CVE-2026-88360

Removed by vendor...

CVE-2026-88369

zserge jsmn commit 25647e6 is vulnerable to Buffer Overflow in example/jsondump.c dump...

CVE-2026-88359

libfyaml 0.9.6 contains a stack exhaustion vulnerability in fyatomiterformat. When processing a specially crafted YAML document containing a very large literal or folded block scalar, the function repeatedly grows an internal buffer using alloca inside a loop. The allocated stack memory is not...

CVE-2026-88383

libical 4.0.6 contains an incompatible function pointer in icalparameterstringtokind. When parsing iCalendar data containing a parameterized property, the function passes icalparametercomparekindmap to bsearch through an incompatible comparator function pointer type. bsearch invokes the callback...

CVE-2026-88373

libde265 commit 4d45a6b contains a NULL pointer dereference vulnerability in the NAL parsing path. When de265pushNAL is called with a zero-length NAL unit, the resulting NALunit may retain a NULL backing buffer, which is subsequently passed as the destination argument to memcpy in NALunit::setdat...

CVE-2026-88372

libsndfile 1.2.2 contains an integer overflow vulnerability in mat4readheader when parsing crafted MAT4 MATLAB v4 files...

CVE-2026-88386

libsndfile 1.2.2 contains a misaligned memory access issue in psfbinheaderreadf while parsing WAV fmt chunks. A specially crafted WAV file can cause the function to cast an unaligned destination address to unsigned int and perform a 4-byte store. This results in undefined behavior leading to deni...

CVE-2026-88387

LibRaw 0.22.0 contains an incorrect numeric conversion vulnerability in LibRaw::parsetiffifd when processing TIFF tag 0x00fe NewSubfileType. A specially crafted RAW, TIFF, or DNG file can supply an attacker-controlled NewSubfileType value outside the range of a signed int. The parser converts thi...

CVE-2026-88382

hiredis commit 29ea279 post-v1.5.0 contains an uncontrolled memory allocation vulnerability in its RESP aggregate parser...

CVE-2026-88385

Mini-XML 4.0.5 contains a memory leak vulnerability in mxmlloaddata during malformed XML parsing. Specially crafted XML input can cause text nodes allocated by mxmlNewText to become unlinked before a parse error transfers control to the cleanup path. These orphaned nodes are not released, resulti...

CVE-2026-88384

OpenEXR 3.4.14 contains a NULL Pointer Dereference in the C++ attribute parsing path. A specially crafted EXR file containing an unknown-type attribute with dataSize set to zero causes the parser to create an opaque attribute with a NULL packeddata pointer. The OpaqueAttribute constructor passes...

CVE-2026-88378

QuickJS commit 04be24600 contains a heap out-of-bounds write condition in JSReadFunctionTag...

CVE-2026-88362

MuJS e892c9fdb contains an incorrect numeric conversion vulnerability in jsRisindex in jsrun.c. A specially crafted JavaScript input containing an excessively large numeric array index can cause an out-of-range floating-point value to be converted to an integer without proper range validation. Th...

CVE-2026-88357

nDPI 5.1.0 contains a memory access issue in the DNS dissector and serializer deserialization code. Specially crafted network input can cause byte-buffer addresses at odd offsets to be cast to uint16t or wider integer pointers and directly dereferenced without alignment checks. This results in...

CVE-2026-88358

simdjson 4.6.1 contains a one-byte out-of-bounds read vulnerability in dom::parser::parseunpadded. A specially crafted truncated JSON document whose final structural token closes a nested array or object can cause jsoniterator::walkdocument to access buflen after the input buffer has been...

CVE-2026-88371

ZBar commit 2ea2ca58 contains an undefined-behavior vulnerability in the Code 128 decode6 function. When processing specially crafted Code 128 input, decodee can return -1 for an invalid edge pattern, and decode6 subsequently left-shifts this negative signed value while constructing the edge...

CVE-2026-89078

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to a double free issue when parsing a...

CVE-2026-93577

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to an integer overflow issue when...

CVE-2026-59980

hpack is an HTTP/2 Header Encoding for Python. Prior to version 4.2.0, unbounded variable integer decoding can cause run-away computation on malformed input leading to On^2 runtime, effectively blocking further processing with large enough unsanitized input. A fix is available in python-hyper/hpa...

CVE-2026-67221

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The AMQP 0-9-1 shovel calls amqpuri:removecredentials before storing its connection URI, but the AMQP 1.0 shovel stores the raw URI including the password. The stored URI is visible via GET...

CVE-2026-67231

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The trust-store plugin installs a verifyfun that overrides badcert, unknownca / badcert, selfsignedpeer when the presented cert "matches" a whitelisted one. The match key is extractissuerid/...

CVE-2026-67218

RabbitMQ is a messaging and streaming broker. Prior to versions 4.0.22, 4.1.11, 4.2.6, and 4.3.0, acceptcontent/2 at line 56 calls rabbitstreammanager:createsuperstream/... directly after isauthorized which only checks the management tag + vhost access via isauthorizedvhost. The stream-protocol...

CVE-2026-66074

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, matchvalue/3 passes the user-supplied ?name= regular expression to re:run with no matchlimit option, and executes it once per resource in the result set. OTP's default 10M matchlimit caps ea...

CVE-2026-67232

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The cowboy WebSocket options at line 117 set compress = true, enabling RFC 7692 permessage-deflate negotiation. The handler does not set maxframesize, so cowboy's default of infinity applies...

CVE-2026-67405

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, Neither the Web-MQTT handler deps/rabbitmqwebmqtt/src/rabbitwebmqtthandler.erl:104 nor the Web-STOMP handler deps/rabbitmqwebstomp/src/rabbitwebstomphandler.erl:102 validates the Origin head...

CVE-2026-66075

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, isauthorized/2 for the /federation-links/.../restart route uses isauthorizedmonitor accepts the monitoring tag, while allowedmethods permits DELETE and deleteresource/2 triggers...

CVE-2026-67219

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, addbinding/3 parses the routing key as an integer weight N and computes ring positions with lists:seqNextN0, NextN0 + N - 1. validatebinding/2 only checks N = 1 , no upper bound. The resulti...

CVE-2026-67228

RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, The runtime-parameters lookup path coerces the URL :component segment to an atom with rabbitdatacoercion:toatom/1 in lookupcomponent/1 deps/rabbit/src/rabbitruntimeparameters.erl, creating a new atom for any previous...

CVE-2026-67235

RabbitMQ is a messaging and streaming broker. Prior to versions 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15, The content-header BodySize a uint64 was stored without validation against maxmessagesize. The size check ran only when assembly completed. By declaring bodysize = 2^63-1 and then streaming...

CVE-2026-66068

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, ?LOGDEBUG"shutting down Shovel 'ts', ... Shovel state: tp", Name, State formats the entire state map. The 'uris' field holds plaintext URIs after credentialsobfuscation:decrypt called in...

CVE-2026-67229

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, addvhost/2 calls rabbitdatacoercion:atomizekeys/1 the unsafe variant using binarytoatom on the vhost metadata map. The 20 MB management body limit fits 1M+ short keys. Admin-only. An...

CVE-2026-66080

RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.11, 4.2.6, and 4.3.0, validatepartitions only checks that the requested partition count is at least 1, with no upper bound. A large count such as lists:seq0, 500000000 allocates roughly 8GB. Preconditions include The...

CVE-2026-67240

RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, patterntoregex maps % - .? and - ., then compiles ^...$ with only unicode; re:run is called with only capture, none - no explicit matchlimit. A pattern like %%...%X becomes ^.?..?.....?.X$ with overlapping lazy...

CVE-2026-66072

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, getchunkselector/1 calls binarytoatom on the raw client-supplied property from post-auth subscribe and resolveoffsetspec frames, with no whitelist and no existing guard. An authenticated...

CVE-2026-66067

RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, The stream open handler calls only checkvhostaccess; it omits the node/vhost/user connection-limit checks that rabbitreader performs for AMQP. A developer %% FIXME comment at the cited line explicitly acknowledges th...

CVE-2026-66069

RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.13, 4.2.7, and 4.3.0, isauthorized/2 uses isauthorizedmonitor for all methods. DELETE resets rabbitcoremetrics:resetauthattemptmetrics. Impact is cosmetic counters only, no log erasure, but inconsistent with rabbitmgmtwmreset.erl...

CVE-2026-67404

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, When no CA bundle is available, ssloptions/1 falls back to verify, verifynone with no warning. An attacker in a man-in-the-middle position can forge the JWKS response, which leads the broker...

CVE-2026-67220

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, 4.3.0, When a binding is created on an x-jms-topic exchange, addbinding/3 reads the rjmserlangselector argument and passes it through erlscan:string/1 then erlparse:parseterm/1. erlscan:string/1 intern...

CVE-2026-67224

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, The trace consumer constructs the output path as filename:joinTraceDir, Name ++ ".log" where Name comes from PUT /api/traces/:vhost/:name. No saferelativepath / traversal check is applied on...

CVE-2026-66077

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, The management UI uses EJS 1.0 in which does NOT HTML-escape. connection.ejs:135 renders and peercertissuer directly into the page. The same pattern appears in streamConnection.ejs:102,106,110. The...

CVE-2026-66079

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, parsearrayprimitive/2 for constructor 0x45 list0 returns an element with byte-width B = 0. The enclosing array32 parser at line 148 reads a 4-byte Count from the wire and loops Count times consumin...

CVE-2026-66070

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, matchorigin/1 returned the bare reflected Origin and allowed credentials even when the wildcard "" was configured, so the response echoed the attacker's origin together with...

CVE-2026-67238

RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, rabbitpidcodec:decomposefrombinary/1 parses a caller-supplied ETF-encoded binary and calls binarytoatomNode, utf8 on the node-name field. It is reached from rabbitvolatilequeue:pidfromname/2, which is invoked for any...

CVE-2026-66076

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, isauthorized/2 calls rabbitmgmtutil:isauthorized/2, which checks only the management tag, instead of isauthorizedvhost/2. The /api/queues/quorum/:vhost/:queue/status handler reads the vhost...

CVE-2026-96889

A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions Xincludes with duplicate entity declarations, a use-after-free error can occur. This vulnerability arises because the library incorrectly frees an XML entity that is still in use by the parser. An attack...

CVE-2026-59990

Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nesting without a depth limit, allowing a remote attacker who can submit untrusted JSON to grow parser contexts until the JVM heap is exhausted. The resulting...

CVE-2026-61814

Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks because each absorb call rescans the incomplete token from the start. A remote attacker who controls untrusted JSON input and its chunk...

CVE-2026-96546

A one-byte out-of-bounds heap read flaw was found in GIMP's uncompressed DDS image loader. When a user opens an uncompressed DDS image, the file-dds plug-in performs an unconditional one-byte look-ahead after processing the final pixel. This may cause the plug-in to crash if the byte immediately...

CVE-2026-96545

An out-of-bounds heap read flaw was found in GIMP's TIM image loader. When a user opens a crafted 4bpp TIM image that causes promotion to an RGBA layer, the file-tim plug-in allocates an undersized row buffer but processes it using the larger RGBA row size. This can copy adjacent heap contents in...

CVE-2026-77423

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in less viewer passes user-controlled search and display-filter patterns from getPatternboolean doDisplayPattern in builtins/src/main/java/org/jline/builtins/Less.java directly to Java's...