CVE-2026-32687: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in elixir-ecto postgrex 'Elixir.Postgrex.Notifications' module allows SQL Injection. The channel argument passed to 'Elixir.Postgrex.Notifications':listen/3 and...

CVE-2026-8291: Improper Resource Shutdown or Release

A weakness has been identified in Open5GS up to 2.7.7. Impacted is the function ogsnnrfnfmhandlenfprofile of the file lib/sbi/nnrf-handler.c of the component NRF. This manipulation causes denial of service. The attack is possible to be carried out remotely. The exploit has been made available to...

CVE-2026-8226: Improper Resource Shutdown or Release

A security flaw has been discovered in Open5GS up to 2.7.7. This vulnerability affects the function ogspccruleinstallflowfrommedia in the library /lib/proto/types.c. The manipulation results in denial of service. The attack can be launched remotely. The exploit has been released to the public and...

CVE-2026-8186: Out-of-bounds Read

A vulnerability was detected in Open5GS up to 2.7.7. This affects the function ogssbiclientsendviascporsepp in the library lib/sbi/client.c of the component NF. Performing a manipulation results in out-of-bounds read. The attack is possible to be carried out remotely. The patch is named...

CVE-2026-8122: Improper Resource Shutdown or Release

A vulnerability was found in Open5GS up to 2.7.7. This affects the function ogssbidiscoveryoptionaddservicenames in the library /lib/sbi/message.c of the component NSSF. The manipulation results in denial of service. The attack may be performed from remote. The exploit has been made public and...

CVE-2026-43336: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: lib/crypto: chacha: Zeroize permutedstate before it leaves scope Since the ChaCha permutation is invertible, the local variable 'permutedstate' is sufficient to compute the original 'state', and thus the key, even after the...

CVE-2026-41885: Improper Limitation of a Pathname to a Restricted Directory

i18next-locize-backend is a simple i18next backend for locize.com which can be used in Node.js, in the browser and for Deno. Prior to version 9.0.2, i18next-locize-backend interpolates lng, ns, projectId, and version directly into the configured loadPath / privatePath / addPath / updatePath /...

CVE-2026-41673: Uncontrolled Recursion

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, seven recursive traversals in lib/dom.js operate without a depth limit. A sufficiently deeply nested DO...

RHCOS 4 : OpenShift Container Platform 4.8.35 (RHSA-2022:0871)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0871 advisory. - CRI-O: Arbitrary code execution in cri-o via abusing kernel.corepattern kernel parameter CVE-2022-0811 - workflow-cps: OS command...

Malicious code in @rivianlabs/dt-lib-lumberjack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7cf3a31f76f8c2e22a2792aee30736347d17fe5872cb69c7edaecc7728aa6190 The package @rivianlabs/dt-lib-lumberjack was found to contain malicious code. Source: ossf-package-analysis...

SUSE-SU-2026:21544-1 Security update for openssl-3-x86_64-v3-livepatches

This update for openssl-3-x8664-v3-livepatches fixes the following issues: Changes in openssl-3-x8664-v3-livepatches: - Add package for libopenssl3-x86-64-v3-3.5.0 bsc1259271. Fixed: - CVE-2025-11187: Fixed Improper validation of PBMAC1 parameters in PKCS12 MAC verification bsc1256878. -...

MAL-2026-3326 Malicious code in paychex-common-vendor-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77d8076c0caa289734b5a30b904f9a075ae0d55ea3fc74f665806d913efe7d28 The package paychex-common-vendor-lib was found to contain malicious code. Source: ghsa-malware...

dovecot: Fix of CVE-2017-15132

CVE-2017-15132: fix memory leak and hash-table use-after-free in authclientrequestabort lib-auth. Squashed upstream commits 1a29ed2f96da and a9b135760aea...

p5-Image-ExifTool -- code injection via crafted media

ExifTool versions up to 13.53 contain a code injection flaw in the Processmrld function of lib/Image/ExifTool/GM.pm, reached while parsing JPEG, QuickTime, MOV and MP4 files. When exiftool is invoked with the -ee extract embedded option on a crafted file, a local attacker with low privileges can...

CVE-2026-7580: Improper Control of Generation of Code

A vulnerability was detected in Exiftool up to 13.53. Impacted is the function Processmrld of the file lib/Image/ExifTool/GM.pm of the component JPEG/QuickTime/MOV/MP4. The manipulation of the argument -ee results in code injection. Attacking locally is a requirement. Upgrading to version 13.54 i...

CVE-2026-39804: Allocation of Resources Without Limits or Throttling

Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion when WebSocket permessage-deflate compression is enabled. 'Elixir.Bandit.WebSocket.PerMessageDeflate':inflate/2 in...

CVE-2026-39807: Reliance on Untrusted Inputs in a Security Decision

Reliance on Untrusted Inputs in a Security Decision vulnerability in mtrudel bandit allows unauthenticated transport-state spoofing on plaintext HTTP connections. 'Elixir.Bandit.Pipeline':determinescheme/2 in lib/bandit/pipeline.ex returns the client-supplied URI scheme verbatim, ignoring the...

The vulnerability of the kset_register() function in the lib/kobject.c module of the Linux kernel allows a hacker to cause a service failure.

The vulnerability of the ksetregister function in the lib/kobject.c module of the Linux kernel is related to the assignment of the NULL pointer. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2026-31689: NULL Pointer Dereference

In the Linux kernel, the following vulnerability has been resolved: EDAC/mc: Fix error path ordering in edacmcalloc When the mci-pvtinfo allocation in edacmcalloc fails, the error path will call putdevice which will end up calling the device's release function. However, the init ordering is wrong...

CVE-2026-42035: Improper Neutralization of CRLF Sequences in HTTP Headers

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, a prototype pollution gadget exists in the Axios HTTP adapter lib/adapters/http.js that allows an attacker to inject arbitrary HTTP headers into outgoing requests. The vulnerability exploits duck-type...