Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in the BcKeyStoreSpi.engineLoad method, which sizes buffers for the certificate chain array, encoded certificates, encoded key material, entry data, and PBE salts directly from readInt length...

CVE-2026-18582

A security flaw has been discovered in mz-automation libiec61850 up to 1.6.1. This vulnerability affects the function ReportingRCBWriteAccessHandler of the file src/iec61850/server/mmsmapping/reporting.c of the component Report Sending Path Handler. The manipulation results in free of memory not ...

PT-2026-67497

Name of the Vulnerable Software and Affected Versions Apache NiFi versions 1.5.0 through 2.10.0 Description The application REST API supports gzip-encoded HTTP requests via a Jersey encoding filter. The framework enforces a maximum request size on the compressed payload instead of the decompresse...

PT-2026-67495

Name of the Vulnerable Software and Affected Versions Apache NiFi versions 1.10.0 through 2.10.0 Description A Parameter Context update REST API method fails to enforce authorization checks on components that reference parameter values. While framework authorization was limited to read and write...

PT-2026-67323

Name of the Vulnerable Software and Affected Versions ArcadeDB versions prior to 26.7.2 Description Authenticated users can retrieve the arcadedb.ha.clusterToken value in cleartext because the software fails to properly redact the cluster token in the 'GET /api/v1/server' endpoint. An attacker ca...

UBUNTU-CVE-2026-18446

fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it backslash backslash, forward slash backslash, or backslash forward slash is parsed with no authority and folds into th...

Linux Distros Unpatched Vulnerability : CVE-2026-66755

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Relative Path Traversal in the ISA-Tab parser in Apache Software Foundation Apache Tika from 1.8 through 3.3.1, and 4.0.0-alpha-1, allows an attacker who can...

CVE-2026-28814

Summary of CVE-2026-28814 : Apache JSPWiki (up to 2.12.3) allows pre-auth arbitrary wiki markup rendering due to lack of authentication. This can enable an attacker to obtain sensitive data stored in JSPWiki variables. Affected version range is up to 2.12.3; fixed in 2.12.4 and 3.0.0. Remediation...

EUVD-2026-51181

Arbitrary Wiki Markup rendering due to lack of authentication in Apache JSPWiki up to 2.12.3 allows attacker to obtain sensitive data stored in JSPWiki variables. Users are recommended to upgrade to version 2.12.4 or 3.0.0, which fixes this issue...

CVE-2026-44617 Apache Zeppelin: LDAP filter injection in LdapRealm — incomplete fix of CVE-2024-31867

LDAP filter injection vulnerability in Apache Zeppelin. LdapRealm used RFC 4514 distinguished-name escaping when constructing LDAP search filters instead of RFC 4515 filter escaping, leaving special filter characters insufficiently escaped. This is an incomplete fix of...

Out-of-bounds Read

Overview Magick.NET-Q16-HDRI-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

CVE-2026-23904

Kyuubi Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to that destination. A remote requester with network access to the proxy can cause the Kyuubi server to send HTTP requests to arbitrary reachable hosts, resulting in SSRF or open-proxy behavior. This...

UBUNTU-CVE-2026-58179

The Apache Traffic Server regexremap plugin overflows the stack and integers from substitution input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix...

EUVD-2026-50234

Apache Traffic Server allows redirect-limit bypass when plugins reset the retry counter, enabling SSRF amplification. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or...

EUVD-2026-50233

Several Apache Traffic Server experimental plugins have memory-safety and limit-bypass errors. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the iss...

CVE-2026-58188 Apache Traffic Server: Memory-safety and limit-bypass errors across experimental plugins

Several Apache Traffic Server experimental plugins have memory-safety and limit-bypass errors. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the iss...

CVE-2026-58188 Apache Traffic Server: Memory-safety and limit-bypass errors across experimental plugins

Several Apache Traffic Server experimental plugins have memory-safety and limit-bypass errors. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the iss...

EUVD-2026-50232

The Apache Traffic Server multiplexer plugin overruns its chunk-decode buffer on upstream input, enabling denial of service. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.1...

CVE-2026-58187

The Apache Traffic Server multiplexer plugin overruns its chunk-decode buffer on upstream input, enabling denial of service. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.1...

CVE-2026-58186

The Apache Traffic Server webptransform plugin can decode unsafely and serve mislabeled, cacheable responses. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4,...