88434 matches found
EUVD-2026-57788
baseline-browser-mapping 2.x before 2.11.0 calls process.exit instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination, causing denial of service...
CVE-2026-45819
baseline-browser-mapping 2.x before 2.11.0 calls process.exit instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination, causing denial of service...
ALSA-2026:54575 Important: dracut security update
The dracut packages contain an event-driven initial RAM file system initramfs generator infrastructure based on the udev device manager. The virtual file system, initramfs, is loaded together with the kernel at boot time and initializes the system, so it can read and boot from the root partition...
CVE-2026-19487: Always-Incorrect Control Flow Implementation
Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in Sfindbyclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one...
CVE-2026-18020: Out-of-bounds Read
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an off-by-one error in bounds checking...
CVE-2026-53794: Improper Validation of Specified Quantity in Input
rsync before 3.5.0 contains a logic error in --max-alloc handling that allows a sender or configuration setting --max-alloc=0 to disable allocation sanity checks entirely rather than enforcing a zero-byte cap. Attackers can exploit this flaw to cause the receiver to attempt unbounded memory...
PT-2026-76575
Summary Vault token and secret values are exposed in thrown errors when using hashi-vault-js. Details Every API method in Vault.js executes throw parseAxiosErrorerr, which returns the raw AxiosError untouched. That error carries the full Axios configuration, including the X-Vault-Token header and...
CVE-2026-6464: Inclusion of Functionality from Untrusted Control Sphere
Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection. If the "COPY FROM STDIN" or "\copy FROM STDIN" command fails before the server indicates that it awaits input rows, psql processes the in-line...
CVE-2026-70463: Incorrect Authorization
rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting the user list, which fails to correctly handle entries of the form @Group Name where the group name contains a space. The space within the...
PT-2026-71670
Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.26.0 Description An issue exists where the validation exception handler in vllm/entrypoints/openai/server utils.py converts FastAPI RequestValidationError objects using strexc, and the sanitize message function in...
PT-2026-75934
Summary Vault token and secret values are exposed in thrown errors when using hashi-vault-js. Details Every API method in Vault.js executes throw parseAxiosErrorerr, which returns the raw AxiosError untouched. That error carries the full Axios configuration, including the X-Vault-Token header and...
CVE-2026-6464: Inclusion of Functionality from Untrusted Control Sphere
Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection. If the "COPY FROM STDIN" or "\copy FROM STDIN" command fails before the server indicates that it awaits input rows, psql processes the in-line...
ROS-20260813-73-0052
The vulnerability in uriparser is related to numerical truncation errors. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
ALSA-2026:54576 Important: dracut security update
The dracut packages contain an event-driven initial RAM file system initramfs generator infrastructure based on the udev device manager. The virtual file system, initramfs, is loaded together with the kernel at boot time and initializes the system, so it can read and boot from the root partition...
ROS-20260813-73-0046
The vulnerability in freerdp3 is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to cause a service failure...
SUSE SLED15: libxmlrpc++8 / libxmlrpc3 / libxmlrpc_abyss++8 / libxmlrpc_abyss3 / etc (SUSE-SU-2026:3572-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3572-1 advisory. This update for xmlrpc-c fixes the following issue: - CVE-2026-15928: reflected cross-site scripting XSS via HTML...
PT-2026-71779
Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description An issue exists where the state stored for an Observability Onboarding flow is not bound to the user who created it. Because the routes used to read and update this state do not verify...
Important: dracut security update
The dracut packages contain an event-driven initial RAM file system initramfs generator infrastructure based on the udev device manager. The virtual file system, initramfs, is loaded together with the kernel at boot time and initializes the system, so it can read and boot from the root partition...
CVE-2026-72669: Missing Authorization
The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state do not verify ownership. An authenticated user who holds only generic read access to the space can therefore discover the onboarding flow...
PT-2026-71632
Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0 Description A logic error exists in the handling of the --max-alloc configuration. When a sender or configuration sets --max-alloc=0, allocation sanity checks are entirely disabled instead of enforcing a zero-byte...