The vulnerability of the ssh_get_hexa() function in the application programming interface of the libssh library, which allows a hacker to cause a service failure

The vulnerability of the sshgethexa function in the application programming interface of the libssh library is related to a breach of the buffer boundary. Exploiting this vulnerability could allow an attacker, operating remotely, to cause service failures...

CVE-2026-33899

A flaw was found in ImageMagick. When processing a specially crafted XML file, a remote attacker could exploit an out-of-bounds write vulnerability. This could lead to a denial of service, making the affected program unavailable. Mitigation Mitigation for this issue is either not available or the...

CVE-2026-33901

A flaw was found in ImageMagick. A remote attacker could exploit a heap buffer overflow vulnerability in the MVG decoder by processing a specially crafted image file. This vulnerability allows for an out-of-bounds write, which could lead to a Denial of Service DoS for the affected system...

CVE-2026-33555

A flaw was found in HAProxy. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/3 request. The HTTP/3 parser fails to verify that the received body length matches the announced content-length when a stream is closed with an empty payload. This desynchronization...

CVE-2026-4113

An observable response discrepancy vulnerability in the SonicWall SMA1000 series appliances allows a remote attacker to enumerate SSL VPN user credentials...

CVE-2026-4112

Improper neutralization of special elements used in an SQL command “SQL Injection” in SonicWall SMA1000 series appliances allows a remote authenticated attacker with read-only administrator privileges to escalate privileges to primary administrator...

USN-8170-1: Corosync vulnerabilities

It was discovered that Corosync incorrectly handled the membership commit token validity check. A remote attacker could use this issue to cause Corosync to crash, resulting in a denial of service, or to possibly obtain a small quantity of sensitive information. CVE-2026-35091 It was discovered th...

USN-8168-1: Rust vulnerability

It was discovered that tar-rs embedded in rustc incorrectly handled symlinks when unpacking a tar archive. If a user or automated system were tricked into processing a specially crafted tar archive, a remote attacker could use this issue to modify permissions of arbitrary directories outside the...

perl-xml-parser: XML::Parser: Memory corruption via deeply nested XML files

A flaw was found in XML::Parser, a Perl module for parsing XML. This vulnerability, an off-by-one heap buffer overflow, occurs when processing an XML file with very deep element nesting. A remote attacker could exploit this by providing a specially crafted XML file, potentially leading to memory...

nodejs: Nodejs denial of service

A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when pskCallback or ALPNCallback are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths tlsClientError and error, causing either immediate...

nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination

A flaw was found in nghttp2. Due to missing internal state validation, the library continues to process incoming data even after a session has been terminated. A remote attacker could exploit this by sending a specially crafted HTTP/2 frame, leading to an assertion failure and a denial of service...

CVE-2026-6138

A flaw has been found in Totolink A7100RU 7.4cu.2313b20191024. The impacted element is the function setAccessDeviceCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. This manipulation of the argument mac causes os command injection. The attack can be initiated remotely. The exploi...

The vulnerability of Google Chrome’s PWA components allows attackers to install any PWA applications they desire.

The vulnerability of Google Chrome’s PWA components is related to access control errors. Exploiting this vulnerability allows a remote attacker to install arbitrary PWA applications...

The vulnerability of the g_base64_encode_close() function within the GLib library allows a attacker to cause a service failure.

The vulnerability of the gbase64encodeclose function in the GLib library is related to writing beyond the buffer boundaries. Exploiting this vulnerability allows a remote attacker to cause a service failure...

The vulnerability of the bytestring_parse() and string_parse() functions in the GLib library allows a hacker to cause a service failure.

The vulnerability of the bytestringparse and stringparse functions in the GLib library library set is related to integer overflow. Exploiting this vulnerability allows a remote attacker to cause a service failure...

The vulnerability in the Google Chrome browser’s user interface allows a perpetrator to gain unauthorized access to the rendering process and perform a substitution of the user interface.

The vulnerability of Google Chrome’s user interface is related to an improper limitation on the visible layers of the user interface. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to the rendering process and replace the user interface by sending a speciall...

The vulnerability of Google Chrome’s WebCodecs interface allows attackers to disclose protected information.

The vulnerability of Google Chrome’s WebCodecs interface is related to errors during variable initialization. Exploiting this vulnerability can allow a remote attacker to disclose sensitive information through a specially created HTML page...

PT-2026-32712

It was discovered that tar-rs embedded in rustc incorrectly handled symlinks when unpacking a tar archive. If a user or automated system were tricked into processing a specially crafted tar archive, a remote attacker could use this issue to modify permissions of arbitrary directories outside the...

The vulnerability of the Python programming language-based UltraJSON package lies in the lack of memory release after the effective lifespan, which allows a malicious actor to trigger a service failure.

The vulnerability of the Python programming language-based UltraJSON package is related to the lack of memory release after the effective lifespan of the package. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

PT-2026-35845

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 147.0.7727.138 Description Insufficient validation of untrusted input in the Feedback component allows a remote attacker who has compromised the renderer process to potentially perform a sandbox escape via a...