CVE-2026-93321

A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon...

CVE-2026-105746

The Docling document processing library (versions 2.83.0 through 2.131.0 ) contains a flaw where the KServeV2OcrModel class fails to honor the pipeline_options.enable_remote_services setting. This oversight allows the application to transmit page images to configured external endpoints even when ...

CVE-2026-21589

This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific fil...

CVE-2026-21589

This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific fil...

CVE-2026-21589

CVE-2026-21589 is a critical unauthenticated arbitrary file access vulnerability affecting multiple Atlassian Data Center products, including Jira, Confluence, Bitbucket, Bamboo, Crowd, Crucible, and Fisheye. The root cause lies in the shared atlassian-plugins-webresource library, where the Route...

CVE-2026-101893

Newell Brands DYMO ID 1.5.1.71 parses job files using XmlDocument.Load without disabling DTD processing. The PC Job Files view automatically parses every recognized job file extension on folder browse. A crafted file on any browsed network share can perform SSRF, capture NTLMv2 credentials, read...

Security Bulletin: middleware is vulnerable to algorithmic complexity denial of service when processing a crafted language tag containing a large number of hyphen separated subtags.

Summary Upgrade to InformixHQ 3.3.2 included in 14.10.14W1 and 15.0.1.16 Vulnerability Details CVEID:CVE-2026-69207 DESCRIPTION: Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.34, the built-in CORS middleware, hono/cors, is vulnerable to a...

CVE-2026-94201

Ash stores :atom-typed attributes as strings and compares them as strings. When such an attribute is referenced in a filter, the comparison value is coerced through Ash.Type.Atom. Because the type defined no coerce/2 callback, coercion fell back to the default castinput/2, which calls...

CVE-2026-105691

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the SVG exporter places an attacker-controlled text object's fill-color value into a ppmcolormask command string and executes that string through childprocess.exec. A user who can edit a file can store shell metacharacters...

DEBIAN-CVE-2026-104029

A flaw was found in SSSD. A local attacker can exploit this vulnerability by sending a specially crafted request to the autofs responder UNIX socket. Due to improper buffer offset calculation during request parsing, the service performs an out-of-bounds memory read. This flaw can cause the autofs...

CVE-2026-104029

A flaw was found in SSSD. A local attacker can exploit this vulnerability by sending a specially crafted request to the autofs responder UNIX socket. Due to improper buffer offset calculation during request parsing, the service performs an out-of-bounds memory read. This flaw can cause the autofs...

UBUNTU-CVE-2026-104029

A flaw was found in SSSD. A local attacker can exploit this vulnerability by sending a specially crafted request to the autofs responder UNIX socket. Due to improper buffer offset calculation during request parsing, the service performs an out-of-bounds memory read. This flaw can cause the autofs...

CVE-2026-66752-HTTP-Request-Smuggling-via-Unparsed-Transfer-Encoding-Values-tiny_http-

Security Advisory: HTTP Request Smuggling via Unparsed Transfer-Encoding Values tinyhttp Assigned CVE ID: CVE-2026-66752 Summary tinyhttp checks only whether a Transfer-Encoding header is present. It never looks at the value. Any value, including codings that are not chunked and coding lists whos...

CVE-2026-90254

A flaw was found in the Linux kernel's Bluetooth subsystem. Specifically, a memory leak occurs in the hcisync component when an advertising instance is not properly freed during certain failure or cancellation scenarios. This happens because the advtimeoutexpire function passes a memory-allocated...

CVE-2026-89982

A flaw was found in the Linux kernel's I2C Inter-Integrated Circuit multiplexer mux subsystem. This vulnerability can lead to a resource leak if an adapter fails to register, as a system resource is not properly released. Over time, this could result in resource exhaustion, potentially causing...

CVE-2026-89953

A flaw was found in the Linux kernel's mtdoops module. When a Memory Technology Device MTD is removed and then re-registered, the mtdoops module fails to properly free a previously allocated memory bitmap. This oversight leads to a memory leak, where memory is continuously consumed without being...

CVE-2026-89924

A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine component for s390 architecture. When handling guest debug requests, a memory leak occurs if a watchpoint import fails. A local guest user could repeatedly trigger this flaw, leading to a continuous leak of memory buffers. Th...

CVE-2026-89877

A flaw was found in the saa7164 media driver in the Linux kernel. When the saa7164devsetup function fails to allocate PCI BAR memory regions, it incorrectly leaves a dangling entry on the global device list. This improper cleanup of resources can lead to a resource leak, potentially allowing a...

CVE-2026-89815

A flaw was found in the Linux kernel's Direct Rendering Manager DRM TTM memory manager. During a memory restore operation, the tt-restore object is not properly released after a successful restore. This oversight can lead to shared memory shmem handles remaining active, causing subsequent backup...

CVE-2026-90434

A flaw was found in the Linux kernel's isofs filesystem driver. When processing compressed block pointer tables via the zisofsfillpages function, a memory resource is not properly released upon successful operation. A local attacker could potentially exploit this resource mismanagement, possibly ...