Lucene search
+L

2101742 matches found

OSV
OSV
added 2026/09/21 12:00 a.m.4 views

OPENSUSE-SU-2026:11827-1 MozillaThunderbird-140.16.0-1.1 on GA media

These are all security issues fixed in the MozillaThunderbird-140.16.0-1.1 package on the GA media of openSUSE Tumbleweed...

9.8CVSS5.9AI score0.0066EPSS
SaveExploits0References31
OSV
OSV
added 2026/09/21 12:00 a.m.5 views

UBUNTU-CVE-2026-93488

A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAXVALUE and the handler provides no API to change it. A remote peer can open a SPDY connection and send a large number of SYNSTREAM...

7.5CVSS5.8AI score0.00506EPSS
SaveExploits0References7
OSV
OSV
added 2026/09/21 12:00 a.m.4 views

UBUNTU-CVE-2026-63420

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, An indexed psd with transparency metadata creates fewer stored channelbuffers than the spec.nchannels value advertised ...

5.5CVSS5.9AI score0.0013EPSS
SaveExploits0References8
OSV
OSV
added 2026/09/21 12:00 a.m.5 views

UBUNTU-CVE-2026-93690

uri-js through 4.4.1 contains a denial of service vulnerability in the removeDotSegments function that loops infinitely when a path segment begins with Unicode line or paragraph separators. Attackers can trigger this by calling removeDotSegments directly or through normalize/resolve functions wit...

8.7CVSS5.9AI score0.00457EPSS
SaveExploits0References8
OSV
OSV
added 2026/09/21 12:00 a.m.4 views

UBUNTU-CVE-2026-81627

A flaw was found in QEMU. The VAPIC setup hypercall in hw/i386/vapic.c does not validate that the writable RAM alias remains within the option ROM window. A privileged guest user on a Q35/KVM machine can position this alias over locked SMRAM, bypassing chipset DLCK protection and injecting code...

8.2CVSS5.7AI score0.00198EPSS
SaveExploits0References5
OSV
OSV
added 2026/09/21 12:00 a.m.2 views

UBUNTU-CVE-2026-54634

Hamlib is a ham radio control library for radios, rotators, and amplifiers. Prior to 4.7.2, the unauthenticated rigctld sendraw command on TCP port 4532 reaches rigctlsendraw in tests/rigctlparse.c, which writes a NUL byte at bufbuflen + 1 outside its 200-byte stack buffer, and rigsendraw in...

7.3CVSS5.8AI score0.00251EPSS
SaveExploits0References12
OSV
OSV
added 2026/09/21 12:00 a.m.5 views

UBUNTU-CVE-2026-89059

A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very larg...

7.5CVSS5.7AI score0.00562EPSS
SaveExploits0References7
OSV
OSV
added 2026/09/21 12:00 a.m.5 views

UBUNTU-CVE-2026-63449

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the SIP parser in rust/src/sip/parser.rs stores request and response body lengths in 16-bit fields. A SIP body larger than 65,536 bytes can truncate the...

3.7CVSS5.8AI score0.00245EPSS
SaveExploits0References8
OSV
OSV
added 2026/09/21 12:00 a.m.3 views

UBUNTU-CVE-2026-50161

libre is a generic library for real-time communications with asynchron...

9.3CVSS5.7AI score0.00384EPSS
SaveExploits0References4
OSV
OSV
added 2026/09/21 12:00 a.m.3 views

ALSA-2026:69120 Moderate: unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fixes: unbound: Unbound: DNS cache poisoning via UDP source port predictability CVE-2026-50252 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and...

9.3CVSS5.9AI score0.00163EPSS
SaveExploits0References4
OSV
OSV
added 2026/09/21 12:00 a.m.4 views

UBUNTU-CVE-2026-93485

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Automattic WordPress core allows DOM-Based XSS. This issue affects WordPress versions 7.1 before 7.1.1; 7.0 through 7.0.4; 6.9 through 6.9.7; 6.8 through 6.8.8; 6.7 through 6.7.7; 6.6 through 6.6.7...

7.1CVSS6AI score0.00161EPSS
SaveExploits0References4
OSV
OSV
added 2026/09/21 12:00 a.m.5 views

UBUNTU-CVE-2026-93586

ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a use-after-free vulnerability in the ImagesToBlob method, caused by a pointer that is not updated correctly. Exploitation may result in a limited availability impact e.g., a crash of the affected process. The issue is fixed in versions...

2.9CVSS5.8AI score0.00114EPSS
SaveExploits0References4
OSV
OSV
added 2026/09/21 12:00 a.m.4 views

UBUNTU-CVE-2026-93331

A vulnerability was identified in GPAC 26.08-DEV. This vulnerability affects the function gfrtpparsettxt of the file src/ietf/rtpdepacketizer.c of the component RTP Depacketizer. Such manipulation of the argument size leads to out-of-bounds read. It is possible to launch the attack remotely...

7.3CVSS6.8AI score0.00314EPSS
SaveExploits0References10
OSV
OSV
added 2026/09/21 12:00 a.m.4 views

UBUNTU-CVE-2026-59156

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1, A crafted fits stream containing consecutive 2880-byte header blocks without the mandatory end keyword makes...

6.5CVSS5.7AI score0.00325EPSS
SaveExploits0References8
OSV
OSV
added 2026/09/21 12:00 a.m.3 views

UBUNTU-CVE-2026-62943

btrbk is a tool for creating snapshots and remote backups of Btrfs subvolumes. From 0.29.0 until 0.32.7, btrbk's sshfilterbtrbk.sh constructs allowstreammatch with a start anchor but without an end-of-string anchor for the complete command. A user restricted through an authorizedkeys forced comma...

8.7CVSS6AI score0.00286EPSS
SaveExploits0References6
OSV
OSV
added 2026/09/21 12:00 a.m.4 views

UBUNTU-CVE-2026-63638

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A crafted cineon image can declare unsupported component bit depth 26. cineoninput::open maps it to a 32-bit imagespec,...

8.3CVSS5.8AI score0.00238EPSS
SaveExploits0References8
OSV
OSV
added 2026/09/21 12:00 a.m.6 views

UBUNTU-CVE-2026-93311

A vulnerability was detected in Freedesktop Poppler 26.07.0. This issue affects the function SampledFunction::SampledFunction of the file poppler/Function.cc of the component SampledFunction. The manipulation of the argument BitsPerSample results in integer overflow. The attack may be performed...

5.3CVSS5.1AI score0.00319EPSS
SaveExploits0References8
OSV
OSV
added 2026/09/21 12:00 a.m.3 views

UBUNTU-CVE-2026-84446

libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, crafted HEIF sequence timing and edit-list data can make Track::initsampletimingtable compute a logical mnumoutputsamples value that exceeds the uint32t counters used by TrackVisual::decodenextimagesample and...

7.5CVSS5.9AI score0.00464EPSS
SaveExploits0References5
OSV
OSV
added 2026/09/21 12:00 a.m.3 views

UBUNTU-CVE-2026-75895

In libsmpp35 from 0.1.0 through 1.8.0 out of bound read issue was found in the at smpp34unpack function via attacker controlled SMPP PDUs, leading to memory corruption...

7.5CVSS5.7AI score0.00316EPSS
SaveExploits0References4
OSV
OSV
added 2026/09/21 12:00 a.m.4 views

UBUNTU-CVE-2026-65969

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A truncated tga can leave a pending gif frame that is processed during output close. gifsplitpalette computes numpixels...

5.5CVSS5.7AI score0.0013EPSS
SaveExploits0References8
OSV
OSV
added 2026/09/21 12:00 a.m.4 views

UBUNTU-CVE-2026-93601

rustls-webpki the Rust webpki fork used by rustls versions = 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name. For example, a name constraint of accept.example.com was treated as satisfied by a...

2.2CVSS5.7AI score0.00183EPSS
SaveExploits0References4
OSV
OSV
added 2026/09/21 12:00 a.m.4 views

UBUNTU-CVE-2026-91203

A flaw was found in cockpit-files. This vulnerability allows a local attacker to exploit a timing issue, known as a symlink race condition, during privileged file operations such as changing file ownership or permissions. By manipulating directory entries and winning this race, the attacker can...

6CVSS5.9AI score0.00075EPSS
SaveExploits0References4
OSV
OSV
added 2026/09/21 12:00 a.m.6 views

UBUNTU-CVE-2026-93579

A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross an HTTP/2 to HTTP/1.1 translation boundary,...

6.5CVSS5.6AI score0.00337EPSS
SaveExploits0References5
OSV
OSV
added 2026/09/21 12:00 a.m.6 views

UBUNTU-CVE-2026-92768

A flaw was found in cockpit-machines. This vulnerability allows a local attacker to expose sensitive Virtual Machine VM credentials, including plaintext passwords, by inspecting process command-line arguments during VM creation or installation. The cockpit-machines component passes password value...

5.5CVSS5.8AI score0.00104EPSS
SaveExploits0References4
OSV
OSV
added 2026/09/21 12:00 a.m.5 views

UBUNTU-CVE-2026-91149

A flaw was found in Cockpit. An unauthenticated remote attacker can exploit this vulnerability by initiating and sustaining numerous simultaneous connections to the cockpit-tls service. This forces the service to create an unbounded number of detached threads, consuming system resources such as...

7.5CVSS5.8AI score0.00347EPSS
SaveExploits0References4
OSV
OSV
added 2026/09/21 12:00 a.m.6 views

UBUNTU-CVE-2026-93588

ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a NULL pointer dereference in the PNM coder. When the coder reaches a memory resource limit at a specific point during processing, the failed allocation is not handled and a NULL pointer is dereferenced, which can lead to a denial of servi...

3.1CVSS5.5AI score0.00255EPSS
SaveExploits0References4
OSV
OSV
added 2026/09/21 12:00 a.m.2 views

ALSA-2026:69607 Important: postgresql security update

PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions CVE-2026-14662 postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in...

8.8CVSS8.2AI score0.00676EPSS
SaveExploits3References32
OSV
OSV
added 2026/09/21 12:00 a.m.5 views

UBUNTU-CVE-2026-67549

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.1.16.0, A crafted 1-bit contiguous cmyk tiff is exposed through a native uint1 imagespec, so callers allocate a bit-packed buffer...

7.6CVSS5.9AI score0.00262EPSS
SaveExploits0References6
OSV
OSV
added 2026/09/21 12:00 a.m.4 views

UBUNTU-CVE-2026-94055

Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after-free...

3.7CVSS5.7AI score0.00313EPSS
SaveExploits0References3
OSV
OSV
added 2026/09/21 12:00 a.m.5 views

ALSA-2026:69540 Important: rsyslog security update

The rsyslog packages provide an enhanced, multi-threaded syslog daemon. It supports MySQL, syslog/TCP, RFC 3195, permitted sender lists, filtering on any message part, and fine-grained control over output format. Security Fixes: rsyslog: rsyslog: Denial of service via heap buffer overflow in...

7.5CVSS6.2AI score0.00655EPSS
SaveExploits0References4
OSV
OSV
added 2026/09/21 12:00 a.m.3 views

UBUNTU-CVE-2026-93854

In OpenStack Blazar before 17.0.1, the V2 lease API does not enforce object-level authorization on its update and delete operations PUT /v2/leases/leaseid and DELETE /v2/leases/leaseid. The policy authorize wrapper attempts to load the target lease to build the authorization target from its owner...

7.2CVSS5.7AI score0.0024EPSS
SaveExploits0References3
OSV
OSV
added 2026/09/21 12:00 a.m.3 views

UBUNTU-CVE-2026-94084

Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.responseheader with and without a transform...

9.4CVSS6AI score0.00402EPSS
SaveExploits0References5
OSV
OSV
added 2026/09/21 12:00 a.m.5 views

UBUNTU-CVE-2026-93986

rclone before 1.75.1 fails to confine names from server and third-party listing responses to the listed directory, allowing path traversal sequences in object names. Attackers can craft special names containing forward slashes and parent directory references to potentially write outside the...

3.1CVSS5.9AI score0.002EPSS
SaveExploits0References4
OSV
OSV
added 2026/09/21 12:00 a.m.3 views

ALSA-2026:69259 Moderate: tomcat update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. Security Fixes: Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix CVE-2026-32990 tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication...

5.3CVSS6.8AI score0.0168EPSS
SaveExploits2References13
OSV
OSV
added 2026/09/21 12:00 a.m.2 views

ALSA-2026:69608 Important: openexr security update

OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR. Security Fixes:...

7.1CVSS6AI score0.00127EPSS
SaveExploits0References4
OSV
OSV
added 2026/09/21 12:00 a.m.5 views

UBUNTU-CVE-2026-93600

rustls-webpki rustls/webpki versions 0.101.0 through 0.103.11 and 0.104.0-alpha releases before 0.104.0-alpha.6 ignore X.509 name constraints that apply to URI names, causing such constraints to be accepted rather than enforced. Because name constraints are restrictions on otherwise properly issu...

2.2CVSS5.7AI score0.00183EPSS
SaveExploits0References4
OSV
OSV
added 2026/09/21 12:00 a.m.3 views

UBUNTU-CVE-2026-75894

In osmo-iuh from 0.1.0 through 1.8.0 a reachable assertion was found in the ranaphandlecodt function via a arbitrarily sized NAS-PDU that leads to process crash and remote denial of service...

7.5CVSS5.7AI score0.00313EPSS
SaveExploits0References4
OSV
OSV
added 2026/09/21 12:00 a.m.6 views

UBUNTU-CVE-2026-54627

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. In 0.9.10 and earlier, psdprivatesailpixelformat in src/sail-codecs/psd/helpers.c resolves a one-channel PSD in Bitmap color mode to SAILPIXELFORMATBPP1INDEXED without requiring...

9.8CVSS6.2AI score0.00444EPSS
SaveExploits0References6
OSV
OSV
added 2026/09/21 12:00 a.m.6 views

ALSA-2026:69266 Important: openssh security, bug fix, and enhancement update

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fixes: openssh: OpenSSH: sftp client allows attacker to control downloaded file location...

9.8CVSS7.6AI score0.797EPSS
SaveExploits10References8
OSV
OSV
added 2026/09/21 12:00 a.m.3 views

UBUNTU-CVE-2026-59949

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JN...

6.5CVSS5.8AI score0.00453EPSS
SaveExploits0References3
OSV
OSV
added 2026/09/21 12:00 a.m.5 views

UBUNTU-CVE-2026-93658

uutils coreutils versions before 0.10.0 apply setuid or setgid mode to install destinations before finalizing ownership changes, allowing privileged users to leave setuid executables owned by the privileged invoker when ownership changes fail. Attackers can execute leftover setuid files with...

7.3CVSS5.9AI score0.00152EPSS
SaveExploits0References8
OSV
OSV
added 2026/09/21 12:00 a.m.6 views

UBUNTU-CVE-2026-93676

xdg-dbus-proxy incorrectly filters D-Bus broadcast messages, bypassing configured path, interface, and member restrictions. This allows a sandboxed Flatpak application to intercept broadcast signals on the D-Bus session bus and AT-SPI bus that should be restricted, potentially exposing sensitive...

3.2CVSS5.8AI score0.00101EPSS
SaveExploits0References5
OSV
OSV
added 2026/09/21 12:00 a.m.5 views

UBUNTU-CVE-2026-61819

pgpartman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, when pgjobmon is installed and partconfig.jobmon is true, exception handlers in multiple pgpartman functions place pparenttable verbatim inside a SQL string literal used to call pgjobmon.addjob. A...

8.5CVSS5.9AI score0.00581EPSS
SaveExploits0References5
OSV
OSV
added 2026/09/21 12:00 a.m.6 views

UBUNTU-CVE-2026-59956

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1, An uncompressed 16-bit iff image with a z-buffer makes iffinput::readimg allocate a temporary scanline from...

6.1CVSS6AI score0.002EPSS
SaveExploits0References8
OSV
OSV
added 2026/09/21 12:00 a.m.4 views

ALSA-2026:69126 Important: curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: libcurl: Unauthorized connection reuse due to a logical error CVE-2026-8458 curl: Information disclosure due to...

5.9AI score0.005EPSS
SaveExploits2References6
OSV
OSV
added 2026/09/21 12:00 a.m.5 views

UBUNTU-CVE-2026-54692

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to 1.0.0, sailcodecloadframev8xbm in src/sail-codecs/xbm/xbm.c allocates the decoded pixel buffer using the X11 one-byte-per-literal layout, but an X10 static short file...

7.8CVSS6.3AI score0.00142EPSS
SaveExploits0References6
OSV
OSV
added 2026/09/21 12:00 a.m.4 views

UBUNTU-CVE-2026-61817

pgpartman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, runmaintenance, showpartitions, showpartitioninfo, undopartition, and partitiondatatime interpolate the writable partconfig.timedncoder text value without identifier quoting into dynamic SQL. A role...

8.5CVSS5.9AI score0.00581EPSS
SaveExploits0References5
OSV
OSV
added 2026/09/21 12:00 a.m.2 views

OPENSUSE-SU-2026:11836-1 libtpms-devel-0.10.2-2.1 on GA media

These are all security issues fixed in the libtpms-devel-0.10.2-2.1 package on the GA media of openSUSE Tumbleweed...

6.5CVSS5.8AI score0.00384EPSS
SaveExploits1References1
OSV
OSV
added 2026/09/21 12:00 a.m.3 views

UBUNTU-CVE-2026-75893

In osmo-bsc from 1.0.1 through 1.14.1 a heap based buffer overflow issue was found in the ipaccessproxyreadmsg function via IPA frame lengths...

7.5CVSS6AI score0.00267EPSS
SaveExploits0References3
OSV
OSV
added 2026/09/21 12:00 a.m.4 views

ALSA-2026:69113 Moderate: apr-util security update

The mission of the Apache Portable Runtime APR is to provide a free library of C data structures and routines. This library contains additional utility interfaces for APR; including support for XML, LDAP, database interfaces, URI parsing and more. Security Fixes: apr-util: Apache Portable Runtime...

6.2AI score0.00508EPSS
SaveExploits0References10
Total number of security vulnerabilities2101742