CVE-2026-45099 Terragrunt: Arbitrary File Deletion via Malicious Module Manifest

Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu or Terraform to scale. Prior to 1.0.4, Terragrunt trusts paths decoded from a downloaded module's .terragrunt-module-manifest during fileManifest.Clean in internal/util/file.go. A malicious or...

EUVD-2026-64128

Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu or Terraform to scale. Prior to 1.0.4, Terragrunt trusts paths decoded from a downloaded module's .terragrunt-module-manifest during fileManifest.Clean in internal/util/file.go. A malicious or...

CVE-2026-45099 Terragrunt: Arbitrary File Deletion via Malicious Module Manifest

Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu or Terraform to scale. Prior to 1.0.4, Terragrunt trusts paths decoded from a downloaded module's .terragrunt-module-manifest during fileManifest.Clean in internal/util/file.go. A malicious or...

qt5-qtsvg: qt6-qtsvg: qt: Denial of Service via deeply nested SVG elements

A flaw was found in the Qt SVG module. A remote attacker could trigger this issue by providing a specially crafted SVG Scalable Vector Graphics file containing deeply nested elements. When parsed, this leads to uncontrolled recursion and stack exhaustion, resulting in an application crash and a...

AZL-96984 CVE-2026-54789 affecting package mod_auth_openidc 2.4.14.2-2

modauthopenidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of...

CVE-2026-54789

modauthopenidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of...

EUVD-2026-64000

modauthopenidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of...

CVE-2026-54789 mod_auth_openidc has out-of-bounds read and write in state cookie parsing

modauthopenidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of...

CVE-2026-54789 mod_auth_openidc has out-of-bounds read and write in state cookie parsing

modauthopenidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of...

CVE-2026-54789 mod_auth_openidc has out-of-bounds read and write in state cookie parsing

modauthopenidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of...

CVE-2026-74457

A flaw was found in the Linux kernel's peakusb module. A malicious USB device could send a specially crafted payload, leading to a heap out-of-bounds read. This vulnerability can cause a kernel panic, resulting in a Denial of Service DoS for the affected system. Mitigation Mitigation for this iss...

CVE-2026-48590

XML Injection vulnerability in joshnuss xmlbuilder XmlBuilder module allows Content Spoofing, XML Injection. This vulnerability is associated with program files lib/xmlbuilder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.element/1, XmlBuilder.element/2,...

CVE-2026-47079

Inappropriate Encoding for Output Context vulnerability in joshnuss xmlbuilder XmlBuilder module allows Content Spoofing, Cross-site Scripting. This vulnerability is associated with program files lib/xmlbuilder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2,...

CVE-2026-48590 Element and Attribute Names Injected Verbatim into XML Output in xml_builder

XML Injection vulnerability in joshnuss xmlbuilder XmlBuilder module allows Content Spoofing, XML Injection. This vulnerability is associated with program files lib/xmlbuilder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.element/1, XmlBuilder.element/2,...

CVE-2026-48590

XML Injection vulnerability in joshnuss xmlbuilder XmlBuilder module allows Content Spoofing, XML Injection. This vulnerability is associated with program files lib/xmlbuilder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.element/1, XmlBuilder.element/2,...

CVE-2026-48590 Element and Attribute Names Injected Verbatim into XML Output in xml_builder

XML Injection vulnerability in joshnuss xmlbuilder XmlBuilder module allows Content Spoofing, XML Injection. This vulnerability is associated with program files lib/xmlbuilder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.element/1, XmlBuilder.element/2,...

CVE-2026-74459

A flaw was found in the Linux kernel's can: etases58x module. A memory leak occurs in the es58xreadbulkcallback function when an Urban Request Block URB resubmission fails. This failure prevents the proper release of the associated receive RX buffer, leading to a gradual exhaustion of system...

CVE-2026-65613

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Webhook module while listing and deleting deliveries. This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to versio...

CVE-2026-59085

Server-Side Request Forgery SSRF vulnerability in Apache CloudStack's webhook module, exploitable via webhook delivery requests. This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1....

CVE-2026-74474

A flaw was found in the Linux kernel's vxlan module. This vulnerability arises from the incorrect handling of network packet headers during data transmission. Specifically, certain functions within the vxlan module fail to properly account for the initial part of the network packet, known as the...