7514 matches found
CVE-2026-51293
CVE-2026-51293 is a use-after-free in SQLite 3.41. The vulnerability occurs in the jsonBlobAppendNode() function when it is invoked after sqlite3DbFree() has been called on the aBlob member of the Parse structure. Documents do not provide exploit details, affected version ranges beyond 3.41, or r...
EUVD-2026-51254
A use-after-free vulnerability exists in SQLite 3.41 when the jsonBlobAppendNode function is invoked subsequent to sqlite3DbFree being called on the aBlob member of the Parse structure...
CVE-2026-13697 undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives
undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be stored in the default shared cache and...
CVE-2026-13697 undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives
undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be stored in the default shared cache and...
CVE-2026-13697 undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives
undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be stored in the default shared cache and...
SUSE-SU-2026:3403-1 Security update for perl-XML-Bare
This update for perl-XML-Bare fixes the following issues - CVE-2026-13401: infinite loop when parsing malformed attributes in parsercparse function bsc1271640. - CVE-2026-57074: out-of-bounds read due to unbounded character lookahead in the parsercparse function bsc1271637...
The vulnerability of the smb3_fs_contextParseParam() function in the fs/smb/client/fsContext.c module, which is part of the SMB client support for Linux operating systems, allows a hacker to cause a service failure.
The vulnerability of the smb3fscontextParseParam function in the fs/smb/client/fsContext.c module, which is part of the SMB client support in Linux operating systems, involves the failure to release resources after their useful life has ended. Exploiting this vulnerability could allow an attacker...
Security Bulletin: IBM watsonx.data integration (Data Observability) is affected by a denial-of-service (DoS) due to protobuf
Summary IBM watsonx.data integration Data Observability is vulnerable to protobuf-3.20.3-cp39-cp39-manylinux25x8664.manylinux1x8664.whl CVE-2026-0994. A denial-of-service DoS vulnerability exists in google.protobuf.jsonformat.ParseDict in Python, where the maxrecursiondepth limit can be bypassed...
Security update for perl-HTTP-Date
This update for perl-HTTP-Date fixes the following issue: CVE-2026-14741: CPU exhaustion due to polynomial regex backtracking in parsedate when processing specially crafted date strings bsc1271705. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like...
OSV-2026-1083 Heap-buffer-overflow in parseGoosePayload
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=539005080 Crash type: Heap-buffer-overflow READ 1 Crash state: parseGoosePayload parseGooseMessage fuzzgoosesubscriber.c...
SUSE SLED15 / SLES15 Security Update : alsa (SUSE-SU-2026:3270-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3270-1 advisory. This update for alsa fixes the following issue - CVE-2026-56109: double-free vulnerability in parsedef in src/conf.c th...
UBUNTU-CVE-2026-64546
In the Linux kernel, the following vulnerability has been resolved: drm/edid: fix OOB read in drmparsetiledblock drmparsetiledblock casts the DisplayID block to a struct displayidtiledblock and reads the full fixed layout up to tile-topologyid7 without checking block-numbytes. The DisplayID...
CVE-2026-51298
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
SUSE CVE-2026-64379
In the Linux kernel, the following vulnerability has been resolved: smb: client: mask server-provided mode to 07777 in modefromsid When modefromsid is active, parsedacl applies the server-provided subauth2 value from the NFS mode SID to cfmode without masking to 07777. Apply the correct masking,...
CVE-2026-64379
In the Linux kernel, the following vulnerability has been resolved: smb: client: mask server-provided mode to 07777 in modefromsid When modefromsid is active, parsedacl applies the server-provided subauth2 value from the NFS mode SID to cfmode without masking to 07777. Apply the correct masking,...
UBUNTU-CVE-2026-64379
In the Linux kernel, the following vulnerability has been resolved: smb: client: mask server-provided mode to 07777 in modefromsid When modefromsid is active, parsedacl applies the server-provided subauth2 value from the NFS mode SID to cfmode without masking to 07777. Apply the correct masking,...
EUVD-2026-48923
In the Linux kernel, the following vulnerability has been resolved: smb: client: mask server-provided mode to 07777 in modefromsid When modefromsid is active, parsedacl applies the server-provided subauth2 value from the NFS mode SID to cfmode without masking to 07777. Apply the correct masking,...
CVE-2026-57530
Milkdown (versions
GHSA-GCJH-H69Q-9W9G cel-go: JSON Private Fields Exposed via NativeTypes and ParseStructTag
The function ext.NativeTypesParseStructTag"json" does not honour the encoding/json skip directive json:"-". Fields tagged json:"-" are registered in the CEL type system under the literal name "-" and are readable from any user-submitted CEL expression via dynobj"-". Additionally, newNativeTypes...