CVE-2026-17113 Cri-o: cri-o: unvalidated image env var causes daemon crash

A flaw was found in CRI-O's container-creation environment-variable handling mergeEnvs in server/utils.go, consumed by setupContainerEnvironmentAndWorkdir in server/containercreate.go. When a CreateContainer request supplies a nil CRI Envs field, CRI-O falls back to using the target OCI image's...

CVE-2026-17113 Cri-o: cri-o: unvalidated image env var causes daemon crash

A flaw was found in CRI-O's container-creation environment-variable handling mergeEnvs in server/utils.go, consumed by setupContainerEnvironmentAndWorkdir in server/containercreate.go. When a CreateContainer request supplies a nil CRI Envs field, CRI-O falls back to using the target OCI image's...

EUVD-2026-65156

A flaw was found in CRI-O's container-creation environment-variable handling mergeEnvs in server/utils.go, consumed by setupContainerEnvironmentAndWorkdir in server/containercreate.go. When a CreateContainer request supplies a nil CRI Envs field, CRI-O falls back to using the target OCI image's...

CVE-2026-17113

CRI-O is vulnerable in its container-creation environment-variable handling (mergeEnvs in server/utils.go, consumed by setupContainerEnvironmentAndWorkdir in server/container_create.go). When a CreateContainer request supplies a nil CRI Envs field, CRI-O falls back to the target OCI image's confi...

CVE-2026-17113

A flaw was found in CRI-O's container-creation environment-variable handling mergeEnvs in server/utils.go, consumed by setupContainerEnvironmentAndWorkdir in server/containercreate.go. When a CreateContainer request supplies a nil CRI Envs field, CRI-O falls back to using the target OCI image's...

Vault Vulnerable to Privilege Escalation via Slash Injection in Templated Policy Paths

Summary A vulnerability was identified in HashiCorp Vault and Vault Enterprise “Vault” such that an authenticated attacker may manipulate an identity value referenced by a templated policy path to gain unintended access to Vault paths. An attacker who can control the referenced identity value may...

CVE-2026-72711

The Lean 4 kernel does not check that the body of an opaque declaration is closed. environment::addopaque omits the checknometavarnofvar call that the definition and theorem paths perform, so a value containing a free variable that is absent from the local context is not rejected outright. A...

CVE-2026-72711 Lean 4 before 4.32.2 Kernel Accepts Opaque Declaration With an Unbound Free Variable

The Lean 4 kernel does not check that the body of an opaque declaration is closed. environment::addopaque omits the checknometavarnofvar call that the definition and theorem paths perform, so a value containing a free variable that is absent from the local context is not rejected outright. A...

CVE-2026-72711 Lean 4 before 4.32.2 Kernel Accepts Opaque Declaration With an Unbound Free Variable

The Lean 4 kernel does not check that the body of an opaque declaration is closed. environment::addopaque omits the checknometavarnofvar call that the definition and theorem paths perform, so a value containing a free variable that is absent from the local context is not rejected outright. A...

CVE-2026-72711 Lean 4 before 4.32.2 Kernel Accepts Opaque Declaration With an Unbound Free Variable

The Lean 4 kernel does not check that the body of an opaque declaration is closed. environment::addopaque omits the checknometavarnofvar call that the definition and theorem paths perform, so a value containing a free variable that is absent from the local context is not rejected outright. A...

CVE-2026-72711

CVE-2026-72711 is a kernel soundness flaw in Lean 4 before 4.32.2. The function environment::add_opaque omits the check_no_metavar_no_fvar closure check that the definition and theorem paths perform. A metaprogram can exploit a stale entry in the type checker's inference cache to submit an opaque...

CVE-2026-72711

The Lean 4 kernel does not check that the body of an opaque declaration is closed. environment::addopaque omits the checknometavarnofvar call that the definition and theorem paths perform, so a value containing a free variable that is absent from the local context is not rejected outright. A...

EUVD-2026-65142

The Lean 4 kernel does not check that the body of an opaque declaration is closed. environment::addopaque omits the checknometavarnofvar call that the definition and theorem paths perform, so a value containing a free variable that is absent from the local context is not rejected outright. A...

CVE-2026-39975 Combodo iTop: Remote code execution using external auth variable value

Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, unauthenticated users could delete the .readonly file on iTop instances, leading to code execution. This file, created during the setup process, prevents users from performing write actions. This issue has been fixed in versi...

CVE-2026-39975 Combodo iTop: Remote code execution using external auth variable value

Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, unauthenticated users could delete the .readonly file on iTop instances, leading to code execution. This file, created during the setup process, prevents users from performing write actions. This issue has been fixed in versi...

CVE-2026-39975 Combodo iTop: Remote code execution using external auth variable value

Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, unauthenticated users could delete the .readonly file on iTop instances, leading to code execution. This file, created during the setup process, prevents users from performing write actions. This issue has been fixed in versi...

Information Exposure

Overview blackduck-c-cpp is a Scanning for c/c++ projects using blackduck and coverity tools Affected versions of this package are vulnerable to Information Exposure inheriting sensitive environment variables by subprocesses during build capture and signature scanning. An attacker can access...

DEBIAN-CVE-2026-78475

A flaw was found in the file-pix ESM plugin in GIMP. When processing a specially crafted PIX image file, the plugin allocates a Variable-Length Array VLA on the stack without proper bounds checking, causing an unbounded stack allocation followed by a 21-byte stack over-read. This can result in a...

CVE-2026-78475

A flaw was found in the file-pix ESM plugin in GIMP. When processing a specially crafted PIX image file, the plugin allocates a Variable-Length Array VLA on the stack without proper bounds checking, causing an unbounded stack allocation followed by a 21-byte stack over-read. This can result in a...

CVE-2026-76072

The Continue CLI applies an incomplete denylist as its only barrier to destructive shell commands when running unattended. In headless mode and auto mode the default policy in extensions/cli/src/permissions/defaultPolicies.ts grants the Bash tool the allow permission, and permissionChecker.ts...