AZL-107916 CVE-2026-61801 affecting package telegraf 1.31.0-33

The github.com/moby/sys/user package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing /etc/passwd- or /etc/group-style files, allowing an attacker who can supply a specially...

AZL-107303 CVE-2026-61801 affecting package docker-buildx 0.14.0-17

The github.com/moby/sys/user package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing /etc/passwd- or /etc/group-style files, allowing an attacker who can supply a specially...

AZL-107243 CVE-2026-61801 affecting package containerd2 2.3.4-1

The github.com/moby/sys/user package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing /etc/passwd- or /etc/group-style files, allowing an attacker who can supply a specially...

AZL-107550 CVE-2026-61801 affecting package kata-containers 4.1.0.kata0-1

The github.com/moby/sys/user package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing /etc/passwd- or /etc/group-style files, allowing an attacker who can supply a specially...

AZL-107099 CVE-2026-61801 affecting package kata-containers-preview 3.27.0~preview2-2

The github.com/moby/sys/user package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing /etc/passwd- or /etc/group-style files, allowing an attacker who can supply a specially...

AZL-106857 CVE-2026-107301 affecting package msgpack 3.3.0-1

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, constructing msgpack5 with an empty or partial options object disables the default protoAction: 'error' protection. A decoded map containing a proto key can then replace the decoded object's prototype, potentiall...

AZL-106851 CVE-2026-107300 affecting package msgpack 3.3.0-1

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder recursively invokes itself for each complete MessagePack value remaining in a chunk. A remote peer can send one chunk containing many small valid values, causing recursion proportional to th...

AZL-106848 CVE-2026-107299 affecting package msgpack 3.3.0-1

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder treats the reserved MessagePack byte 0xc1 as incomplete input instead of invalid input. When 0xc1 begins a stream, subsequent data remains buffered while the decoder waits for bytes that...

AZL-106860 CVE-2026-107298 affecting package msgpack 3.3.0-1

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the array and map decoding paths have no nesting-depth limit, allowing an attacker who can provide MessagePack input to submit deeply nested containers that exhaust the JavaScript call stack and interrupt a...

AZL-106842 CVE-2026-107297 affecting package msgpack 3.3.0-1

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder reparses an incomplete array or map from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack container across many small chunks, causing completed...

AZL-106854 CVE-2026-107296 affecting package msgpack 3.3.0-1

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, decoding a negative signed 64-bit integer modifies the corresponding bytes in the caller-provided input buffer while computing the value. Applications that retain or reuse encoded input for integrity checks,...

AZL-106736 CVE-2026-107570 affecting package mutt 2.2.12-1

heap OOB write in convertfilefromto via a crafted Content-Type header allows attacker to OOB write when email is used as a template...

AZL-107078 CVE-2026-107353 affecting package js-jquery 3.5.0-4

traverse npm versions 0.3.6 through 0.3.9, 0.4.0 through 0.4.6, 0.5.0 through 0.5.2, and 0.6.0 through 0.6.11 allow prototype pollution through set. When the path passed to set crosses a primitive value, the next path segment is resolved on that primitive's built-in prototype, so an application...

AZL-107300 CVE-2026-107161 affecting package cyrus-sasl-bootstrap 2.1.28-8

A heap-based buffer overflow flaw was found in Cyrus SASL. The addtochallenge function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting escaping special characters mak...

AZL-107297 CVE-2026-107161 affecting package cyrus-sasl 2.1.28-8

A heap-based buffer overflow flaw was found in Cyrus SASL. The addtochallenge function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting escaping special characters mak...

AZL-107610 CVE-2026-56851 affecting package keda 2.14.1-19

The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer...

AZL-107739 CVE-2026-92542 affecting package moby-engine 25.0.3-20

The firewall rules which mark VXLAN datagrams for encryption indiscriminately match both authentic VXLAN datagrams sent from the kernel and forged datagrams sent by user processes. Any packet sent from the host network namespace of a Linux Swarm node is encrypted with the overlay-network IPsec...

AZL-107748 CVE-2026-92543 affecting package moby-engine 25.0.3-20

Docker Engine classifies a registry hostname as insecure using an any-match DNS check. loadInsecureRegistries injects 127.0.0.0/8 and ::1/128 as insecure CIDRs by default. isCIDRMatch resolves all of the hostname's addresses and returns true if a single address is in the insecure CIDR list. Becau...

AZL-107333 CVE-2026-92543 affecting package docker-cli 25.0.7-5

Docker Engine classifies a registry hostname as insecure using an any-match DNS check. loadInsecureRegistries injects 127.0.0.0/8 and ::1/128 as insecure CIDRs by default. isCIDRMatch resolves all of the hostname's addresses and returns true if a single address is in the insecure CIDR list. Becau...

AZL-107195 CVE-2026-92543 affecting package cert-manager 1.12.15-14

Docker Engine classifies a registry hostname as insecure using an any-match DNS check. loadInsecureRegistries injects 127.0.0.0/8 and ::1/128 as insecure CIDRs by default. isCIDRMatch resolves all of the hostname's addresses and returns true if a single address is in the insecure CIDR list. Becau...

AZL-107351 CVE-2026-92543 affecting package docker-compose 2.27.0-14

Docker Engine classifies a registry hostname as insecure using an any-match DNS check. loadInsecureRegistries injects 127.0.0.0/8 and ::1/128 as insecure CIDRs by default. isCIDRMatch resolves all of the hostname's addresses and returns true if a single address is in the insecure CIDR list. Becau...

AZL-107315 CVE-2026-92543 affecting package docker-buildx 0.14.0-17

Docker Engine classifies a registry hostname as insecure using an any-match DNS check. loadInsecureRegistries injects 127.0.0.0/8 and ::1/128 as insecure CIDRs by default. isCIDRMatch resolves all of the hostname's addresses and returns true if a single address is in the insecure CIDR list. Becau...

AZL-106728 CVE-2026-77214 affecting package expat 2.8.3-2

libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XMLParseBuffer advances the parse buffer end with parser-mbufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XMLParseBuffer calls move...

AZL-107228 CVE-2026-77214 affecting package cmake 3.30.3-15

libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XMLParseBuffer advances the parse buffer end with parser-mbufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XMLParseBuffer calls move...

AZL-106875 CVE-2026-46570 affecting package ntfs-3g for versions less than 2022.10.3-5

In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfsindexwalkdown in libntfs-3g/index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by reading the special crafted file metadata...

AZL-106872 CVE-2026-46569 affecting package ntfs-3g for versions less than 2022.10.3-5

In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfsibcopytail, in libntfs-3g/index.c, that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by extending a directory, e.g., by creating a file...

AZL-106878 CVE-2026-46571 affecting package ntfs-3g for versions less than 2022.10.3-5

In NTFS-3G before 2026.7.7, a out-of-bounds read exists in ntfsfixfilename in libntfs-3g/reparse.c that allows an attacker to read possibly confidential information in ntfs-3g process memory by crafting a malicious NTFS image. The out-of-bounds read is triggered by a readlink on a corrupted file...

AZL-106869 CVE-2026-42618 affecting package ntfs-3g for versions less than 2022.10.3-5

In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfsdecompress in compress.c that allows an attacker to corrupt one byte of heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by reading the special crafted file...

AZL-106863 CVE-2026-42616 affecting package ntfs-3g for versions less than 2022.10.3-5

In NTFS-3G before 2026.7.7, a heap buffer overflow exists in cat in ntfscat.c that allows an attacker to corrupt heap memory in the ntfscat binary by crafting a malicious NTFS image. The overflow is triggered by reading a file...

AZL-106866 CVE-2026-42617 affecting package ntfs-3g 2022.10.3-5

In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfsirtoib in index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by extending a directory, e.g., by creating a file...

AZL-106734 CVE-2026-98374 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free of retransmitskbhint in tcpsendsynack When tcpsendsynack replaces the cloned SYN skb at the head of the retransmit queue with a copy, it frees the original with tcprtxqueueunlinkandfree and only repairs...

AZL-106730 CVE-2026-98373 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: preserve mremap address delta when skipping page tables movehugetlbpagetables optimizes mremap by advancing to the last entry in the page table when the source page table does not exist, either initially or after...

AZL-106685 CVE-2026-106583 affecting package openssh 9.8p1-10

In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection...

AZL-106697 CVE-2026-106589 affecting package openssh 9.8p1-10

In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO OpenServer 5, sshd-session can unexpectedly have root privileges. This is related to the GatewayPorts and StreamLocalForwarding configuration options, and lack of support for file-descriptor passing and unprivileged...

AZL-106682 CVE-2026-106587 affecting package openssh 9.8p1-10

In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled...

AZL-106676 CVE-2026-19029 affecting package hdf5 1.14.6-4

A heap-based buffer over-read in H5Zfilterscaleoffset in src/H5Zscaleoffset.c in HDF5 through 2.2.0 lets an attacker cause a denial of service application crash with a crafted HDF5 file. When the stored minimum bits equal the full precision of the datatype, the decoder copies dnelmts size bytes...

AZL-106694 CVE-2026-106582 affecting package openssh 9.8p1-10

In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 "Crossing the Streams" findings...

AZL-106688 CVE-2026-106586 affecting package openssh 9.8p1-10

In sshd in OpenSSH before 10.6, the restrict keyword in authorizedkeys was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283...

AZL-106691 CVE-2026-106585 affecting package openssh 9.8p1-10

In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data...

AZL-106703 CVE-2026-106584 affecting package openssh 9.8p1-10

In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more severe effect on users in certain Antarctic locations...

AZL-106709 CVE-2026-106555 affecting package openssh 9.8p1-10

In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts...

AZL-106679 CVE-2026-106547 affecting package hdf5 1.14.6-4

A heap-based buffer overflow in H5VMarrayfill in src/H5VM.c in HDF5 before 2.2.0 lets a remote attacker cause an application crash and possibly execute arbitrary code with a crafted HDF5 file. When a dataset's unallocated chunks are read, H5Dfillinit fills the fill-value buffer from datatype and...

AZL-106700 CVE-2026-106552 affecting package openssh 9.8p1-10

In sftp in OpenSSH before 10.6, a server can trigger directory traversal causing files to be written to unintended locations during a recursive copy operation...

AZL-108017 CVE-2026-94114 affecting package bcel 5.2-37

Symbolic name not mapping to correct class. BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class. This issue affects Apache Commons BCEL: before...

AZL-106655 CVE-2026-76061 affecting package cri-o 1.30.1-1

A flaw was found in CRI-O's bindmountprefix handling. When configured with a non-empty bindmountprefix, a malicious container or local attacker could use a Container Runtime Interface CRI hostPath containing an intermediate absolute symlink. This could cause the bind mount source to resolve outsi...

AZL-106712 CVE-2026-106454 affecting package python-twisted 22.10.0-6

Twisted is an event-based framework for internet applications, supporting Python 3.6+. In 25.5.0 and earlier, wildcardToRegexp in twisted/mail/imap4.py translates the IMAP asterisk and percent wildcards but passes all other characters from an authenticated client's LIST or LSUB pattern directly t...

AZL-108014 CVE-2026-105111 affecting package bcel 5.2-37

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Commons BCEL. This only happens when you're using Class2HTML to generate webpages for possibly-attacker-controlled class files, where Class2HTML emitters write attacker class-file strings in...

AZL-106724 CVE-2026-103006 affecting package rubygem-elasticsearch 8.9.0-1

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the aggregation feature of the search API. Elasticsearch contains an uncontrolled recursion weakness in its search aggregation processing. An authenticated use...

AZL-106721 CVE-2026-102411 affecting package rubygem-elasticsearch 8.9.0-1

Allocation of Resources Without Limits or Throttling CWE-770 in Elasticsearch can lead to Denial of Service via Excessive Allocation CAPEC-130. Elasticsearch enforces a size limit on the user-supplied metadata field for each individual template resource, but does not limit the total memory used...

AZL-106715 CVE-2026-102407 affecting package rubygem-elasticsearch 8.9.0-1

Incorrect Authorization CWE-863 in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user with sufficient privileges over a single resource could use the Modify Data Streams API to modify a data...