490134 matches found
CVE-2026-63388 affecting package mysql for versions less than 8.0.46-2
CVE-2026-63388 affecting package mysql for versions less than 8.0.46-2. A patched version of the package is available...
CVE-2026-47895 affecting package strongswan for versions less than 5.9.14-10
CVE-2026-47895 affecting package strongswan for versions less than 5.9.14-10. A patched version of the package is available...
CVE-2026-63385 affecting package libevent for versions less than 2.1.13-1
CVE-2026-63385 affecting package libevent for versions less than 2.1.13-1. An upgraded version of the package is available that resolves this issue...
CVE-2026-63382 affecting package libevent for versions less than 2.1.13-1
CVE-2026-63382 affecting package libevent for versions less than 2.1.13-1. An upgraded version of the package is available that resolves this issue...
CVE-2026-84394 fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority
fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but does not end with a closing bracket is neither validated as an IP literal nor canonicalized as a domain name, so parse returns it as the ho...
trufflehog v3.97.2
TruffleHog Find leaked credentials. 🔎 Now Scanning ...and more To learn more about TruffleHog and its features and capabilities, visit our product page. 🌐 TruffleHog Enterprise Are you interested in continuously monitoring Git, Jira, Slack, Confluence, Microsoft Teams, Sharepoint and more for...
CLSA-2026-1788373419 TuxCare security update for postcss (2 CVEs)
TuxCare rebuilt postcss to address 2 CVEs. Fixed in 8.4.14-tuxcare.4...
CVE-2026-84382
HTTPX2 is a next generation HTTP client for Python. Prior to 2.12.0, the HTTPX2 content decoders in src/httpx2/httpx2/decoders.py fully inflate each gzip, deflate, br, or zstd network chunk before iterbytes or aiterbytes yields bounded pieces to the application. A 64 KiB compressed chunk can expa...
CVE-2026-84381
HTTPX2 is a next generation HTTP client for Python. Prior to 2.10.0, httpcore2 fails to start TLS in src/httpcore2/httpcore2/sync/socksproxy.py and src/httpcore2/httpcore2/async/socksproxy.py when the remote origin uses wss through a SOCKS5 proxy because the TLS upgrade condition only recognizes...
CVE-2026-84380
HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, Request.prepare in src/httpx2/httpx2/models.py can add a body-derived Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header because its setdefault processing checks each default head...
CVE-2026-53670 PREVAIL: Non-singleton typeset in add() skips offset update, allowing OOB access to pass eBPF verification
PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, in the Prevail eBPF verifier, EbpfTransformer::add silently skips offset-variable updates when the destination register carries a non-singleton typeset two or more simultaneously possible...
CVE-2026-84378
HTTPX2 is a next generation HTTP client for Python. From 2.5.0 until 2.10.0, the HTTPX2 Server-Sent Events parser in src/httpx2/httpx2/sse.py repeatedly copies and rescans buffered text in SSELineDecoder.decode when an attacker-controlled or compromised SSE endpoint splits one unterminated line...
EUVD-2026-70150
Jenkins update-center2 3.18.3 and earlier does not escape plugin-provided values plugin names, descriptions, and version metadata on plugin download index pages, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to provide a plugin for hosting...
CVE-2026-84677
The Jenkins update-center2 tool (version 3.18.3 and earlier ) contains a stored cross-site scripting (XSS) vulnerability. The root cause is the failure to escape plugin-provided values, specifically plugin names, descriptions, and version metadata , when rendering plugin download index pages. Thi...
6thbridge-hexa-docs (0.0.1), @12-labours/mapintegratedvuer (>=1.0.0-beta.0, <=1.0.0-beta.14) +1091 more potentially affected by CVE-2026-83610 via @xmldom/xmldom (>=0.9.0, <=0.9.11)
@xmldom/xmldom NPM version =0.9.0, =1.0.0-beta.0, =0.0.1, =0.0.1, =0.0.1, =2.4.4, =0.1.30-develop-map-0, =0.1.0, =0.3.2-beta.0, =2.0.2, =0.8.1, =0.1.0, =0.8.0, =0.1.0, =0.2.2 and more Source cves: CVE-2026-83610 Source advisory: OSV:GHSA-6GMQ-8VP8-GCM6...
GHSA-FC8X-2RWW-XW9M pypdf: Inefficient handling of non-whitespace inputs in read_until_whitespace
Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires a call to readuntilwhitespace with an input which does not have whitespace for a long time. Patches This has been fixed in pypdf==6.15.0. Workarounds If you cannot upgrade yet, consider...
NPM: pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph
NPM: pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph vulnerability discovered by ? in WordPress Npm pnpm versions 10.34.5...
EUVD-2026-42744
Siyuan: Authenticated path traversal in /snippets/ static handler serveSnippets leaks conf/conf.json secrets and siyuan.db...
