EUVD-2026-67043

opensslencrypt versions before 1.4.9 fail to enforce a time ceiling on key derivation function iteration counts specified in file metadata. Attackers can craft files with extremely high KDF iteration counts to consume CPU resources for unbounded periods before password verification occurs...

CVE-2026-81687 openssl_encrypt before 1.4.9 Denial of Service via KDF

opensslencrypt versions before 1.4.9 fail to enforce a time ceiling on key derivation function iteration counts specified in file metadata. Attackers can craft files with extremely high KDF iteration counts to consume CPU resources for unbounded periods before password verification occurs...

EUVD-2026-67034

AVideo before 24.0 contains a server-side request forgery vulnerability in the isSSRFSafeURL function that fails to extract embedded IPv4 addresses from NAT64, 6to4, and Teredo IPv6 transition address formats. Unauthenticated attackers can bypass SSRF protections via the LiveLinks proxy endpoint ...

CVE-2026-81678 AVideo SSRF Guard Bypass via IPv6 Transition Addresses

AVideo before 24.0 contains a server-side request forgery vulnerability in the isSSRFSafeURL function that fails to extract embedded IPv4 addresses from NAT64, 6to4, and Teredo IPv6 transition address formats. Unauthenticated attackers can bypass SSRF protections via the LiveLinks proxy endpoint ...

CVE-2026-81678

AVideo versions prior to 24.0 contain a server-side request forgery (SSRF) vulnerability in the isSSRFSafeURL function. The flaw is that this function fails to extract embedded IPv4 addresses when they are encoded within NAT64 , 6to4 , and Teredo IPv6 transition address formats. Unauthenticated a...

CVE-2026-81678 AVideo SSRF Guard Bypass via IPv6 Transition Addresses

AVideo before 24.0 contains a server-side request forgery vulnerability in the isSSRFSafeURL function that fails to extract embedded IPv4 addresses from NAT64, 6to4, and Teredo IPv6 transition address formats. Unauthenticated attackers can bypass SSRF protections via the LiveLinks proxy endpoint ...

CVE-2026-81678 AVideo SSRF Guard Bypass via IPv6 Transition Addresses

AVideo before 24.0 contains a server-side request forgery vulnerability in the isSSRFSafeURL function that fails to extract embedded IPv4 addresses from NAT64, 6to4, and Teredo IPv6 transition address formats. Unauthenticated attackers can bypass SSRF protections via the LiveLinks proxy endpoint ...

CVE-2026-80574

A flaw was found in the Linux kernel's focaltech input driver. This vulnerability occurs in the focaltechprocessrelpacket function, where incorrect handling of input can lead to an array out-of-bounds write. This memory corruption issue could potentially allow an attacker to cause system...

CVE-2026-16238

A flaw was found in PostgreSQL. An object creator can exploit a type confusion vulnerability in the pgrestoreattributestats function. This flaw occurs due to the conflation of range and multirange values, allowing the attacker to execute arbitrary code as the operating system user running the...

CVE-2026-14677

A flaw was found in PostgreSQL. An integer wraparound vulnerability in 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This can lead to arbitrary code execution as the operating system...

Malicious code in module-relpath (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03bf564e2647cb828bb130eaaba71b21fb6d78928cb6e3a74165bbb2fc546b98 The package presents itself as relative-import-path README title, homepage and repository URL point at github.com/marko-js/relative-import-path, and...

MAL-2026-14561 Malicious code in module-relpath (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03bf564e2647cb828bb130eaaba71b21fb6d78928cb6e3a74165bbb2fc546b98 The package presents itself as relative-import-path README title, homepage and repository URL point at github.com/marko-js/relative-import-path, and...

CVE-2026-80526

A flaw was found in the Linux kernel's ASoC Audio System on Chip tas2562 driver. The tas2562volumecontrolput function lacks proper validation of control values provided by userspace. A local attacker could exploit this by supplying a specially crafted value, leading to an array overflow and an...

CVE-2026-79772

A flaw was found in Nokogiri. This vulnerability occurs because the canonicalize method fails to properly check the return value from an internal XML processing function, returning an empty string on failure instead of an error. A remote attacker could exploit this by providing specially crafted...

CVE-2026-81562

A security flaw has been discovered in AlexGladkov claude-in-mobile 3.10.2. This affects the function execSync of the file src/adb/client.ts. Performing a manipulation results in os command injection. The attack requires a local approach. The exploit has been released to the public and may be use...

CVE-2026-80544

A flaw was found in the Linux kernel's s390/zcrypt component. The zcryptmsgtype6sendep11cprb function, responsible for handling EP11 CPRB Coprocessor Request Block domains, uses fragile struct overlays. This approach lacks proper ASN.1 Abstract Syntax Notation One encoding validation and bounds...

CVE-2026-80542

A flaw was found in the drm/amd/display component of the Linux kernel. The amdgpudmcrtcsetvblank function attempts to dereference a NULL pointer when vblank is enabled or queried before a display stream is properly attached. This can be triggered by a local attacker running specific graphics test...

CVE-2026-76848

A flaw was found in TypeORM. The SelectQueryBuilder.distinctOn function, when used with PostgreSQL-family drivers, does not properly validate or escape client-controlled input. A remote attacker can exploit this vulnerability by providing malicious SQL expressions, leading to SQL injection. This...

CVE-2026-63381

A flaw was found in Libevent, an event notification library. A use-after-free vulnerability exists in the evbufferaddbufferreference function when it processes an output buffer with a zero length. This can lead to a dangling pointer, which an attacker could exploit to cause memory corruption or...

CVE-2026-63388

A flaw was found in Libevent. A heap out-of-bounds write vulnerability in the buffereventsocketsetconnaddress function allows an unauthenticated local peer to achieve arbitrary code execution. By connecting to an AFUNIX listener, an attacker can overwrite critical heap data, leading to memory...