CVE-2026-43622 llama.cpp b1886–b7445 Double Free via llama-android.cpp

llama.cpp builds b1886 through b7445 contain a double free vulnerability in the LLaMA-Android JNI wrapper where new1batch allocates memory using malloc while free1batch deallocates it using the C++ delete operator, causing heap metadata corruption. Attackers can trigger this memory management...

CVE-2026-64640

Apache Polaris did not consistently validate storage locations supplied during table and view registration. An authenticated principal with permission to register a table or view could, depending on the affected release and registration path, cause Polaris to use the catalog's storage credentials...

CVE-2026-64640

Apache Polaris is affected by a storage-location validation flaw during table/view registration. An authenticated user with table- or view-registration privileges could trigger Polaris to use the catalog’s storage credentials to read a caller-supplied Iceberg metadata file before confirming it li...

CVE-2026-64640 Apache Polaris: register endpoint reads attacker-controlled storage location before allowed-locations validation

Apache Polaris did not consistently validate storage locations supplied during table and view registration. An authenticated principal with permission to register a table or view could, depending on the affected release and registration path, cause Polaris to use the catalog's storage credentials...

CVE-2026-64640 Apache Polaris: register endpoint reads attacker-controlled storage location before allowed-locations validation

Apache Polaris did not consistently validate storage locations supplied during table and view registration. An authenticated principal with permission to register a table or view could, depending on the affected release and registration path, cause Polaris to use the catalog's storage credentials...

EUVD-2026-53835

Apache Polaris did not consistently validate storage locations supplied during table and view registration. An authenticated principal with permission to register a table or view could, depending on the affected release and registration path, cause Polaris to use the catalog's storage credentials...

EUVD-2026-53682

Buffer Overflow vulnerability in open62541 v1.5.5 allows a remote attacker to cause a denial of service via the ServiceCall validates input arguments against runtime-resolved InputArguments metadata...

DEBIAN-CVE-2026-67869

Buffer Overflow vulnerability in open62541 v1.5.5 allows a remote attacker to cause a denial of service via the ServiceCall validates input arguments against runtime-resolved InputArguments metadata...

CVE-2026-34966

Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default http.Get without a custom DialContext. Attackers can supply...

GHSA-945V-V9P3-V5XW rclone local `--metadata` applies attacker-controlled mode/uid - setuid binary planted from an untrusted remote

Summary When writing an object with metadata, the local backend applies the source-supplied mode, uid, and gid verbatim: it parses mode as an octal integer and passes it straight into os.Chmodo.path, os.FileModeumode, and passes uid/gid straight into os.Chown. The value is never masked to...

rclone local `--metadata` applies attacker-controlled mode/uid - setuid binary planted from an untrusted remote

Summary When writing an object with metadata, the local backend applies the source-supplied mode, uid, and gid verbatim: it parses mode as an octal integer and passes it straight into os.Chmodo.path, os.FileModeumode, and passes uid/gid straight into os.Chown. The value is never masked to...

CVE-2026-55524

PraisonAI is a multi-agent teams system. In versions prior to 1.6.58, the webcrawl tool performs its SSRF check only on the initially supplied URL, allowing the protection to be bypassed so the tool connects to attacker-chosen internal destinations. The check resolves the hostname once with...

CVE-2026-55523

PraisonAI is a multi-agent teams system. In versions 1.5.128 through 1.6.57, the praisonaiagents.tools.webcrawltools.webcrawl function is vulnerable to server-side request forgery. While it validates the initially supplied URL and blocks direct loopback and private destinations, its default httpx...

CVE-2026-71261

A flaw was found in drlibs. An integer overflow vulnerability exists in the W64 CUE chunk metadata parsing within the drwav.h component. A remote attacker could exploit this by providing a specially crafted W64 WAV file. This could lead to a heap buffer overflow, potentially allowing for arbitrar...

keycloak-services: keycloak-services: SAML broker metadata import disables response signature validation

A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak. When importing identity provider metadata that lacks specific usage attributes for keys, the system incorrectly disables...

keycloak-admin-ui: keycloak-admin-ui:Admin UI extension brute-force-user endpoint bypasses FGAPv2 user view restrictions

A vulnerability was discovered in Keycloak's Admin UI extension that allows certain administrative users to bypass security restrictions. When Fine-Grained Admin Permissions FGAPv2 are enabled, an administrator who should only be able to search for users but not view their full details can use a...

keycloak-services: keycloak-services: SAML broker metadata import disables response signature validation

A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak. When importing identity provider metadata that lacks specific usage attributes for keys, the system incorrectly disables...

CVE-2026-9203

A server-side request forgery vulnerability in Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with low-privileged roles to bypass protections for cloud instance metadata endpoints. Successful exploitation can disclose cloud credentials and compromise cloud resourc...

EUVD-2026-53431

A server-side request forgery vulnerability in Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with low-privileged roles to bypass protections for cloud instance metadata endpoints. Successful exploitation can disclose cloud credentials and compromise cloud resourc...

CVE-2026-16443

A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak. When importing identity provider metadata that lacks specific usage attributes for keys, the system incorrectly disables...