Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in JcePKCSPBEInputDecryptorProviderBuilder and JceOpenSSLPKCS8DecryptorProviderBuilder, which parse PBES2Parameters from attacker-supplied EncryptedPrivateKeyInfo, PKCS12, or CMS...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the CMSSignedData.verifySignaturesSignerInformationVerifierProvider, boolean method, which iterates the signer set and returns true on loop completion without checking that any signer ...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in the processRecord method of DTLSReliableHandshake, where the DTLSReassembler constructor allocates a bytelength buffer directly from the 24-bit handshake length field without checking it...

Inadequate Encryption Strength

Overview Affected versions of this package are vulnerable to Inadequate Encryption Strength in the BcKeyStoreSpi.engineLoad method, which for legacy BKS keystore versions 0 and 1 passes hMac.getMacSize 20 bytes for SHA-1 to generateDerivedMacParameters, where PKCS12ParametersGenerator divides it ...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation in the isEmailConstrained and isURIConstrained methods of PKIXNameConstraintValidator, which compare rfc822Name and URI subjectAltName values with a bare equalsIgnoreCase and do not strip a trailing dot t...

Debian dsa-6409 : libgd-dev - security update

The remote Debian 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6409 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6409-1 [email protected] https://www.debian.org/security/...

core-geonetwork has an Open Redirect Bypass

Summary GeoNetwork's post-login redirect handling can be bypassed to redirect users to an attacker-controlled external site, even though the code attempts to restrict redirect targets to relative, in-application URLs. This affects both supported SSO login methods: OAuth2/OIDC and Keycloak. Detail...

[SECURITY] [DSA 6407-1] incus security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6407-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 31, 2026 https://www.debian.org/security/faq -...

CVE-2026-18394

Incorrect authorization in the httprequest tool in Strands Agents Tools before 0.8.2 might allow remote attackers to obtain credentials configured via HTTPREQUESTTOKENCONFIG by influencing the LLM to route requests through actor-controlled proxy infrastructure. To remediate this issue, users shou...

hashi-vault-js has a path traversal and query parameter injection

Summary The hashi-vault-js library is vulnerable to path traversal and query string injection due to the lack of proper encoding of identifiers in path segments and query strings. This allows attackers to manipulate the request URL and potentially access unintended downstream endpoints or inject...

Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing

Impact In its default configuration, a Rails application that displays image variants may allow an unauthenticated attacker to read arbitrary files from the server, including the process environment. That environment typically holds secretkeybase and often credentials for external systems, which...

CVE-2026-18245 Incomplete fix for CVE-2025-4318 code injection in Amazon @aws-amplify/codegen-ui-react

Improper control of code generation in Amazon @aws-amplify/codegen-ui-react before 2.20.6 might allow a remote authenticated user to execute arbitrary code in end-user browsers, developer machines, CI/CD environments, and server-side rendering contexts via crafted Studio component or theme schema...

SUSE CVE-2026-55076

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, Coder's OIDC callback checked emailverified with a direct Go bool type assertion. When an IdP returned the claim as a non-boolean for example the string...

Out-of-bounds Read

Overview Magick.NET-Q16-HDRI-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package a...

Out-of-bounds Read

Overview Magick.NET-Q8-AnyCPU is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

PT-2026-66513

Name of the Vulnerable Software and Affected Versions Apache JSPWiki versions prior to 2.12.4 Description A lack of checks in the UserManager allows for impersonation, which may enable attackers to escalate privileges. Recommendations Upgrade to version 2.12.4 or newer...

CVE-2026-13321 affecting package bind for versions less than 9.20.26-1

CVE-2026-13321 affecting package bind for versions less than 9.20.26-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-58183

The Apache Traffic Server prefetch plugin can crash when processing attacker-influenced input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the iss...

CVE-2026-65325

Apache Traffic Server reuses multiplexed HTTP/2 origin connections without verifying the server certificate covers the new request hostname. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1....

CVE-2026-58186 Apache Traffic Server: webp_transform plugin decodes unsafely and mislabels degraded responses

The Apache Traffic Server webptransform plugin can decode unsafely and serve mislabeled, cacheable responses. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4,...