CVE-2026-44627

Integer overflow to buffer overflow for some IntelR oneAPI Deep Neural Network Library oneDNN software before version v2026.0.0 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enab...

CVE-2026-44627

Integer overflow to buffer overflow for some IntelR oneAPI Deep Neural Network Library oneDNN software before version v2026.0.0 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enab...

EUVD-2026-121319

Integer overflow to buffer overflow for some IntelR oneAPI Deep Neural Network Library oneDNN software before version v2026.0.0 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enab...

CVE-2026-44627

Integer overflow to buffer overflow for some IntelR oneAPI Deep Neural Network Library oneDNN software before version v2026.0.0 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enab...

CVE-2026-44627

The Intel(R) oneAPI Deep Neural Network Library (oneDNN) software, specifically versions prior to v2026.0.0 , is susceptible to an integer overflow to buffer overflow vulnerability within Ring 3: User Applications. This flaw allows an unprivileged software adversary with authenticated user access...

CVE-2026-44627: n/a Intel(R) oneAPI Deep Neural Network Library (oneDNN) software: Integer overflow to buffer overflow for some Intel(R) oneAPI Deep Neural Network Library (oneDNN) software before…

Integer overflow to buffer overflow for some IntelR oneAPI Deep Neural Network Library oneDNN software before version v2026.0.0 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enab...

Sony neural network library input validation error vulnerability

Versions 1.39.0 and earlier of Sony’s neural network libraries contain a security vulnerability. This vulnerability stems from a code injection issue in the loadparamintxt function within the python/src/nnabla/utils/cli/encodedecodeparam.py file in the Encode Param Command Handler component,...

CVE-2026-89044

Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the final transfer coding in the Transfer-Encoding header, allowing attackers to smuggle requests by using malformed encoding declarations. Attackers can split Transfer-Encoding...

CVE-2026-89044

Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the final transfer coding in the Transfer-Encoding header, allowing attackers to smuggle requests by using malformed encoding declarations. Attackers can split Transfer-Encoding...

CVE-2026-73259

Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can send a crafted percent-encoded request path to a deployment using MGENABLEDIRLIST and persuade a user to visit it. The mghttpservedir and listdir path in src/http.c places the decoded request URI into the...

CVE-2026-73255

Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control an SSI-enabled file can place directory traversal sequences in an include file or include virtual directive. The mgssi function in src/ssi.c concatenates the directive argument into a filesystem pat...

CVE-2026-73254

Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can create a file with an HTML payload in its name can trigger stored cross-site scripting when a user browses a directory served with MGENABLEDIRLIST. The printdirentry path called by listdir in src/http.c...

CVE-2026-73257

Mongoose is an embedded web server and network library. Priro to version 7.22, a remote unauthenticated attacker can send an HTTP request containing both Content-Length and Transfer-Encoding: chunked. The clcount and tecount checks in the mghttpparse and httpcb paths in src/http.c accept both...

CVE-2026-73253

Mongoose is an embedded web server and network library. Prior to version 7.22, an on-path network attacker with a wildcard certificate for a parent domain can impersonate deeper subdomains to a client using the built-in TLS stack. The mgtlsverifycertsan and mgtlsverifycertcn functions in...

CVE-2026-73256

Mongoose is an embedded web server and network library. Prior to 7.22, a remote unauthenticated attacker can exploit an HTTP/1.0 reverse-proxy deployment by sending a request with Transfer-Encoding: chunked and conflicting framing. The httpcb function in src/http.c tests hm.proto.len with an...

CVE-2026-73258

Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a lone carriage return or line feed in multipart input processed by mghttpnextmultipart in src/http.c. The loops comparing sb and sb + 1, and sh2 and sh2 + 1, use an incorrect AND condition and stop...

ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass

A flaw was found in the ip-address library. This library incorrectly interprets IPv4 address octets with leading zeros as decimal, while standard network parsers interpret them as octal. This inconsistency can cause applications to misclassify network targets, allowing a remote attacker to bypass...

OSV-2026-1161 Heap-buffer-overflow in ppp_tx_frame

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=546440470 Crash type: Heap-buffer-overflow WRITE Crash state: ppptxframe ppprx mgtcpiprx...

Security update for prometheus-ha_cluster_exporter

This update for prometheus-haclusterexporter fixes the following issue: CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266552. Other updates and bugfixes: Release 1.4.2 Use proper obs time forma...

CLEANSTART-2026-FV79231 Netty is a network application framework for development of protocol servers and clients

Multiple security vulnerabilities affect the s3proxy package. Netty is a network application framework for development of protocol servers and clients. See references for individual vulnerability details...