CVE-2026-41415

PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, there is an out-of-bounds read when parsing a malformed Content-ID URI in SIP multipart message body. Insufficient length validation can cause reads beyond the intended buffer bounds. This...

DEBIAN-CVE-2026-42033

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when Object.prototype has been polluted by any co-dependency with keys that axios reads without a hasOwnProperty guard, an attacker can a silently intercept and modify every JSON response before the...

CVE-2026-42040 Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the encode function in lib/helpers/AxiosURLSearchParams.js contains a character mapping charMap at line 21 that reverses the safe percent-encoding of null bytes. After encodeURIComponent'\x00' correctly...

CVE-2026-31625

In the Linux kernel, the following vulnerability has been resolved: HID: alps: fix NULL pointer dereference in alpsrawevent Commit ecfa6f34492c "HID: Add HIDCLAIMEDINPUT guards in rawevent callbacks missing them" attempted to fix up the HID drivers that had missed the previous fix that was done i...

CVE-2026-31618

In the Linux kernel, the following vulnerability has been resolved: fbdev: tdfxfb: avoid divide-by-zero on FBIOPUTVSCREENINFO Much like commit 19f953e74356 "fbdev: fbpm2fb: Avoid potential divide by zero error", we also need to prevent that same crash from happening in the udlfb driver as it uses...

CVE-2026-31606

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fhid: don't call cdevinit while cdev in use When calling unbind, then bind again, cdevinit reinitialized the cdev, even though there may still be references to it. That's the case when the /dev/hidg device is still...

CVE-2026-5265

CVE-2026-5265 describes a heap over-read in the ICMP error response generation within OVN’s ovn-controller. The issue occurs when generating ICMP Destination Unreachable or Packet Too Big messages: the handler copies a portion of the original packet into the ICMP error body using the IP header’s ...

CVE-2026-6019

creationtimestamp| type| source ---|---|--- 2026-04-23 14:20:08+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mk67gae64g2b 2026-06-23 12:01:34+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3moxe4mppew2g 2026-06-27 16:32:12+00:00| seen|...

SUSE-SU-2026:21388-1 Security update for the Linux Kernel (Live Patch 6 for SUSE Linux Enterprise 16)

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.27.1 fixes one security issue The following security issue was fixed: - CVE-2026-23268: apparmor: fix unprivileged local user can do privileged policy management bsc1259859...

ALSA-2026:10226 Important: grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: grafana: Grafana: Information disclosure of data-source passwords via public dashboards CVE-2026-27877 For more details about the security issues, including the impact, a...

GHSA-G2QJ-PRGH-4G9R

creationtimestamp| type| source ---|---|--- 2026-04-22 21:20:09+00:00| published-proof-of-concept| Telegram/wn9Qi4rYZ0wmwM3QnYEzwEWgvyumLNiA44jY2rXcciEdxg...

CVE-2025-3922

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.4 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have allowed an authenticated user to cause denial of service by overwhelming system resources under certain conditions due to insufficient...

CVE-2026-35342

The mktemp utility in uutils coreutils fails to properly handle an empty TMPDIR environment variable. Unlike GNU mktemp, which falls back to /tmp when TMPDIR is an empty string, the uutils implementation treats the empty string as a valid path. This causes temporary files to be created in the...

CVE-2026-31461

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix drmedid leak in amdgpudm WHAT When a sink is connected, aconnector-drmedid was overwritten without freeing the previous allocation, causing a memory leak on resume. HOW Free the previous drmedid before updati...

CVE-2026-5262

creationtimestamp| type| source ---|---|--- 2026-04-22 12:50:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mk3jwdl7pl2u 2026-04-22 18:14:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mk43zvvmkl2c 2026-04-22 19:00:11+00:00| seen|...

CVE-2026-6777

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Other issue in the Networking: DNS component...

CVE-2026-35238

...

CVE-2026-35236

...

CVE-2026-35232

CVE-2026-35232 affects Oracle Fusion Middleware’s Dynamic Monitoring Service (DMS) in versions 12.2.1.4.0 and 14.1.2.0.0. The vulnerability allows a low-privileged, network-accessible attacker (via HTTP) with user interaction to compromise the framework, potentially enabling unauthorized update/i...

CVE-2026-35230

...