MINI-6458-J4VR-QC94

Bulletin has no description...

MINI-H34J-7H4F-HVM8

Bulletin has no description...

MINI-8VJV-5698-3XR9

Bulletin has no description...

MINI-J9H5-J9HG-RRG3

Bulletin has no description...

MINI-PMH5-4P8X-GQ43

Bulletin has no description...

MINI-3JV8-452W-9P7Q

Bulletin has no description...

DEBIAN-CVE-2026-75140

jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in XmlTreeBuilder that allows remote attackers to exhaust JVM heap memory by supplying a deeply nested XML document with uniquely-namespaced elements. The builder copies the entire inherited...

UBUNTU-CVE-2026-75140

jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in XmlTreeBuilder that allows remote attackers to exhaust JVM heap memory by supplying a deeply nested XML document with uniquely-namespaced elements. The builder copies the entire inherited...

ECHO-912C-D41A-C3C3 assert(has_sequence()) in HeifContext::get_track(). The whole sequence/ track API arrived in v1.20.0: 1.19.8 has no matches for has_sequence, get_track, m_tracks or heif_context_get_track, no libheif/sequences/ and no heif_sequences.h, and context.cc is 1572 lines while the upstream patch targets line 2115. nm -D on the shipped libheif.so exports no sequence/track symbol at all. Same basis as the six entries above. Note Debian still lists this open for trixie - the claim rests on the code evidence, not their triage.

Bulletin has no description...

ECHO-9D99-9ED1-60B7

Bulletin has no description...

ECHO-CAA6-834D-70DC

Bulletin has no description...

ECHO-7EC1-3546-3774

Bulletin has no description...

ECHO-DB00-4309-1170

Bulletin has no description...

ECHO-041C-12C3-789B

Bulletin has no description...

ECHO-EB5E-B491-1225

Bulletin has no description...

ECHO-471F-26DC-2062

Bulletin has no description...

ECHO-C1FF-2E31-6166

Bulletin has no description...

MINI-9PXR-5PXV-XJ5V

Bulletin has no description...

ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass

A flaw was found in the ip-address library. This library incorrectly interprets IPv4 address octets with leading zeros as decimal, while standard network parsers interpret them as octal. This inconsistency can cause applications to misclassify network targets, allowing a remote attacker to bypass...

ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input

A flaw was found in ip-address, a JavaScript library for parsing and manipulating IPv4 and IPv6 addresses. This vulnerability allows a remote attacker to perform cross-site scripting XSS by providing untrusted input to the Address6 constructor. When an application renders the output of...