2027 matches found
EUVD-2026-63487
The Lean 4 kernel does not verify that the structure named in a projection expression matches the type of the value being projected, and environment::addinductive in src/kernel/inductive.cpp did not type check the nested inductive applications that are replaced by auxiliary types, so their...
CVE-2026-72844 Lean 4 Kernel Type Checking Bypass via Mismatched Structure Projections
The Lean 4 kernel does not verify that the structure named in a projection expression matches the type of the value being projected, and environment::addinductive in src/kernel/inductive.cpp did not type check the nested inductive applications that are replaced by auxiliary types, so their...
CVE-2026-72844 Lean 4 Kernel Type Checking Bypass via Mismatched Structure Projections
The Lean 4 kernel does not verify that the structure named in a projection expression matches the type of the value being projected, and environment::addinductive in src/kernel/inductive.cpp did not type check the nested inductive applications that are replaced by auxiliary types, so their...
ruby/json: Ruby JSON: Denial of Service or Information Disclosure via format string injection
A flaw was found in Ruby JSON. This vulnerability, a format string injection, allows a remote attacker to cause a denial of service DoS or disclose sensitive information. The flaw occurs when processing specially crafted user-supplied documents with the allowduplicatekey: false parsing option...
CVE-2026-72844: Access of Resource Using Incompatible Type
The Lean 4 kernel does not verify that the structure named in a projection expression matches the type of the value being projected, and environment::addinductive in src/kernel/inductive.cpp did not type check the nested inductive applications that are replaced by auxiliary types, so their...
EUVD-2026-62295
When auditing a system call executed via ptracePTSCREMOTE, the kernel passed the return value of an internal setup function to AUDITSYSCALLEXIT rather than the actual result of the executed system call. As a result, committed audit records for system calls which returned an error do not reflect t...
Lemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = False
Summary The CertificateExport handler in lemur/certificates/views.py nests its entire ownership / CertificatePermission check inside an if plugin.requireskey: branch. When the selected export plugin advertises requireskey = False, the authorization check is skipped entirely and any authenticated...
CVE-2026-13221
A flaw was found in Perl. When the Perl regular expression engine processes patterns with a very large number of alternative fixed strings, an internal data field can overflow. This leads to silently incorrect regular expression matches, causing the engine to either match strings it should not...
CVE-2026-47245
MyBB is free and open source forum software. Prior to 1.8.40, the User CP Buddy/Ignore List component does not validate reciprocal buddy-list updates correctly. The usercp.php?action=doeditlists delete handler removes the selected entry from the acting user's list and then updates...
CVE-2026-75834
Grav before 2.0.14 contains a stored cross-site scripting vulnerability in the Security::detectXss function system/src/Grav/Common/Security.php. All XSS detection patterns use the PCRE /u UTF-8 modifier, so a single invalid UTF-8 byte anywhere in page content causes pregmatch to return false for...
BELL-CVE-2026-74418 CVE-2026-74418 does not affect BellSoft software
Bulletin has no description...
BELL-CVE-2026-74414 CVE-2026-74414 does not affect BellSoft software
Bulletin has no description...
BELL-CVE-2026-74343 CVE-2026-74343 does not affect BellSoft software
Bulletin has no description...
BELL-CVE-2026-74326 CVE-2026-74326 does not affect BellSoft software
Bulletin has no description...
BELL-CVE-2026-72471 CVE-2026-72471 does not affect BellSoft software
Bulletin has no description...
BELL-CVE-2026-72456 CVE-2026-72456 does not affect BellSoft software
Bulletin has no description...
BELL-CVE-2026-72417 CVE-2026-72417 does not affect BellSoft software
Bulletin has no description...
BELL-CVE-2026-72173 CVE-2026-72173 does not affect BellSoft software
Bulletin has no description...
Unity Linux 20.1050e Security Update: kernel (UTSA-2026-101994)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101994 advisory. In the Linux kernel, the following vulnerability has been resolved: fanotify: fix false positive on permission events fsnotifygetmarksafe may return false for a mark...
PT-2026-76934
Name of the Vulnerable Software and Affected Versions Grav versions prior to 2.0.14 Description A stored cross-site scripting issue exists in the Security::detectXss function located in system/src/Grav/Common/Security.php. The XSS detection patterns utilize the PCRE /u UTF-8 modifier, which cause...