2105043 matches found
CGA-55PV-QJ22-66JC
Bulletin has no description...
CGA-GQ6R-744J-X42F
Bulletin has no description...
ROOT-APP-PYPI-CVE-2026-84382 CVE-2026-84382 in httpx2 - Patched by Root
Root has patched CVE-2026-84382 in the httpx2 package for Root:PyPI. Multiple fixed versions available...
CVE-2026-89139 Temporal Server worker deployment compute provider executes a caller-supplied command on the Worker Service host
Temporal Server compiles a Worker Controller Instance module into its Worker Service, and that module registers a compute provider named subprocess whose function is to launch a worker by running a command on the machine hosting the Worker Service. The program name and the argument vector that...
CVE-2026-87858 Temporal Server completion callback source header can direct attacker-chosen requests to the internal frontend with administrator authorization
Temporal Server decided whether a Workflow completion callback was internal by reading a caller-supplied HTTP header. An authenticated caller holding only write permission in a single namespace could attach a completion callback whose URL host matched the configured callback address allowlist,...
CVE-2026-65654 temporalio/ringpop-go fails to enforce configured label limits on inbound membership gossip
github.com/temporalio/ringpop-go enforces configured LabelOptions limits when an application changes the local node's labels, but affected versions do not apply those limits to label maps received in SWIM membership changes. A network peer that can reach a live Ringpop TChannel listener can...
CVE-2026-65653 temporalio/tchannel-go zero-chunk call fragment causes process termination
github.com/temporalio/tchannel-go did not reject TChannel call fragments containing checksum metadata but no length-prefixed argument chunks. The fragment reader left its chunk slice empty and then unconditionally selected the first element. A network peer can supply such a malformed call fragmen...
CVE-2026-65652 temporalio/tchannel-go malformed checksum type causes process termination
github.com/temporalio/tchannel-go did not validate the one-byte checksum-type field in inbound TChannel call frames. A network peer that can reach a listener can complete the standard initialization handshake and send a call request with an unsupported checksum type. The parser uses that value as...
CVE-2026-65651 temporalio/sqlparser deeply nested unary expressions can cause a fatal stack overflow during AST traversal
temporalio/sqlparser accepts SQL containing deeply nested unary expressions and can return a correspondingly deep abstract syntax tree without enforcing an applicable nesting limit. The library's String and Walk operations recursively traverse that tree. An application that parses...
CVE-2026-16651 temporalio/sqlparser malformed MySQL version comments can cause a panic
temporalio/sqlparser can panic when Parse, ParseStrictDDL, or ParseNext processes a MySQL version comment whose contents are empty or consist only of one to five decimal digits. ExtractMysqlComment does not check the -1 result returned by strings.IndexFunc before using it as a slice boundary. The...
CVE-2026-94210 Hyve5 Leantime Kanban Board Tickets.php getAllGrouped cross site scripting
A flaw has been found in Hyve5 Leantime up to 3.9.8. Affected by this vulnerability is the function getAllGrouped of the file app/Domain/Tickets/Services/Tickets.php of the component Kanban Board. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. Th...
CGA-W6RH-Q533-6F9X
Bulletin has no description...
CGA-9R7F-Q342-G88R
Bulletin has no description...
CGA-HCFF-RQ73-9MWR
Bulletin has no description...
CGA-P3QQ-G66Q-VX55
Bulletin has no description...
CGA-FV2X-Q4V9-9HVJ
Bulletin has no description...
CGA-X728-W8PG-Q7VQ
Bulletin has no description...
CGA-C37V-27FJ-QWW4
Bulletin has no description...
CGA-F22C-F3WH-5H97
Bulletin has no description...
CGA-RPPX-HF22-7F2M
Bulletin has no description...
CGA-XFQ6-F28F-82W4
Bulletin has no description...
CGA-8G4J-CMGJ-9X8G
Bulletin has no description...
CGA-8338-GWXR-3H79
Bulletin has no description...
CGA-8C6V-QJR4-5V8W
Bulletin has no description...
CGA-7482-5FRP-5CQ7
Bulletin has no description...
CVE-2026-16652 Temporal Server Schedule exclusion search can cause excessive CPU consumption
Temporal Server did not bound the work performed while searching for a Schedule's next action time. An authenticated caller with namespace write permission could create or update a Schedule that combines a fine-grained cadence with an exclusion calendar that rejects every candidate time, causing...
USN-8785-1 openjdk-lts vulnerabilities
Kai Aizen discovered that the Networking component of OpenJDK 11 did not correctly handle user authentication. A remote attacker could possibly use this issue to leak sensitive information. CVE-2026-61308 It was discovered that the JSSE component of OpenJDK 11 did not correctly handle user...
CLSA-2026-1789989792 TuxCare security update for @babel (2 CVEs)
TuxCare rebuilt 35 @babel packages to address 2 CVEs. Fixed in 7.24.5-tuxcare.1...
ROOT-APP-NPM-GHSA-46J5-6FG5-4GV3 GHSA-46j5-6fg5-4gv3 in nodemailer - Patched by Root
Root has patched GHSA-46j5-6fg5-4gv3 in the nodemailer package for Root:npm. Multiple fixed versions available...
USN-8784-1 openjdk-8 vulnerabilities
Kai Aizen discovered that the Networking component of OpenJDK 8 did not correctly handle user authentication. A remote attacker could possibly use this issue to leak sensitive information. CVE-2026-61308 It was discovered that the JSSE component of OpenJDK 8 did not correctly handle user...
ROOT-OS-ALPINE-323-CVE-2026-85091 CVE-2026-85091 in zlib - Patched by Root
Root has patched CVE-2026-85091 in the zlib package for Root:Alpine:3.23. Multiple fixed versions available...
CGA-MFH5-H2VJ-2G94
Bulletin has no description...
CGA-4RRW-Q87Q-M4J3
Bulletin has no description...
CGA-4R85-5MJ2-CP99
Bulletin has no description...
CGA-H5QQ-9J66-XJ92
Bulletin has no description...
CGA-C7C4-PX73-8RHP
Bulletin has no description...
CGA-3G26-7W6C-HR96
Bulletin has no description...
CGA-JVPF-55GP-JJ7J
Bulletin has no description...
CGA-GX32-2XJW-RF56
Bulletin has no description...
CGA-9FGR-8PWJ-P392
Bulletin has no description...
CGA-P38P-Q72P-R43R
Bulletin has no description...
CGA-PHXF-RW22-G9VR
Bulletin has no description...
CVE-2026-92612
In Eclipse iceoryx2 versions greater than v0.8.0, the StaticString exposes its contents as mutable bytes through safe APIs, while String::asstr converts those bytes into a Rust string slice without validating UTF-8. An application can therefore create an invalid &str and trigger undefined behavio...
CGA-R565-WJFR-4FW6
Bulletin has no description...
CGA-6HMJ-CXJG-QPW4
Bulletin has no description...
CGA-GVWH-8XCV-45F6
Bulletin has no description...
CGA-QGPQ-G52P-F4XG
Bulletin has no description...
CGA-HCGR-2H93-3V6C
Bulletin has no description...