CVE-2026-16318

The CVE-2026-16318 issue affects server-side QUIC deployments using s2n-tls, where the QUIC transport parameters extension handler uses s2n_alloc instead of s2n_realloc. During TLS 1.3 HelloRetryRequest, the handler runs twice on the same connection; on the second run it zeroes the existing point...

CVE-2026-16318 QUIC Transport Parameters Memory Leak During HelloRetryRequest in s2n-tls

The QUIC transport parameters extension handler in s2n-tls incorrectly uses s2nalloc instead of s2nrealloc to store the peer's transport parameters. When a TLS 1.3 connection goes through a HelloRetryRequest, the handler is called twice on the same connection. On the second call, s2nalloc zeroes...

CVE-2026-16318 QUIC Transport Parameters Memory Leak During HelloRetryRequest in s2n-tls

The QUIC transport parameters extension handler in s2n-tls incorrectly uses s2nalloc instead of s2nrealloc to store the peer's transport parameters. When a TLS 1.3 connection goes through a HelloRetryRequest, the handler is called twice on the same connection. On the second call, s2nalloc zeroes...

CVE-2026-15829 SQL Injection and Security Boundary Bypass in googleapis/mcp-toolbox

A SQL injection CWE-89 and security boundary bypass CWE-863 vulnerability exists in the prebuilt BigQuery forecasting tool bigquery-forecast of googleapis/mcp-toolbox. The tool accepts client-controlled parameters datacol, timestampcol, and idcols as plain strings and interpolates them unescaped...

CVE-2026-15829 SQL Injection and Security Boundary Bypass in googleapis/mcp-toolbox

A SQL injection CWE-89 and security boundary bypass CWE-863 vulnerability exists in the prebuilt BigQuery forecasting tool bigquery-forecast of googleapis/mcp-toolbox. The tool accepts client-controlled parameters datacol, timestampcol, and idcols as plain strings and interpolates them unescaped...

CVE-2026-15829

CVE-2026-15829 affects googleapis/mcp-toolbox (bigquery-forecast). The prebuilt forecasting tool interpolates client-controlled parameters (data_col, timestamp_col, id_cols) into a generated AI.FORECAST query via fmt.Sprintf without re-validation, enabling SQL injection (CWE-89) and a security bo...

EUVD-2026-46317

A SQL injection CWE-89 and security boundary bypass CWE-863 vulnerability exists in the prebuilt BigQuery forecasting tool bigquery-forecast of googleapis/mcp-toolbox. The tool accepts client-controlled parameters datacol, timestampcol, and idcols as plain strings and interpolates them unescaped...

CVE-2026-15792

CVE-2026-15792 affects BuildKit components (notably the LLB solver/llbsolver) where a malicious BuildKit frontend or LLB input can trigger NULL pointer dereference or slice-index panics, crashing the BuildKit daemon. Public detail across sources indicates vulnerable paths in the solver handling a...

CVE-2026-15792 Possible panic when incorrect parameters sent from frontend

A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic...

CVE-2026-15792 Possible panic when incorrect parameters sent from frontend

A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic...

CVE-2026-15792 Possible panic when incorrect parameters sent from frontend

A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic...

SUSE CVE-2026-64049

In the Linux kernel, the following vulnerability has been resolved: drm/msm/adreno: fix userspace-triggered crash on a2xx-a4xx Before a5xx Adreno driver will not try fetching UBWC params because those generations didn't support UBWC anyway, however it's still possible to query UBWC-related params...

PT-2026-62072

Name of the Vulnerable Software and Affected Versions s2n-tls versions prior to v1.7.6 Description The QUIC transport parameters extension handler incorrectly uses s2n alloc instead of s2n realloc to store peer transport parameters. In TLS 1.3 connections involving a HelloRetryRequest, the handle...

CVE-2026-47198

Paymenter prior to 1.5.1 is vulnerable to URL parameter injection in the Checkout component. The Checkout Livewire property $checkoutConfig is exposed via URL query parameters, and validation rules are generated only for keys defined by an extension’s getCheckoutConfig(). Undefined keys bypass va...

CVE-2026-47198

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.1, the checkout component improperly filters URL-writable properties, allowing authenticated users to inject arbitrary key-value pairs into server provisioning parameters. Because...

CVE-2026-53592

CVE-2026-53592 affects FreeScout (Laravel-based). A prototype pollution flaw in the frontend JavaScript function getQueryParam (/public/js/main.js) allows attacker-controlled URL query strings to write into Object.prototype. Initial fix in 1.8.139 blocked top-level proto keys but did not sanitize...

CVE-2026-63766 GPT-SoVITS 20250606v2pro OS Command Injection via webui.py

GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in webui.py where ASR, slice, denoise, and uvr5 functions interpolate unsanitized Gradio textbox values directly into shell commands executed with shell=True. Attackers can inject shell metacharacters through path...

CVE-2026-63766 GPT-SoVITS 20250606v2pro OS Command Injection via webui.py

GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in webui.py where ASR, slice, denoise, and uvr5 functions interpolate unsanitized Gradio textbox values directly into shell commands executed with shell=True. Attackers can inject shell metacharacters through path...

CVE-2026-63766 GPT-SoVITS 20250606v2pro OS Command Injection via webui.py

GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in webui.py where ASR, slice, denoise, and uvr5 functions interpolate unsanitized Gradio textbox values directly into shell commands executed with shell=True. Attackers can inject shell metacharacters through path...

GHSA-JHMP-MQWM-3GQ8 Tornado: Quadratic DoS via Crafted Multipart Parameters

Summary The parseparam function in Tornado's httputil.py is used to parse specific HTTP header values, such as those in multipart/form-data. This function uses an inefficient algorithm that repeatedly calls string.count within a nested loop while processing quoted semicolons e.g., param=";". As a...