74098 matches found
CVE-2026-115892
Wasmtime is a runtime for WebAssembly. From 46.0.0 until 48.0.7 and 49.0.4, lowering a host-created component-model stream or future into a guest can omit a required payload-type check after the value passes through guest code and returns through StreamAny, FutureAny, Val::Stream, Val::Future, or...
CVE-2026-115889
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with many SSA values. The overflow can make...
CVE-2026-115877
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.web.http.HTTPChannel.headerReceived rejects a NUL byte in an HTTP header value but accepts a bare carriage return or bare line feed. Because Twisted splits header lines only on CRLF...
CVE-2026-83813
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.names.dns.DNSDatagramProtocol accepts a UDP DNS response for a pending query when its 16-bit transaction ID matches but does not verify that the response came from the queried host...
CVE-2026-115778
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.conch.telnet.Telnet.dataReceived appends every byte received after IAC SB to a persistent subnegotiation buffer until IAC SE is received, without applying a maximum length. Telnet...
CVE-2026-115776
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.words.protocols.irc.IRC.dataReceived retains all bytes received without a line feed in its per-connection buffer and applies no maximum line length. The twisted.words.service.IRCUse...
CVE-2026-115775
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, the twisted.words.xish.domish ExpatElementStream parser allows an unauthenticated remote peer to keep a container element open while continuously adding child elements. The parser retains t...
CVE-2026-115774
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.mail.imap4.IMAP4Server reaches twisted.mail.imap4.parseNestedParens with a negative literal size in an authenticated SEARCH command after the client enters the selected mailbox stat...
CVE-2026-113877
HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions. languagematch interpolates each Accept-Language range into the pattern /^$range-/i without escaping it, so regular expression syntax in the header reaches the...
CVE-2026-115586
virtualenv is a tool for creating isolated virtual python environments. From 21.14.9 until 21.14.13, the bash bin/activate script can copy an attacker-controlled --prompt value into PS1 without escaping dollar signs or backticks when both promptvars and POSIX mode are disabled during activation...
CVE-2026-115585
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an incomplete remediation for repeated malformed cross-reference entries in GHSA-55h5-xmcq-c37v could still trigger a complete PDF stream reload during each recovery attempt even when a recovery cache was present, causing...
CVE-2026-115580
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF with a standard cross-reference table whose declared entry count exceeds what the file can contain, causing excessive processing and long runtimes when the file is opened. This issue is fixed in...
CVE-2026-115572
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF that repeatedly references the same nonexistent indirect object, causing relevant file parts such as pages to trigger repeated full-file recovery loads and long runtimes when accessed. This issue...
CVE-2026-115863
ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in getdomains in gdhcp/client.c. It copies a fixed NSMAXDNAME 1025 bytes from a DHCPv6 DOMAINLIST option 24 value into a 1026-byte stack buffer dnsname regardless of the actual option length, then walks...
CVE-2026-115567
Tokio is a runtime for writing applications with Rust. In 1.54.0, a race condition between tokio::time::Interval::polltick including .tick.await and the multi-threaded runtime's time driver could drop an internal timer entry without synchronizing with the driver thread that was firing it. The rac...
CVE-2026-105481
A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931. The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event...
CVE-2026-105482
A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve functions and dns.reverse. This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup and the net/tls host options. Because the name is passed to c-ares as a C strin...
CVE-2026-105483
A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits １２７.0.0.1. tls.checkServerIdentity did not recognize such hosts as IP...
CVE-2026-106069
A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as 0127.0.0.1. tls.checkServerIdentity normalizes the host...
CVE-2026-106070
A flaw in the Node.js zlib.ZipFile API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails. When zipEntry.modified is read on an archive whose local header does not match its central directory, either directly or while...
CVE-2026-106071
A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard --allow-fs-read or --allow-fs-write rule. When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a...
CVE-2026-106072
A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as 0177.0.0.1, 0x7f.0.0.1, 2130706433 or 127.1. tls.checkServerIdentity did not classify these hosts as IP...
CVE-2026-106073
A flaw in Node.js Permission Model filesystem enforcement leaves fs.realpathSync without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered fs.realpathSync.native. As a result, code running under --permission with restricted --allow-fs-read can...
CVE-2026-106074
A flaw in Node.js crypto causes the internal entropy caches used by crypto.randomUUID, crypto.randomUUIDv7, and crypto.randomInt to be saved into user-land startup snapshots --build-snapshot and single executable applications built with useSnapshot. If any of these functions, or an API that relie...
CVE-2026-49442
Cacti is an open source performance and fault management framework. Prior to version 1.2.31, a User Enumeration vulnerability allows an attacker to identify valid usernames on the Cacti service. When a user attempts to log in, the application returns slightly different error messages depending on...
CVE-2026-39902
Cacti is an open source performance and fault management framework. Prior to version 1.2.31, the prior blocklist ;&| $\n\r omitted single-quote, double-quote, redirect operators, subshell parens and braces. An authenticated admin could save an inputstring containing single-quote, redirect...
CVE-2026-46531
Cacti is an open source performance and fault management framework. From version 1.2.27 to before version 1.2.31, Cacti contains an authenticated stored second-order SQL injection in the automation tree rule item handler. A user holding the Automation realm default General Administration role can...
CVE-2026-115754
serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script elements by ending serialized function source text with an unescaped /script. Attackers controlling a function's source via a spoofed toString can combine...
CVE-2026-115730
i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl that allows attackers to redirect translation requests by supplying an ns value starting with a slash. Attackers controlling the namespace value can form a protocol-relative URL in loadPath or addPath templates to load...
CVE-2026-99087
In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix NULL pointer dereference when the 'R' flag is used If the dm-integrity device has the SBFLAGDIRTYBITMAP flag set and the user activates the device in the 'R' mode, a crash in dmintegrityresume happens because th...
CVE-2026-99086
In the Linux kernel, the following vulnerability has been resolved: dm-integrity: validate the superblock on resume dmintegrityresume re-reads the superblock from the device so that it picks up the flags and the recalculate position. It performs no validation on the result, while the constructor...
CVE-2026-99085
In the Linux kernel, the following vulnerability has been resolved: schedext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler A CPU going down has to empty its own rq. Its hotplug thread waits in schedcpuwaitempty until nothing else is left, and the only thing that wakes it...
CVE-2026-99084
In the Linux kernel, the following vulnerability has been resolved: readdir: take no inode lock on an immutable directory iteratedir takes the directory's irwsem shared and holds it across -iterateshared. For a directory that never has an entry and is never removed the lock keeps nothing still, i...
CVE-2026-99083
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix heap out-of-bounds write in krb5authenticate In krb5authenticate, outlen is calculated to determine available headroom in responsebuf for the incoming Kerberos AP-REP token. However, when SMB2SESSIONSETUP is processed ...
CVE-2026-99082
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Use active memslots for the per-vCPU MMIO cache KVM tags the per-vCPU MMIO cache with a memslot generation so that a memslot update invalidates cached MMIO information. Both the fill and validation paths use kvmmemslots...
CVE-2026-55888
XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileChooser.SaveFiles method to gain arbitrary file access to non-existing files on the host limited to files the user has access to. The FileChooser.SaveFiles method takes...
CVE-2026-55889
XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileTransfer.RetrieveFiles method to redirect drag-and-drop and copy-paste data targeted at other applications to itself. Some portals generate tokens which provide access to...
CVE-2026-99081
In the Linux kernel, the following vulnerability has been resolved: bnxten: fix DMA mapping length for padded small packets Stefan Fleischmann reported Intel IOMMU DMA Read faults on BCM57412 NetXtreme-E NICs when transmitting packets on VLAN/macvlan interfaces: DMAR: DMA Read NOPASID Request...
CVE-2026-99080
In the Linux kernel, the following vulnerability has been resolved: fs: Free any excess xarray nodes in clearinode For many years we've had a hard to hit leak of xarray nodes. Hugh documented it well in commit 786b31121a2c. Recently people and syzbot have found ways to force it to happen with...
CVE-2026-99079
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent stale XSK buffer release on refill retry When an XDP redirect to an AFXDP socket fails because its RX ring is full, the XSK core frees the buffer. During the subsequent batched refill of a legacy cyclic RQ, mlx...
CVE-2026-99078
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry With AFXDP on a striding RQ, mlx5e defers releasing XSK buffers until an MPWQE is refilled. If XSK allocation then returns -ENOMEM, actualwqhead is not advanced an...
CVE-2026-99077
In the Linux kernel, the following vulnerability has been resolved: ipv4: udp: Create exceptions before socket matching Currently, when ICMP Fragmentation Needed and Redirect Message packets are locally delivered and quote a UDP packet, a FIB nexthop exception FNHE is only created if the kernel c...
CVE-2026-99076
In the Linux kernel, the following vulnerability has been resolved: ipv6: udp: Create exceptions before socket matching Currently, when ICMPv6 Packet Too Big and Redirect Message packets are locally delivered and quote a UDP packet, an exception is only created in the IPv6 exception cache if the...
CVE-2026-99075
In the Linux kernel, the following vulnerability has been resolved: rustbinder: reschedule node refcount update on thread exit When a thread exits via BINDERTHREADEXIT, its pending work items are cancelled. If a thread exits while holding a pending node refcount increment e.g. pushed as deferred...
CVE-2026-99074
In the Linux kernel, the following vulnerability has been resolved: ipv4: stop PMTU walk when nexthop group shrinks Commit 7d3f3b4367f3 "net: ipv4: Cache pmtu for all packet paths if multipath enabled" made iprtupdatepmtu update every path. For nexthop objects, fibinfonumpath and fibinfonhc...
CVE-2026-99073
In the Linux kernel, the following vulnerability has been resolved: ipv4: stop exception dump when nexthop group shrinks Commit 4ce5dc9316de "inet: switch inetdumpfib to RCU protection" allowed IPv4 FIB dumps to run concurrently with nexthop replacement. fibdumpinfofnhe uses fibinfonumpath as the...
CVE-2026-99072
In the Linux kernel, the following vulnerability has been resolved: ipv4: stop route notification sizing when nexthop group shrinks Commit 680aea08e78c "net: ipv4: Emit notification when fib hardware flags are changed" added an RCU-only fibnlmsgsize call for asynchronous hardware flag...
CVE-2026-99071
In the Linux kernel, the following vulnerability has been resolved: ipv4: do not warn on route notification size race Commit 680aea08e78c "net: ipv4: Emit notification when fib hardware flags are changed" added asynchronous route notifications for hardware flag changes. fibaliashwflagsset sizes t...
CVE-2026-99070
In the Linux kernel, the following vulnerability has been resolved: ipv6: do not warn on route notification size race fib6infohwflagsset sizes the skb with rt6nlmsgsize and later fills it with rt6fillnode. With nexthop compatibility mode enabled, a concurrent replacement can grow the group betwee...