CVE-2026-114609

fpdf2 is a PDF creation library for Python. Prior to 2.8.8, fpdf2's shared image loader automatically dereferences attacker-controlled HTTPS URLs and raw local paths supplied through FPDF.image, FPDF.writehtml HTML values, SVG or xlink:href values, and template image fields. This can cause outbou...

CVE-2026-114608

Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINTHOME and loads those files with pickle.load on a later run. An attacker who can write to a shared, group-writable, or otherwise untrusted cache directory can...

CVE-2026-97631

EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It could also impact Confidentiality,...

CVE-2026-114605

dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.fromwireparser follows attacker-controlled DNS compression pointer chains without a hop limit. A malicious DNS wire-format message can force excessive pointer traversal during name decompression, causing high CPU use, application...

CVE-2026-75507

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.0.0 until 3.2.12 and 3.3.0rc1, the OverlappingFieldsCanBeMerged rule in specifiedrules repeatedly compares fields that share response names and recursively re-compares flattened inline fragments during the validation...

CVE-2026-75508

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.2.3 until 3.2.12 and 3.3.0rc1, the parser's maxtokens limit in Parser.advancelexer counts only non-comment tokens returned after Lexer.lookahead skips comments. Each skipped comment is still allocated as a Token and...

CVE-2026-114603

OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the opentelemetry-api function TraceState.fromheader in opentelemetry/trace/span.py, reached through TraceContextTextMapPropagator.extract, parses inbound W3C tracestate headers with an unbounded...

CVE-2026-111181

body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a...

CVE-2026-111497

A buffer overflow vulnerability in the Brotli decoder c/dec/decode.c in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially...

CVE-2026-92709

Rsyslog is a rocket-fast system for log processing. From versions 1.15.0 to 8.2610.0, rsyslog's omfile dynaFile facility intentionally allows templates to generate flexible output paths. This supports valid deployments that route logs into different directories or use dynamically generated file...

CVE-2026-115327

libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxmlenvnetconfrpc in src/parserxml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lydparseop to crash servers like netopeer2 or...

CVE-2026-115319

fzf 0.36.0 through 0.74.5 contains an inefficient algorithmic complexity vulnerability in maskActionContents that allows local attackers to exhaust the --listen HTTP server through quadratic string concatenation. Attackers can repeatedly send POST bodies of about 1 MB to the unauthenticated...

CVE-2026-115207

A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, absolute file paths in patch headers a...

CVE-2026-106017

Improper certificate validation in the OpenVPN 3 Core library version 3.4 through 3.11.7 allows attackers to circumvent extended key usage restrictions...

CVE-2026-114460

A flaw was found in modqos. An off-by-one pointer calculation error occurs when merging request body parameters with an existing URL query, which truncates the query string during security evaluation while leaving the actual request unchanged. An unauthenticated remote attacker could exploit this...

CVE-2026-114459

A flaw was found in modqos. When inspecting HTTP response bodies, improper boundary checking can cause the module to read memory outside allocated buffer boundaries. An unauthenticated remote attacker can exploit this vulnerability by triggering specifically crafted server responses, causing an...

CVE-2026-114458

A flaw was found in modqos. An unauthenticated remote attacker can cause a Denial of Service DoS by maintaining numerous concurrent low-rate connections to a target server. When connection rate monitoring is active, the module fails to verify array boundaries when recording client IP addresses,...

CVE-2026-114457

A flaw was found in modqos. An unauthenticated remote attacker could cause a Denial of Service DoS by sending a specially crafted JSON request when JSON body filtering is enabled. Due to improper string termination during the processing of percent-encoded input, the module reads past allocated...

CVE-2026-110353

HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service worker-thread CPU exhaustion via a truncated HTTP/2 PING frame. h2chandleping in src/muxh2.c does not check for a short read, unlike the other H2 frame handlers. Because the incomplete frame cannot be...

CVE-2026-110354

HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service persistent worker-thread CPU exhaustion via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without...

CVE-2026-114732

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user logs in with an alias address, rcubeuser::query matched the address against identity records without qualifying the lookup by IMAP host, so a log...

CVE-2026-114731

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy the utils/modcss action. The fetched stylesheet was read into memory in full, with no size limit and no read timeout, so a stylesheet URL referencing an...

CVE-2026-114730

Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcubeutils::islocalurl omitted the RFC 6052 NAT64 prefix 64:ff9b::/96, the RFC 8215 local-use NAT64 prefix 64:ff9b:1::/48 and the unspecified...

CVE-2026-114729

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcubewashtml inspected the SVG SMIL animation attributes to, from and values for URIs, but not by; so markup such as in an HTML message caused remote content to be loaded without the user's...

CVE-2026-114728

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes. rcubewashtml detected the CSS url token with a pattern that enumerated only some of its escaped spellings, so values using other CSS escape sequences, for...

CVE-2026-114727

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images. SVG and EPS were accepted as valid image types for contact photo upload and conversion, and both formats can reference external resources and invoke ImageMagick delegate...

CVE-2026-114726

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce resend action. rcubemime::decodeaddresslist did not strip control characters from the decoded display name, so a received message whose From display-name carries CRLF sequence...

CVE-2026-114725

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmailsendmail stripped newline characters only from the Subject and Organization headers, leaving other header values taken from request parameters unsanitized, so a remote authenticated...

CVE-2026-114724

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcubesession::unserialize. A session key prefixed with “!” was treated as having no value, and the reconstructed serialized string was emitted with a key but no corresponding value, desynchronizing th...

CVE-2026-114723

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation. When rcubeimage falls back to GD, the available-memory check was applied only on Windows, so on other platforms a crafted image with large dimensions was...

CVE-2026-114722

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages. rcubeutils::modcssstyles did not treat an at-rule prologue such as @layer a; as a selector boundary, and did not handle selectors beginning with ::, so selectors following an at-rule were...

CVE-2026-114721

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabledactions configuration setting to be bypassed. The check compared only the action name as requested, so a remote authenticated attacker could reach an action listed in disabledactions by requesting it through its deprecated...

CVE-2026-114720

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability. A remote authenticated attacker can exploit this via CRLF sequences injected into the flag parameter of the mail/mark action to execute arbitrary IMAP commands. Upstream fixed this in th...

CVE-2026-114719

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin. The plugin read the uid parameter from POST data but passed it to rcmail::getuids without constraining the input mode, so values re-read inside that...

CVE-2026-114718

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the password plugin. Error text returned by a password driver was concatenated into the message presented to the user without HTML escaping, so a backend able to influence that text, such...

CVE-2026-114717

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability when a message is forwarded as an attachment. The subject of the forwarded message was used verbatim to generate the attachment name, so a received message whose subject contains CRLF...

CVE-2026-114716

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmailsendmail::extractinlineimages used the media type taken from an inline image data URI without validating it, so a remote authenticated attacker could inject arbitrary MIME part heade...

CVE-2026-114715

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability in the Modoboa driver of the password plugin. The driver took the first entry of the account search result returned by the Modoboa API instead of matching the authenticated user, so a...

CVE-2026-114714

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmailusercopy plugin. With the file based backend, the source path was built from the login name without rejecting path separators, so a login name containing a slash could cause fil...

CVE-2026-110264

An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to...

CVE-2026-91403

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1; Oracle GraalVM for JDK: 17.0.21 and...

CVE-2026-94140

Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no. Every remote branch of sync builds its ssh command with that option, for password authentication, for private-key authentication and for the fallback. Th...

CVE-2026-114501

Pillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow export assumes that an image's rows are tightly contiguous and exports from im-blocks0.ptr even when PILLOWALIGNMENT makes alignedlinesize include row padding or an aligned offset before the first row. The resulting Arrow buffer...

CVE-2026-96639

Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode while a later frame of the same dimensions changes the logical mode and decoder tiles to wider RGB or CMYK data. ImageFile.loadprepare reuses the...

CVE-2026-96636

Pillow is a Python imaging library. Prior to 13.0.0, MpoImageFile.seek and DcxImageFile.seek reparse later MPO or DCX frames and replace self.size without rerunning Image.decompressionbombcheck. A crafted multi-frame image can use a tiny first frame to pass Image.open and then declare an over-lim...

CVE-2026-96640

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearizepagetree in src/PIL/PdfParser.py treats a PDF /Pages graph as a tree without tracking duplicate indirect references. When Image.save..., format="PDF", append=True processes an attacker-controlled existing PDF whose...

CVE-2026-96637

Pillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.seek in src/PIL/SpiderImagePlugin.py reparses a later SPIDER stack frame and replaces self.size without rerunning Image.decompressionbombcheck. A tiny file can use a safe first frame to pass Image.open and then declare very larg...

CVE-2026-96778

Pillow is a Python imaging library. From 9.4.0 until 13.0.0, ImagingJpegEncode in src/libImaging/JpegEncode.c can call jpegwritemarker for a JPEG COM comment when an ICC profile has exactly filled the 65536-byte encoder buffer. libjpeg writes one byte before checking the exhausted freeinbuffer...

CVE-2026-96643

Pillow is a Python imaging library. From 11.0.0 until 13.0.0, Exif.load in src/PIL/Image.py repeatedly slices the remaining EXIF data while it begins with the six-byte Exif header. src/PIL/PngImagePlugin.py accepts an uncapped PNG eXIf chunk, so a file filled with repeated headers causes a new...

CVE-2026-96644

Pillow is a Python imaging library. Prior to 13.0.0 on Windows, src/PIL/WmfImagePlugin.py passes unchecked 32-bit WMF or EMF dimensions to the native drawwmf handler in src/display.c. The handler sizes a DIB allocation from 16-bit-truncated bcWidth and bcHeight fields but copies pixel data using...