CVE-2026-31790

Issue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can send contents of an uninitialized memory buffer to a malicious peer. Impact summary: The uninitialized buffer might contain sensitive data from the previous execution of the application process whi...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect through the redirecturi parameter in multiple endpoints ForgotPassword, MagicLinkLogin, Signup, InviteMembers, OAuthLoginHandler, VerifyEmailHandler which is not validated against AllowedOrigins. An attacker can obtain...

CVE-2026-34992

Antrea is a Kubernetes networking solution intended to be Kubernetes native. Prior to 2.4.5 and 2.5.2, a missing encryption vulnerability affects inter-Node Pod traffic. In Antrea clusters configured for dual-stack networking with IPsec encryption enabled trafficEncryptionMode: ipsec, Antrea fail...

DEBIAN-CVE-2026-34444

Lupa integrates the runtimes of Lua or LuaJIT2 into CPython. In 2.6 and earlier, attributefilter is not consistently applied when attributes are accessed through built-in functions like getattr and setattr. This allows an attacker to bypass the intended restrictions and eventually achieve arbitra...

EUVD-2026-19231

Mattermost Plugin Legal Hold versions =1.1.4 fail to halt request processing after a failed authorization check in ServeHTTP which allows an authenticated attacker to access, create, download, and delete legal hold data via crafted API requests to the plugin's endpoints. Mattermost Advisory ID:...

kernel: Linux kernel: Local denial of service and memory leak in DAMON sysfs via setup failure

A flaw was found in the Linux kernel's Data Access MONitor DAMON sysfs interface. A local attacker, typically a privileged user, could exploit a cleanup bug during DAMON context setup. If the setup fails after the attrs directory is created, stale sysfs directories are left behind. This can lead ...

BIT-NODE-MIN-2026-21712

A flaw in Node.js URL processing causes an assertion failure in native code when url.format is called with a malformed internationalized domain name IDN containing invalid characters, crashing the Node.js process...

BIT-NODE-2026-21712

A flaw in Node.js URL processing causes an assertion failure in native code when url.format is called with a malformed internationalized domain name IDN containing invalid characters, crashing the Node.js process...

CVE-2026-31409

In the Linux kernel, the following vulnerability has been resolved: ksmbd: unset conn-binding on failed binding request When a multichannel SMB2SESSIONSETUP request with SMB2SESSIONREQFLAGBINDING fails ksmbd sets conn-binding = true but never clears it on the error path. This leaves the connectio...

The vulnerability of the WebML component in the Google Chrome browser, which allows a hacker to trigger a service failure.

The vulnerability of the WebML component in Google Chrome relates to writing beyond the buffer boundaries. Exploiting this vulnerability could allow a malicious actor to cause a service failure through a specially created HTML page...

The vulnerability of the WebML component in the Google Chrome browser, which allows a hacker to trigger a service failure.

The vulnerability of the WebML component in Google Chrome browser is related to buffer overflow in dynamic memory. Exploiting this vulnerability could allow a malicious actor to cause a service failure through a specially created HTML page...

The vulnerability of the Delete() function in the Go programming language, which allows a hacker to trigger a service failure

The vulnerability of the Delete function in the Go programming language is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause service failures...

The vulnerability of the RDP client FreeRDP, related to the lack of use of the assert() function, allows a hacker to trigger a service failure.

The vulnerability of the RDP client FreeRDP is related to the lack of use of the assert function. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

Mattermost 安全漏洞

Mattermost is an open-source collaboration platform developed by the American company Mattermost. There is a security vulnerability in Mattermost; this vulnerability stems from the failure of authorization checks, which allows requests to continue processing without being stopped. This may allow...

The vulnerability of the WebML component in the Google Chrome browser, which allows a hacker to trigger a service failure.

The vulnerability of the WebML component in Google Chrome relates to a numerical overflow condition. Exploiting this vulnerability could allow an attacker to cause a service failure through the use of a specially crafted HTML page...

PT-2026-30635

Memory corruption when buffer copy operation fails due to integer overflow during attestation report generation...

PT-2026-30601

Mattermost Plugin Legal Hold versions =1.1.4 fail to halt request processing after a failed authorization check in ServeHTTP which allows an authenticated attacker to access, create, download, and delete legal hold data via crafted API requests to the plugin's endpoints. Mattermost Advisory ID:...

CVE-2026-31409

In the Linux kernel, the following vulnerability has been resolved: ksmbd: unset conn-binding on failed binding request When a multichannel SMB2SESSIONSETUP request with SMB2SESSIONREQFLAGBINDING fails ksmbd sets conn-binding = true but never clears it on the error path. This leaves the connectio...

Vulnerability of the progressive_decompress_tile_upgrade() function in the RDP client FreeRDP, allowing a hacker to trigger a service failure

The vulnerability of the progressivedecompresstileupgrade function in the RDP client FreeRDP is related to integer overflow. Exploiting this vulnerability could allow a malicious actor to cause service failure...

The vulnerability of the GNU Binutils development tool, related to reading beyond the buffer boundaries in memory, allows an attacker to disclose protected information or cause system failures.

The vulnerability of the GNU Binutils development tool lies in the reading of data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to disclose sensitive information or cause system failures...