474654 matches found
CVE-2026-115372
Incus from 7.3.0 before 7.5.0 contains a project restriction bypass that allows restricted project users to set block.createoptions through volume update, copy, and move operations. Attackers can set the option on a custom volume and trigger a copy or move onto a formatting pool to inject argumen...
CLSA-2026-1792696243 TuxCare security update for org.bouncycastle (9 CVEs)
TuxCare rebuilt 39 org.bouncycastle packages to address 9 CVEs. Fixed in 1.75-tuxcare.1...
crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages
A flaw was found in the crypto/tls package within the Go golang standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock,...
crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages
A flaw was found in the crypto/tls package within the Go golang standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock,...
CVE-2026-77157
ast-cli downloads two helper binaries, the Vorpal ASCA real-time engine and the SCA Resolver, from "download.checkmarx.com" as part of its auto-update flow, triggered by the Checkmarx’s "VSCode/JetBrains" extensions and by cx scan "sca-realtime". Prior to the fix, the downloaded archive was not...
CLSA-2026-1792692686 TuxCare security update for 39 packages (15 CVEs)
TuxCare rebuilt 39 packages to address 15 CVEs. Fixed in 10.1.16-tuxcare.1...
CVE-2026-77157 ast-cli: Auto-update downloads are not verified against a checksum before execution
ast-cli downloads two helper binaries, the Vorpal ASCA real-time engine and the SCA Resolver, from "download.checkmarx.com" as part of its auto-update flow, triggered by the Checkmarx’s "VSCode/JetBrains" extensions and by cx scan "sca-realtime". Prior to the fix, the downloaded archive was not...
CVE-2026-77157
The ast-cli tool is vulnerable to arbitrary binary execution because it fails to verify checksums for helper binaries (Vorpal ASCA real-time engine and SCA Resolver) during its auto-update flow. This flow is triggered by Checkmarx VSCode/JetBrains extensions and the cx scan "sca-realtime" command...
CVE-2026-77157 ast-cli: Auto-update downloads are not verified against a checksum before execution
ast-cli downloads two helper binaries, the Vorpal ASCA real-time engine and the SCA Resolver, from "download.checkmarx.com" as part of its auto-update flow, triggered by the Checkmarx’s "VSCode/JetBrains" extensions and by cx scan "sca-realtime". Prior to the fix, the downloaded archive was not...
crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages
A flaw was found in the crypto/tls package within the Go golang standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock,...
CLSA-2026-1792687888 TuxCare security update for 39 packages (7 CVEs)
TuxCare rebuilt 39 packages to address 7 CVEs. Fixed in 10.1.18-tuxcare.8...
CLSA-2026-1792687381 TuxCare security update for 36 packages (4 CVEs)
TuxCare rebuilt 36 packages to address 4 CVEs. Fixed in 7.0.109-tuxcare.5...
CLSA-2026-1792687342 TuxCare security update for org.springframework (2 CVEs)
TuxCare rebuilt 24 org.springframework packages to address 2 CVEs. Fixed in 5.3.23-tuxcare.2...
CLSA-2026-1792687194 TuxCare security update for 40 packages (8 CVEs)
TuxCare rebuilt 40 packages to address 8 CVEs. Fixed in 10.1.50-tuxcare.1...
crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages
A flaw was found in the crypto/tls package within the Go golang standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock,...
CLSA-2026-1792686740 TuxCare security update for 38 packages (6 CVEs)
TuxCare rebuilt 38 packages to address 6 CVEs. Fixed in 9.0.39-tuxcare.1...
CVE-2026-41940-Security-Patch
CVE-2026-41940-Security-Patch Unofficial temporary patch for the CVE-2026-41940 vulnerability Can be used for temporary defense Please upgrade to the official release as soon as conditions permit cPanel Security Announcement:...
CLSA-2026-1792686134 TuxCare security update for 33 packages (9 CVEs)
TuxCare rebuilt 33 packages to address 9 CVEs. Fixed in 9.0.13-tuxcare.1...
CLSA-2026-1792686128 TuxCare security update for 35 packages (13 CVEs)
TuxCare rebuilt 35 packages to address 13 CVEs. Fixed in 8.5.78-tuxcare.1...
GHSA-7587-9684-52R6 mem0ai Databricks vector store vulnerable to SQL injection
mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vectorstores/databricks.py that allows attackers to inject SQL by influencing stored memory content. Attackers can supply crafted memory text, metadata, or message names that reach unescaped insert and update string...