Astra Linux – Vulnerability in libxml2

In libxml2 version 2.9.13, the valid.c file contains a use-after-free issue with the ID and IDREF attributes...

[SECURITY] Fedora 44 Update: libXfont2-2.0.9-1.fc44

X.Org X11 libXfont2 runtime library...

EUVD-2026-53677

A heap-based buffer overflow exists in lib60870-C 2.4.0 in the server-side FileSegment ASDU encoding path. The issue occurs because FileSegmentencode validates only the standalone segment length via FileSegmentGetMaxDataSize and does not verify the residual capacity of the current ASDU frame befo...

EUVD-2026-49375

ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks...

CLEANSTART-2026-MT60629 Security fixes in go-fips-1.24 1.24.9-r0

Package go-fips-1.24 version 1.24.9-r0 fixes 10 vulnerabilities: CVE-2025-61725, CVE-2025-61724, CVE-2025-61723, CVE-2025-58189, CVE-2025-58188...

UBUNTU-CVE-2026-62389

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as a duplicate of CVE-2026-48779...

adm-zip: Crafted ZIP file triggers 4GB memory allocation

adm-zip before 0.5.18 is vulnerable to denial of service via a crafted ZIP file with a manipulated uncompressed size header field. In zipEntry.js line 103, Buffer.alloccentralHeader.size allocates memory based on the declared uncompressed size from the ZIP central directory header without...

UBUNTU-CVE-2026-59868

js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.0, when merge keys are enabled, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in...

com.mig82:folder-properties (57.vde5161ec7a_b_a), io.jenkins.blueocean:blueocean (>=1.27.17, <=1.27.18) +13 more potentially affected by CVE-2026-57284 via io.jenkins.plugins:pipeline-groovy-lib (704.vc58b_8890a_384)

io.jenkins.plugins:pipeline-groovy-lib MAVEN version 704.vc58b8890a384 is affected by a known vulnerability. The following packages have a transitive dependency on io.jenkins.plugins:pipeline-groovy-lib and may be impacted: - com.mig82:folder-properties 57.vde5161ec7aba -...

io.jenkins.plugins:pipeline-agent-build-history (>=44.va_44d94c22f21, <=90.vf089ff0feff9), io.jenkins.plugins:pipeline-groovy-lib (>=727.ve832a_9244dfa, <=745.vdf6077913de0) +4 more potentially affected by CVE-2026-57280 via org.jenkins-ci.plugins:script-security (1326.vdb_c154de8669)

org.jenkins-ci.plugins:script-security MAVEN version 1326.vdbc154de8669 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - io.jenkins.plugins:pipeline-agent-build-history =44.va44d94c22f21,...

io.jenkins.plugins:pipeline-agent-build-history (>=44.va_44d94c22f21, <=90.vf089ff0feff9), io.jenkins.plugins:pipeline-groovy-lib (>=727.ve832a_9244dfa, <=745.vdf6077913de0) +4 more potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1326.vdb_c154de8669)

org.jenkins-ci.plugins:script-security MAVEN version 1326.vdbc154de8669 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - io.jenkins.plugins:pipeline-agent-build-history =44.va44d94c22f21,...

io.jenkins.plugins:shared-library-version-override (>=17.v786074c9fce7, <=24.v102d8d8fd0cc) potentially affected by CVE-2026-57283 via io.jenkins.plugins:pipeline-groovy-lib (730.ve57b_34648c63)

io.jenkins.plugins:pipeline-groovy-lib MAVEN version 730.ve57b34648c63 is affected by a known vulnerability. The following packages have a transitive dependency on io.jenkins.plugins:pipeline-groovy-lib and may be impacted: - io.jenkins.plugins:shared-library-version-override =17.v786074c9fce7,...

io.jenkins.plugins:shared-library-version-override (>=17.v786074c9fce7, <=24.v102d8d8fd0cc) potentially affected by CVE-2026-57284 via io.jenkins.plugins:pipeline-groovy-lib (730.ve57b_34648c63)

io.jenkins.plugins:pipeline-groovy-lib MAVEN version 730.ve57b34648c63 is affected by a known vulnerability. The following packages have a transitive dependency on io.jenkins.plugins:pipeline-groovy-lib and may be impacted: - io.jenkins.plugins:shared-library-version-override =17.v786074c9fce7,...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the processPIDEvents goroutine. An attacker can cause the agent to become unresponsive by triggering the goroutine to block indefinitely in the openat2 syscall, preventing further...

io.jenkins.plugins:shared-library-version-override (>=17.v786074c9fce7, <=24.v102d8d8fd0cc) potentially affected by CVE-2026-48921 via io.jenkins.plugins:pipeline-groovy-lib (730.ve57b_34648c63)

io.jenkins.plugins:pipeline-groovy-lib MAVEN version 730.ve57b34648c63 is affected by a known vulnerability. The following packages have a transitive dependency on io.jenkins.plugins:pipeline-groovy-lib and may be impacted: - io.jenkins.plugins:shared-library-version-override =17.v786074c9fce7,...

Malicious code in apple-app-store-server-library-v3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0927a2d11dc610a60127985e95a9851a1bcad74ff346884f089d1d25545aa896 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

io.jenkins.plugins:pipeline-agent-build-history (>=44.va_44d94c22f21, <=90.vf089ff0feff9), io.jenkins.plugins:pipeline-groovy-lib (>=727.ve832a_9244dfa, <=745.vdf6077913de0) +4 more potentially affected by CVE-2026-42519 via org.jenkins-ci.plugins:script-security (1326.vdb_c154de8669)

org.jenkins-ci.plugins:script-security MAVEN version 1326.vdbc154de8669 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - io.jenkins.plugins:pipeline-agent-build-history =44.va44d94c22f21,...

JLSEC-2026-311

HDF5 Library through 1.14.3 contains a heap-based buffer over-read in H5Odtypeencodehelper in H5Odtype.c...

CVE-2026-3505

Allocation of resources without limits or throttling, Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg on all pg modules. This vulnerability is associated with program files AEADEncDataPacket.Java, BcAEADUtil.Java, JceAEADUtil.Java,...

CVE-2026-39959 Tmds.DBus: malicious D-Bus peers can spoof signals, exhaust file descriptor resources, and cause denial of service

Tmds.DBus provides .NET libraries for working with D-Bus from .NET. Tmds.DBus and Tmds.DBus.Protocol are vulnerable to malicious D-Bus peers. A peer on the same bus can spoof signals by impersonating the owner of a well-known name, exhaust system resources or cause file descriptor spillover by...