CVE-2026-63382 affecting package libevent for versions less than 2.1.13-1

CVE-2026-63382 affecting package libevent for versions less than 2.1.13-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-63385 affecting package libevent for versions less than 2.1.13-1

CVE-2026-63385 affecting package libevent for versions less than 2.1.13-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-63388 affecting package ntp for versions less than 4.2.8p17-3

CVE-2026-63388 affecting package ntp for versions less than 4.2.8p17-3. A patched version of the package is available...

CVE-2026-63382 affecting package ntp for versions less than 4.2.8p17-3

CVE-2026-63382 affecting package ntp for versions less than 4.2.8p17-3. A patched version of the package is available...

CVE-2026-63383 affecting package ntp for versions less than 4.2.8p17-3

CVE-2026-63383 affecting package ntp for versions less than 4.2.8p17-3. A patched version of the package is available...

CVE-2026-63388 affecting package mysql for versions less than 8.0.46-2

CVE-2026-63388 affecting package mysql for versions less than 8.0.46-2. A patched version of the package is available...

CVE-2026-63383 affecting package libevent for versions less than 2.1.13-1

CVE-2026-63383 affecting package libevent for versions less than 2.1.13-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-79921 affecting package keda for versions less than 2.14.1-18

CVE-2026-79921 affecting package keda for versions less than 2.14.1-18. A patched version of the package is available...

CVE-2026-79921 affecting package telegraf for versions less than 1.31.0-31

CVE-2026-79921 affecting package telegraf for versions less than 1.31.0-31. A patched version of the package is available...

CVE-2026-84394 fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority

fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but does not end with a closing bracket is neither validated as an IP literal nor canonicalized as a domain name, so parse returns it as the ho...

trufflehog v3.97.2

TruffleHog Find leaked credentials. 🔎 Now Scanning ...and more To learn more about TruffleHog and its features and capabilities, visit our product page. 🌐 TruffleHog Enterprise Are you interested in continuously monitoring Git, Jira, Slack, Confluence, Microsoft Teams, Sharepoint and more for...

CLSA-2026-1788373419 TuxCare security update for postcss (2 CVEs)

TuxCare rebuilt postcss to address 2 CVEs. Fixed in 8.4.14-tuxcare.4...

CVE-2026-84382

HTTPX2 is a next generation HTTP client for Python. Prior to 2.12.0, the HTTPX2 content decoders in src/httpx2/httpx2/decoders.py fully inflate each gzip, deflate, br, or zstd network chunk before iterbytes or aiterbytes yields bounded pieces to the application. A 64 KiB compressed chunk can expa...

CVE-2026-84381

HTTPX2 is a next generation HTTP client for Python. Prior to 2.10.0, httpcore2 fails to start TLS in src/httpcore2/httpcore2/sync/socksproxy.py and src/httpcore2/httpcore2/async/socksproxy.py when the remote origin uses wss through a SOCKS5 proxy because the TLS upgrade condition only recognizes...

CVE-2026-84380

HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, Request.prepare in src/httpx2/httpx2/models.py can add a body-derived Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header because its setdefault processing checks each default head...

CVE-2026-53670 PREVAIL: Non-singleton typeset in add() skips offset update, allowing OOB access to pass eBPF verification

PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, in the Prevail eBPF verifier, EbpfTransformer::add silently skips offset-variable updates when the destination register carries a non-singleton typeset two or more simultaneously possible...

CVE-2026-84378

HTTPX2 is a next generation HTTP client for Python. From 2.5.0 until 2.10.0, the HTTPX2 Server-Sent Events parser in src/httpx2/httpx2/sse.py repeatedly copies and rescans buffered text in SSELineDecoder.decode when an attacker-controlled or compromised SSE endpoint splits one unterminated line...

CVE-2026-84677

The Jenkins update-center2 tool (version 3.18.3 and earlier ) contains a stored cross-site scripting (XSS) vulnerability. The root cause is the failure to escape plugin-provided values, specifically plugin names, descriptions, and version metadata , when rendering plugin download index pages. Thi...

EUVD-2026-70150

Jenkins update-center2 3.18.3 and earlier does not escape plugin-provided values plugin names, descriptions, and version metadata on plugin download index pages, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to provide a plugin for hosting...

6thbridge-hexa-docs (0.0.1), @12-labours/mapintegratedvuer (>=1.0.0-beta.0, <=1.0.0-beta.14) +1091 more potentially affected by CVE-2026-83610 via @xmldom/xmldom (>=0.9.0, <=0.9.11)

@xmldom/xmldom NPM version =0.9.0, =1.0.0-beta.0, =0.0.1, =0.0.1, =0.0.1, =2.4.4, =0.1.30-develop-map-0, =0.1.0, =0.3.2-beta.0, =2.0.2, =0.8.1, =0.1.0, =0.8.0, =0.1.0, =0.2.2 and more Source cves: CVE-2026-83610 Source advisory: OSV:GHSA-6GMQ-8VP8-GCM6...