8079 matches found
SUSE CVE-2026-45287
OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.0.17, go.opentelemetry.io/otel/schema/v1.0 and go.opentelemetry.io/otel/schema/v1.1 leaks one file descriptor on each successful ParseFile call. ParseFile opens the schema file and passes it to Parse without closing it...
CVE-2026-65635 Boruta dynamic client registration allows creation of over-privileged OAuth clients
Improper Isolation or Compartmentalization vulnerability in malach-it boruta Elixir.Boruta.Openid module allows attackers to register OpenID Connect clients with administrative privileges through the dynamic client registration entry point. Boruta.Openid.registerclient/3 forwards caller-supplied...
CVE-2026-60074
Date::Manip versions through 6.99 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check. The parse regexes capture year, month and day with the \d shorthand, which on a character string matches the whole Unicode decimal digit property \pNd and not...
CVE-2026-60074 Date::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check
Date::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check. The parse regexes capture year, month and day with the \d shorthand, which on a character string matches the whole Unicode decimal digit property \pNd and not...
BIT-SQLITE-2026-51298
sqlite 3.41 is vulnerable to use after free in the JSON extraction function. After releasing JsonParse object memory via jsonParseFree, the program still accesses internal member of the freed pointer, which can cause service crash and denial of service...
Exploit for CVE-2026-16723
CVE-2026-16723 Fastjson RCE ★ CVE-2026-16723 Fastjson @JSONT...
OSV-2026-1095 Heap-buffer-overflow in grk::t1::CodeblockDecompressImpl::parsePacketData
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=540111888 Crash type: Heap-buffer-overflow READ 8 Crash state: grk::t1::CodeblockDecompressImpl::parsePacketData grk::PacketParser::readData grk::PacketParser::parsePacketData...
PT-2026-66631
A crafted IEC 60870-5-104 I-frame with a declared object count exceeding what fits in the ASDU body causes InformationObject ParseObjectAddress to read one byte past the end of the heap-allocated message buffer...
PT-2026-66474
Name of the Vulnerable Software and Affected Versions Date::Manip versions prior to 7.0 Description Processing of untrusted character strings in ParseDate or Date::Manip::Date-parse can result in corrupted dates without triggering a parse error. This occurs because the parsing regular expressions...
PT-2026-66475
Name of the Vulnerable Software and Affected Versions Date::Manip versions prior to 7.0 Description CPU exhaustion can occur due to quadratic backtracking during unanchored time substitution within the parse time function. The issue arises when the function uses an unanchored substitution...
CVE-2026-51293
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
EUVD-2026-51254
A use-after-free vulnerability exists in SQLite 3.41 when the jsonBlobAppendNode function is invoked subsequent to sqlite3DbFree being called on the aBlob member of the Parse structure...
PT-2026-66525
A use-after-free vulnerability exists in SQLite 3.41 when the jsonBlobAppendNode function is invoked subsequent to sqlite3DbFree being called on the aBlob member of the Parse structure...
CVE-2026-51293
CVE-2026-51293 is a use-after-free in SQLite 3.41. The vulnerability occurs in the jsonBlobAppendNode() function when it is invoked after sqlite3DbFree() has been called on the aBlob member of the Parse structure. Documents do not provide exploit details, affected version ranges beyond 3.41, or r...
CVE-2026-13697 undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives
undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be stored in the default shared cache and...
CVE-2026-13697 undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives
undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be stored in the default shared cache and...
CVE-2026-13697 undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives
undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be stored in the default shared cache and...
SUSE-SU-2026:3403-1 Security update for perl-XML-Bare
This update for perl-XML-Bare fixes the following issues - CVE-2026-13401: infinite loop when parsing malformed attributes in parsercparse function bsc1271640. - CVE-2026-57074: out-of-bounds read due to unbounded character lookahead in the parsercparse function bsc1271637...
The vulnerability of the smb3_fs_contextParseParam() function in the fs/smb/client/fsContext.c module, which is part of the SMB client support for Linux operating systems, allows a hacker to cause a service failure.
The vulnerability of the smb3fscontextParseParam function in the fs/smb/client/fsContext.c module, which is part of the SMB client support in Linux operating systems, involves the failure to release resources after their useful life has ended. Exploiting this vulnerability could allow an attacker...