76597 matches found
CVE-2026-42500
A flaw was found in golang.org/x/image/bmp. A remote attacker could exploit this vulnerability by providing a specially crafted paletted BMP Bitmap file. Decoding this file with an out-of-range palette index causes the application to panic when accessing invalid image pixels, leading to a Denial ...
DEBIAN-CVE-2026-19487
Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in Sfindbyclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one...
CVE-2026-73670
The CVE describes a SQL injection in a CMS affecting the admin/db_data.php component (line 509) that allows authenticated administrators to inject arbitrary SQL into a SHOW COLUMNS FROM statement via an unsanitized table_name parameter (GET/POST). Attack techniques include table traversal, time-b...
K000162904: Linux kernel vulnerability CVE-2022-50053
Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: iavf: Fix reset error handling Do not call iavfclose in iavfresettask error handling. Doing so can lead to double call of napidisable, which can lead to deadlock there. Removing VF would lead to...
CVE-2026-53794
rsync before 3.5.0 contains a logic error in --max-alloc handling that allows a sender or configuration setting --max-alloc=0 to disable allocation sanity checks entirely rather than enforcing a zero-byte cap. Attackers can exploit this flaw to cause the receiver to attempt unbounded memory...
CVE-2026-73555
vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the validationexceptionhandler in vllm/entrypoints/openai/serverutils.py converts FastAPI RequestValidationError objects with strexc, and sanitizemessage in vllm/entrypoints/utils.py does not remove traceback-styl...
CVE-2026-73555 vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages
vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the validationexceptionhandler in vllm/entrypoints/openai/serverutils.py converts FastAPI RequestValidationError objects with strexc, and sanitizemessage in vllm/entrypoints/utils.py does not remove traceback-styl...
CVE-2026-73555
CVE-2026-73555 affects vLLM prior to 0.26.0. The issue arises in the validation_exception_handler (vllm/entrypoints/openai/server_utils.py) which converts FastAPI RequestValidationError objects with str(exc), and in sanitize_message (vllm/entrypoints/utils.py) which does not remove traceback-styl...
CVE-2026-53794 rsync < 3.5.0 Denial of Service via --max-alloc=0 Logic Error
rsync before 3.5.0 contains a logic error in --max-alloc handling that allows a sender or configuration setting --max-alloc=0 to disable allocation sanity checks entirely rather than enforcing a zero-byte cap. Attackers can exploit this flaw to cause the receiver to attempt unbounded memory...
EUVD-2026-58033
rsync before 3.5.0 contains a logic error in --max-alloc handling that allows a sender or configuration setting --max-alloc=0 to disable allocation sanity checks entirely rather than enforcing a zero-byte cap. Attackers can exploit this flaw to cause the receiver to attempt unbounded memory...
CVE-2026-53794
The CVE affects rsync prior to 3.5.0. A logic error in --max-alloc handling allows a sender or config setting --max-alloc=0 to bypass allocation sanity checks, causing unbounded memory allocations for file lists/data structures and potential memory exhaustion leading to DoS. Remediation: upgrade ...
CVE-2026-53794 rsync < 3.5.0 Denial of Service via --max-alloc=0 Logic Error
rsync before 3.5.0 contains a logic error in --max-alloc handling that allows a sender or configuration setting --max-alloc=0 to disable allocation sanity checks entirely rather than enforcing a zero-byte cap. Attackers can exploit this flaw to cause the receiver to attempt unbounded memory...
NPM: hashi-vault-js: Vault token and secret values exposed in thrown errors
NPM: hashi-vault-js: Vault token and secret values exposed in thrown errors vulnerability discovered by ? in WordPress Npm hashi-vault-js versions = 0.5.1...
CVE-2026-6464
Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection. If the "COPY FROM STDIN" or "\copy FROM STDIN" command fails before the server indicates that it awaits input rows, psql processes the in-line...
CVE-2026-6464 PostgreSQL psql COPY FROM STDIN early failure processes data lines as psql commands
Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection. If the "COPY FROM STDIN" or "\copy FROM STDIN" command fails before the server indicates that it awaits input rows, psql processes the in-line...
CVE-2026-45819
baseline-browser-mapping 2.x before 2.11.0 calls process.exit instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination, causing denial of service...
EUVD-2026-57788
baseline-browser-mapping 2.x before 2.11.0 calls process.exit instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination, causing denial of service...
Squid Proxy - HTTP Authentication Credentials Disclosure
Squid versions prior to 7.2 fail to redact HTTP authentication credentials in error page responses. The Authorization header value is embedded in plain text inside the mailto: diagnostic block when Squid generates an error page e.g. ERRDNSFAIL. id: CVE-2025-62168 info: name: Squid Proxy - HTTP...
Important: dracut security update
The dracut packages contain an event-driven initial RAM file system initramfs generator infrastructure based on the udev device manager. The virtual file system, initramfs, is loaded together with the kernel at boot time and initializes the system, so it can read and boot from the root partition...
