5187 matches found
EUVD-2026-42629
Open WebUI: Cross-user model-list exposure via static cache key in getallmodels aiocache key= vs keybuilder= misuse...
EUVD-2026-44927
Microsoft Kiota: Code Generation Literal Injection in Kiota Python Generator...
CVE-2026-64244
In the Linux kernel, the following vulnerability has been resolved: drivers/base/memory: set mem-altmap after successful device registration If addmemoryblock fails at xastore under memory pressure for example, deviceunregister is called, which eventually triggers memoryblockrelease with mem-altm...
CVE-2026-64222
In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: avoid double free of pool-stack on AQ init failure otx2poolaqinit frees pool-stack when mailbox sync or retry allocation fails, but leaves the pointer unchanged. Later, otx2sqaurapoolinit unwinds the partial setup...
DEBIAN-CVE-2026-56391
GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w --check-chars option is used. The findfield function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input,...
CVE-2026-47752
Tugtainer is a self-hosted app for automating updates of Docker containers. Versions prior to 1.30.2 are vulnerable to Server-Side Template Injection SSTI in the notification template feature. The titletemplate and bodytemplate fields are rendered using an unsandboxed jinja2.Environment, allowing...
7zip-26.02-1.1 on GA media (moderate)
7zip-26.02-1.1 on GA media Announcement ID: openSUSE-SU-2026:11319-1 Rating: moderate Cross-References: CVE-2026-14266 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the 7zip-26.02-1.1 packag...
CVE-2026-47708 MCP-for-Stata: Command injection via log_file_name parameter in Stata command wrapper
MCP-for-Stata is an MCP server for Stata to integrate Stata into an agent. Prior to version 1.17.3, the logfilename parameter in the statado API and CLI is directly interpolated into a Stata command string without sanitization. The security guard GuardValidator only scans the do-file content but...
EUVD-2026-43956
pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs...
CVE-2026-16403
Spoofing issue in the Address Bar component. This vulnerability was fixed in Firefox 153 and Thunderbird 153...
CVE-2026-16399
Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 153 and Thunderbird 153...
CVE-2026-16399
Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 153 and Thunderbird 153...
EUVD-2026-46236
Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 153...
EUVD-2026-46227
Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 153 and Firefox ESR 140.13...
EUVD-2026-46223
Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153...
CVE-2026-16376
Denial-of-service in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153...
CVE-2026-16375
The Networking: HTTP component in Mozilla Firefox and Mozilla Thunderbird is affected by a site isolation issue (CVE-2026-16375). The vulnerability has been resolved in Firefox 153 , Firefox ESR 140.13 , and Thunderbird 153 (including Thunderbird 140.13 ). For Amazon Linux 2 , the fix is availabl...
EUVD-2026-46205
Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13...
