CVE-2026-40195

Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage bucket import logic allows an authenticated user with access to the storage bucket feature to cause the Incus daemon to crash. The vulnerability is present in the backup...

CVE-2026-40197

Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage volume import logic allows an authenticated user with access to the storage volume feature to cause the Incus daemon to crash. The custom volume backup import subsystem...

CVE-2026-41305 vulnerabilities

Vulnerabilities for packages: langfuse, langfuse-fips, authentik-fips, kubeflow-katib, gitlab-rails-ce, homepage, saf, renovate, jitsucom-jitsu, arangodb, drupal, gitlab-rails-ce-fips, vite, authentik, py3-captum, vitess, pelias-api, nextcloud-server, keep-fips, keep...

GHSA-QX2V-QP2M-JG93 vulnerabilities

Vulnerabilities for packages: langfuse, langfuse-fips, authentik-fips, kubeflow-katib, gitlab-rails-ce, homepage, saf, renovate, jitsucom-jitsu, arangodb, drupal, gitlab-rails-ce-fips, vite, authentik, py3-captum, vitess, pelias-api, nextcloud-server, keep-fips, keep...

CVE-2026-42203 vulnerabilities

Vulnerabilities for packages: litellm, airflow...

GHSA-57J5-QWP2-VQP6 vulnerabilities

Vulnerabilities for packages: grafana-fips, grafana, commercial-grafana...

CVE-2026-41131 vulnerabilities

Vulnerabilities for packages: grafana-fips, grafana, commercial-grafana...

CVE-2026-7953

Insufficient validation of untrusted input in Omnibox in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via malicious network traffic. Chromium security severity: Medium...

CVE-2026-6691

The MongoDB C Driver's Cyrus SASL integration performs unsafe string copying during username canonicalization, enabling a heap buffer overflow before any authentication or network traffic. This may be triggered by passing untrusted input in the username of a MongoDB URI with authMechanism=GSSAPI...

BIT-JAVA-MIN-2026-20652

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.3, iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, visionOS 26.3. A remote attacker may be able to cause a denial-of-service...

BIT-JAVA-MIN-2026-20635

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.3, iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, tvOS 26.3, visionOS 26.3, watchOS 26.3. Processing maliciously crafted web content may lead to an unexpected process crash...

BIT-JAVA-2023-42917

A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited against...

CVE-2026-41168 vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-21728 vulnerabilities

Vulnerabilities for packages: grafana...

CVE-2026-41491 vulnerabilities

Vulnerabilities for packages: dapr...

CVE-2026-42215 vulnerabilities

Vulnerabilities for packages: checkov, open-webui, mlflow...

CVE-2026-43171

In the Linux kernel, the following vulnerability has been resolved: EFI/CPER: don't dump the entire memory region The current logic at cperprintfwerr doesn't check if the error record length is big enough to handle offset. On a bad firmware, if the ofset is above the actual record, length -= offs...

CVE-2026-43245

In the Linux kernel, the following vulnerability has been resolved: ntfs: -dcompare must not block ... so don't use getname there. Switch it and ntfsdhash, while we are at it to kmallocPATHMAX, GFPNOWAIT. Yes, ntfsdhash almost certainly can do with smaller allocations, but let ntfs folks deal wit...

CVE-2026-43277

In the Linux kernel, the following vulnerability has been resolved: APEI/GHES: ensure that won't go past CPER allocated record The logic at ghesnew prevents allocating too large records, by checking if they're bigger than GHESESTATUSMAXSIZE currently, 64KB. Yet, the allocation is done with the...

CVE-2026-43256

In the Linux kernel, the following vulnerability has been resolved: media: qcom: camss: vfe: Fix out-of-bounds access in vfeisrregupdate vfeisr iterates using MSMVFEIMAGEMASTERSNUM7 as the loop bound and passes the index to vfeisrregupdate. However, vfe-line array is defined with VFELINENUMMAX4:...