2102537 matches found
UBUNTU-CVE-2026-87079
Net::IDN::Punycode versions before 2.590 for Perl allow CPU exhaustion via quadratic insertion cost when decoding a long label in decodepunycode. The XS backend inserts each decoded code point into a UTF-8 buffer and finds the insertion point by scanning that buffer from the start, one character ...
UBUNTU-CVE-2026-87080
Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decodepunycode. The pure-Perl decoder reads one digit at a time with four-argument substr and tests the result with defined to detect the end of the input. substr on...
UBUNTU-CVE-2026-87078
Net::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output buffer on every rejected label in decodepunycode. The XS backend allocates the scalar it returns before it validates the input, sizing the buffer at twice the input length. The scalar is released only on the success path...
UBUNTU-CVE-2016-15059
Net::IDN::Punycode versions before 2.301 for Perl allow a heap buffer overflow via unchecked writes past the output buffer in encodepunycode. The XS backend builds the encoded label in the string buffer of the scalar it returns, sized from the input length. The loop that emits the digits of each...
UBUNTU-CVE-2026-74766
Net::IDN::Punycode versions from 2.301 before 2.590 for Perl allow a heap use-after-free via a decoded code point that reallocates the output buffer in decodepunycode. The XS backend inserts each decoded code point into the string buffer of the scalar it returns. decodepunycode computes the...
UBUNTU-CVE-2026-87081
Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an overlong label before the length check in toascii. toascii punycode encodes each label and only then applies the 63-byte DNS limit. encodepunycode in both backends follows the sample...
CLSA-2026-1790064872 TuxCare security update for cryptography (1 CVE)
TuxCare rebuilt cryptography to address 1 CVE. Fixed in 3.4.8.post6+tuxcare...
ROOT-APP-MAVEN-CVE-2026-41731 CVE-2026-41731 in org.springframework.kafka:spring-kafka - Patched by Root
Root has patched CVE-2026-41731 in the org.springframework.kafka:spring-kafka package for Root:Maven. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2025-29927 CVE-2025-29927 in next - Patched by Root
Root has patched CVE-2025-29927 in the next package for Root:npm. Multiple fixed versions available...
CLSA-2026-1790063936 TuxCare security update for anyio (2 CVEs)
TuxCare rebuilt anyio to address 2 CVEs. Fixed in 3.7.1.post2+tuxcare...
ROOT-APP-MAVEN-CVE-2026-5795 CVE-2026-5795 in org.eclipse.jetty.ee10:jetty-ee10-jaspi - Patched by Root
Root has patched CVE-2026-5795 in the org.eclipse.jetty.ee10:jetty-ee10-jaspi package for Root:Maven. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2026-10050 CVE-2026-10050 in org.eclipse.jetty:jetty-security - Patched by Root
Root has patched CVE-2026-10050 in the org.eclipse.jetty:jetty-security package for Root:Maven. Multiple fixed versions available...
CLSA-2026-1790062887 TuxCare security update for aiohttp (1 CVE)
TuxCare rebuilt aiohttp to address 1 CVE. Fixed in 3.8.4.post11+tuxcare...
CLSA-2026-1790062789 TuxCare security update for org.springframework.data (1 CVE)
TuxCare rebuilt 3 org.springframework.data packages to address 1 CVE. Fixed in 4.2.12-tuxcare.4...
CLSA-2026-1790062770 TuxCare security update for org.springframework.data (3 CVEs)
TuxCare rebuilt 5 org.springframework.data packages to address 3 CVEs. Fixed in 4.2.12-tuxcare.4...
CLSA-2026-1790061998 TuxCare security update for django (2 CVEs)
TuxCare rebuilt django to address 2 CVEs. Fixed in 5.0.post14+tuxcare...
CVE-2026-87082 Net::IDN::Punycode versions before 2.590 for Perl hang, crash or return a wrong label via unvalidated malformed UTF-8 in encode_punycode
Net::IDN::Punycode versions before 2.590 for Perl hang, crash or return a wrong label via unvalidated malformed UTF-8 in encodepunycode. Neither backend checks that its input is well-formed UTF-8, so a string with the UTF-8 flag set over malformed bytes, as the :utf8 PerlIO layer produces from an...
CVE-2026-87081 Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an overlong label before the length check in to_ascii
Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an overlong label before the length check in toascii. toascii punycode encodes each label and only then applies the 63-byte DNS limit. encodepunycode in both backends follows the sample...
CVE-2026-87080 Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decode_punycode
Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decodepunycode. The pure-Perl decoder reads one digit at a time with four-argument substr and tests the result with defined to detect the end of the input. substr on...
CVE-2026-87079 Net::IDN::Punycode versions before 2.590 for Perl allow CPU exhaustion via quadratic insertion cost when decoding a long label in decode_punycode
Net::IDN::Punycode versions before 2.590 for Perl allow CPU exhaustion via quadratic insertion cost when decoding a long label in decodepunycode. The XS backend inserts each decoded code point into a UTF-8 buffer and finds the insertion point by scanning that buffer from the start, one character ...
CVE-2026-87078 Net::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output buffer on every rejected label in decode_punycode
Net::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output buffer on every rejected label in decodepunycode. The XS backend allocates the scalar it returns before it validates the input, sizing the buffer at twice the input length. The scalar is released only on the success path...
CVE-2026-74766 Net::IDN::Punycode versions from 2.301 before 2.590 for Perl allow a heap use-after-free via a decoded code point that reallocates the output buffer in decode_punycode
Net::IDN::Punycode versions from 2.301 before 2.590 for Perl allow a heap use-after-free via a decoded code point that reallocates the output buffer in decodepunycode. The XS backend inserts each decoded code point into the string buffer of the scalar it returns. decodepunycode computes the...
CVE-2026-74765 Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumulator in encode_punycode
Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumulator in encodepunycode. The XS backend keeps the punycode delta, and the digit index derived from it, in a signed int. The accumulation delta += m-n h+1 has no overflow check, so...
ROOT-APP-COMPOSER-AIKIDO-2026-387398 AIKIDO-2026-387398 in enshrined/svg-sanitize - Patched by Root
Root has patched AIKIDO-2026-387398 in the enshrined/svg-sanitize package for Root:Composer. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2015-9235 CVE-2015-9235 in jsonwebtoken - Patched by Root
Root has patched CVE-2015-9235 in the jsonwebtoken package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-NSWG-ECO-17 NSWG-ECO-17 in jsonwebtoken - Patched by Root
Root has patched NSWG-ECO-17 in the jsonwebtoken package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2022-23539 CVE-2022-23539 in jsonwebtoken - Patched by Root
Root has patched CVE-2022-23539 in the jsonwebtoken package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2022-23529 CVE-2022-23529 in jsonwebtoken - Patched by Root
Root has patched CVE-2022-23529 in the jsonwebtoken package for Root:npm. Multiple fixed versions available...
MAL-2026-16377 Malicious code in cloushaar-poc-exfil-91827 (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58b36f7c6e3e2e536f43b51acc410985240e6de6d7bb1e1d78126131e888806f The package's setup.py, executed automatically during pip install, iterates a hardcoded list of installer-side filesystem paths /flag, /flag.txt,...
CLSA-2026-1790060501 TuxCare security update for pip (3 CVEs)
TuxCare rebuilt pip to address 3 CVEs. Fixed in 9.0.0.post3+tuxcare...
ROOT-APP-COMPOSER-AIKIDO-2026-21741 AIKIDO-2026-21741 in robrichards/xmlseclibs - Patched by Root
Root has patched AIKIDO-2026-21741 in the robrichards/xmlseclibs package for Root:Composer. Multiple fixed versions available...
ROOT-APP-COMPOSER-AIKIDO-2026-134354 AIKIDO-2026-134354 in robrichards/xmlseclibs - Patched by Root
Root has patched AIKIDO-2026-134354 in the robrichards/xmlseclibs package for Root:Composer. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2025-64530 CVE-2025-64530 in @apollo/composition - Patched by Root
Root has patched CVE-2025-64530 in the @apollo/composition package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-GHSA-M8JR-FXQX-8XX6 GHSA-m8jr-fxqx-8xx6 in @apollo/composition - Patched by Root
Root has patched GHSA-m8jr-fxqx-8xx6 in the @apollo/composition package for Root:npm. Multiple fixed versions available...
ROOT-OS-DEBIAN-13-CVE-2026-84446 CVE-2026-84446 in libheif - Patched by Root
Root has patched CVE-2026-84446 in the libheif package for Root:Debian:13. Multiple fixed versions available...
RLSA-2026:69095 Important: libtiff security update
The libtiff packages contain a library of functions for manipulating Tagged Image File Format TIFF files. Security Fixes: libtiff: libtiff: Arbitrary code execution via processcommandopts function CVE-2026-52490 For more details about the security issues, including the impact, a CVSS score,...
RLSA-2026:69120 Moderate: unbound security update
The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fixes: unbound: Unbound: DNS cache poisoning via UDP source port predictability CVE-2026-50252 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and...
RLSA-2026:69113 Moderate: apr-util security update
The mission of the Apache Portable Runtime APR is to provide a free library of C data structures and routines. This library contains additional utility interfaces for APR; including support for XML, LDAP, database interfaces, URI parsing and more. Security Fixes: apr-util: Apache Portable Runtime...
RLSA-2026:69112 Important: perl-DBI:1.641 security update
The perl-DBI package provides the standard database interface module for the Perl programming language. It implements a database-independent interface, meaning it defines a consistent set of methods, variables, and conventions for database operations. Security Fixes: perl-DBI: DBI for Perl: Heap...
RLSA-2026:69266 Important: openssh security, bug fix, and enhancement update
OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fixes: openssh: OpenSSH: sftp client allows attacker to control downloaded file location...
ROOT-OS-DEBIAN-12-CVE-2026-78408 CVE-2026-78408 in util-linux - Patched by Root
Root has patched CVE-2026-78408 in the util-linux package for Root:Debian:12. Multiple fixed versions available...
ROOT-OS-DEBIAN-12-CVE-2026-78409 CVE-2026-78409 in util-linux - Patched by Root
Root has patched CVE-2026-78409 in the util-linux package for Root:Debian:12. Multiple fixed versions available...
ROOT-OS-DEBIAN-12-CVE-2026-76642 CVE-2026-76642 in util-linux - Patched by Root
Root has patched CVE-2026-76642 in the util-linux package for Root:Debian:12. Multiple fixed versions available...
ROOT-OS-DEBIAN-12-CVE-2026-53615 CVE-2026-53615 in util-linux - Patched by Root
Root has patched CVE-2026-53615 in the util-linux package for Root:Debian:12. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2026-54399 CVE-2026-54399 in org.apache.httpcomponents.core5:httpcore5 - Patched by Root
Root has patched CVE-2026-54399 in the org.apache.httpcomponents.core5:httpcore5 package for Root:Maven. Multiple fixed versions available...
CLSA-2026-1790050729 TuxCare security update for org.springframework.integration (5 CVEs)
TuxCare rebuilt 39 org.springframework.integration packages to address 5 CVEs. Fixed in 5.5.19-tuxcare.1...
USN-8799-1 libssh2 vulnerabilities
It was discovered that libssh2 incorrectly handled certain publickey subsystem attributes. A remote attacker controlling a malicious SSH server could use this issue to cause a denial of service or possibly execute arbitrary code. CVE-2026-58050 It was discovered that libssh2 did not properly...
MINI-WW7R-P9J8-4W38
Bulletin has no description...