CVE-2026-61848

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax...

CVE-2026-61846

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax...

CVE-2026-61847

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax...

CVE-2026-61845

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax...

CVE-2026-119728

A flaw was found in the H.264 video parser in gst-plugins-bad. When pr...

CVE-2026-119727

A flaw was found in GStreamer's gst-plugins-bad H.265 video parser. Wh...

CVE-2026-116366

An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server...

CVE-2026-119760

sniproxy through 0.7.0 contains a NULL pointer dereference vulnerabili...

CVE-2026-115865

Starlet versions before 0.33 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory. The request body is read in a loop that asks sysread for all of the remaining declared length at once. Perl grows the read buffer to that size before any data arrives, so ...

CVE-2026-116127

Starlet versions before 0.33 for Perl send a body in responses to HEAD requests, corrupting the next response on a persistent or pipelined connection. The request method is not passed to the response writer, so whatever body the application returns for a HEAD request is sent. With...

CVE-2026-115866

Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular expression backtracking when decoding chunked request bodies. A chunk-size line is matched as a run of hex digits, then . and a CRLF. A run followed by a bare LF and then a CRLF can never match, and the engine retrie...

CVE-2026-116128

Starlet versions from 0.20 before 0.33 for Perl allow memory exhaustion via unbounded buffering when decoding chunked request bodies. The decoder adds each read to one buffer of unconsumed input. Nothing limits the length of a chunk-size line, so a line without a CRLF grows the buffer for as long...

CVE-2026-119147

ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorization bypass in the modsftp copy-file extension handler that skips Limit WRITE checks for new destination files. Authenticated SFTP users can copy any readable file to a new path in write-denied directories, creating files where uploads are...

CVE-2026-119146

ProFTPD before 1.3.9e and 1.3.10rc5 contains a buffer overflow vulnerability in the modrewrite int:utf8trans RewriteMap that allows remote attackers to overwrite static buffers. Attackers can send FTP command arguments longer than 1024 bytes, without authentication if pre-login commands are...

CVE-2026-119364

ProFTPD through 1.3.9e and 1.3.10rc1 through 1.3.10rc4 contains a link-following vulnerability in modcopy that allows authenticated FTP users to bypass Limit WRITE restrictions via symlinks. Attackers can place a symlink in a writable directory and use SITE COPY or SITE CPTO to overwrite files in...

CVE-2026-62303

Pistache is a high-performance REST toolkit written in C++. From 0.0.5...

CVE-2026-116130

HTTP::Parser::XS versions before 0.18 for Perl truncate PATHINFO at an encoded NUL byte in parsehttprequest. The XS parser URL-decodes the request path and measures the result with strlen, so PATHINFO ends at the first byte decoded from %00. The pure-Perl backend is not affected. A remote attacke...

CVE-2026-119528

A flaw was found in GIMP. The PSD plug-in’s image resource header loader uses an incorrect destination size when copying a converted resource name into a fixed stack buffer. Opening a crafted PSD file can cause a stack-based buffer overflow, leading to a crash and potentially arbitrary code...

CVE-2026-119777

A flaw was found in GStreamer's gst-plugins-bad H.266/VVC parser. When...

CVE-2026-119842

A flaw was found in GStreamer's gst-plugins-base MicroDVD subtitle par...

CVE-2026-119729

A flaw was found in GStreamer. An integer overflow vulnerability in th...

CVE-2026-84243

The gettext family of functions in the GNU C Library version 2.0 and l...

CVE-2026-119416

CakePHP through 5.4.3 contains an improper cookie domain validation vulnerability in the Http Client CookieCollection that allows malicious servers to receive and plant cookies by abusing unanchored suffix matching. Attackers controlling a host such as one ending in a victim domain suffix, or...

CVE-2026-119415

CakePHP through 5.4.3 contains a header injection vulnerability in FormDataPart that allows attackers to inject MIME part headers via unsanitized Content-Type and Content-ID values. Attackers can supply CR/LF sequences in attachment MIME types or Content-IDs passed to Message::setAttachments or...

CVE-2026-119417

CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom...

CVE-2026-119418

CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated frame offsets and directions to WindowExpression::range and frame. Attackers can pass crafted values through applications forwarding user input into the OVER clause to execut...

CVE-2026-119419

CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated collation values to StringExpression and IdentifierExpression. Attackers controlling a collation name passed to the constructor or setCollation can append SQL after the...

CVE-2026-119718

Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability caused by integer overflow in ptcachedataalloc when reading point cache files. Attackers can supply a crafted point cache file with a large totpoint value alongside a .blend file to crash Blender or execute...

CVE-2026-119719

Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability in the blend file thumbnail extractor caused by 32-bit integer overflow in thumbdataverticalflip. Attackers can craft a .blend file with malicious TEST block dimensions that trigger an out-of-bounds write whe...

CVE-2026-119720

Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds read vulnerability in readfiledna that reads a GLOB block field without validating its declared length. Attackers can supply a crafted .blend file with a truncated GLOB block that, when opened, triggers the out-of-bounds rea...

CVE-2026-119722

Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds access vulnerability in readstruct that skips size validation when a .blend file's SDNA struct layout compares equal. Attackers can supply a crafted .blend file with short blocks so field reads, writes, and pointer...

CVE-2026-119721

Blender before 4.5.15 and 5.x before 5.2.3 contains an out-of-bounds read vulnerability in blobheadid accessors in readfile.cc that read ID fields without block length checks. Attackers can supply a crafted .blend file with short ID blocks that, when browsed or appended from, causes heap over-rea...

CVE-2026-103963

A flaw was found in glib-networking. When establishing connections using Transport Layer Security TLS version 1.3, the client-side session cache does not limit the number of session tickets retained for a single host. A malicious server can exploit this by sending excessive session ticket message...

CVE-2026-118475

A flaw was found in Eye of GNOME. When parsing a specially crafted PNG image containing malformed color profile metadata, the application fails to validate chunk boundaries while searching for a null terminator. An attacker could trick a user into opening a malicious image, causing the applicatio...

CVE-2026-116591

compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable ...

CVE-2026-112922

A flaw was found in Ghostscript. A remote attacker could exploit this vulnerability by enticing a user to process a specially crafted PDF or PostScript document containing malicious mesh shading data. Due to improper bounds validation during the processing of indexed color values, Ghostscript...

CVE-2026-110133

A flaw was found in Ghostscript. When processing a specially crafted TrueType font or document embedding one, an accounting error during font rendering can bypass buffer size checks, triggering a heap-based buffer overflow. A remote attacker could exploit this by enticing a victim or automated...

CVE-2026-116590

snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. Prior to 1.1.10.9, Snappy.arrayCopyObject src, int offset, int byteLength, Object dest, int destOffset passes caller-supplied ranges to native memcpy without validating either array, allowing negativ...

CVE-2026-119281

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the connector assumed result bytes were UTF-8 but guarded only changes to charactersetclient. It did not reject non-UTF-8 charactersetresults changes an...

CVE-2026-119279

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.10, the ReadableByteBuf.readLength and ReadableByteBuf.readIntLengthEncodedNotNull methods narrowed the protocol's unsigned 8-byte length-encoded integer to...

CVE-2026-119280

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the MariaDbPoolConnection.recover and MariaDbPoolPinnedConnection.recover implementations trusted the gtridlength and bquallength columns returned by XA...

CVE-2026-119278

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7 and 3.4.5, during cachingsha2password authentication, the authentication-more-data response was treated as a length-encoded byte array, memory was allocated from the...

CVE-2026-119277

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, decoders for OK packet session-state blocks, column definition packets, text row data, or binary row data used server-declared lengths without confirmin...

CVE-2026-119276

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, when CLIENTSESSIONTRACK was negotiated, the OkPacket.parse and OkPacket.parseWithInfo paths allocated byte arrays using server-declared lengths for the ...

CVE-2026-119210

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the ClientMessage.validateLocalFileName check used a regular expression that could match LOAD DATA LOCAL INFILE text inside quoted identifiers, string...

CVE-2026-116587

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. Prior to 4.1.6, go-jose parses attacker-controlled RSA modulus and prime values from...

CVE-2026-116585

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. Prior to 4.1.5, decrypting untrusted JWE ciphertext with A128CBC-HS256, A192CBC-HS384...

CVE-2026-116586

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested...

CVE-2026-119208

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive time and memory when an application accesses the page count of a crafted encrypted PDF whose page tree declares a forged /Count value. Even after successful decryption, page-count retrieval trust...

CVE-2026-119209

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory while opening a crafted PDF containing cross-reference streams that declare very large entry counts. Highly compressible streams and /Prev chains can multiply the number of parsed entries...