Lucene search
+L

2101896 matches found

OSV
OSV
added 2026/09/21 12:00 a.m.5 views

UBUNTU-CVE-2026-93589

ImageMagick before 7.1.2-31 and 6.9.13-56 contains a division-by-zero flaw in the FLIF encoder. An incorrect value for ticks per second in the image being encoded causes a divide-by-zero and crashes the encoder, resulting in a denial of service. The issue is fixed in 7.1.2-31 and 6.9.13-56...

6.3CVSS5.6AI score0.00285EPSS
SaveExploits0References4
OSV
OSV
added 2026/09/21 12:00 a.m.3 views

UBUNTU-CVE-2026-85721

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, automatic response decompression on the HTTP/1.1 path uses ChannelManager.newHttpContentDecompressor to install...

7.5CVSS6AI score0.0035EPSS
SaveExploits0References7
OSV
OSV
added 2026/09/21 12:00 a.m.6 views

UBUNTU-CVE-2026-77568

Mojolicious is a real-time web framework for Perl. Prior to 9.48, the Mojolicious CSRF helpers csrffield, csrftoken, and csrfprotect reuse an unchanged per-session token in rendered HTML. When response compression is enabled and attacker-influenced content is reflected in the same response, an...

4.2CVSS5.7AI score0.00098EPSS
SaveExploits0References4
OSV
OSV
added 2026/09/21 12:00 a.m.6 views

UBUNTU-CVE-2026-93491

A flaw was found in Netty's HttpServerCodec. A remote, unauthenticated attacker can exploit this vulnerability by pipelining HTTP/1.1 requests on a single connection and withholding reads. This action causes the methodOverflowQueue to grow without limit, leading to unbounded heap memory consumpti...

7.5CVSS5.8AI score0.00477EPSS
SaveExploits0References7
OSV
OSV
added 2026/09/21 12:00 a.m.3 views

ALSA-2026:69387 Important: freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fixes: FreeRDP: FreeRDP: Remote code execution or client crash via malicious TS...

8.7CVSS8AI score0.00489EPSS
SaveExploits0References4
OSV
OSV
added 2026/09/21 12:00 a.m.4 views

UBUNTU-CVE-2026-93852

In OpenStack Blazar before 17.0.1, the V2 lease listing operation GET /v2/leases returns leases for every project without enforcing project scoping or an administrator-only policy. Any authenticated user with access to the Blazar REST API can enumerate leases belonging to other tenants, exposing...

7.1CVSS5.8AI score0.0022EPSS
SaveExploits0References3
OSV
OSV
added 2026/09/21 12:00 a.m.4 views

UBUNTU-CVE-2026-93493

A flaw was found in Netty's netty-handler-ssl-ocsp component. A remote attacker can exploit this vulnerability by providing an Online Certificate Status Protocol OCSP response that omits the optional nextUpdate field. This omission causes the OCSP validation to be silently skipped, leading to...

5.9CVSS5.8AI score0.00218EPSS
SaveExploits0References5
OSV
OSV
added 2026/09/21 12:00 a.m.4 views

UBUNTU-CVE-2026-54354

MapServer is a system for developing web-based GIS applications. Prior to 8.6.4, MapServer's PostGIS runtime filter translation in src/mappostgis.cpp and msPostGISLayerTranslateFilter treats a filteritem as numeric when CONNECTIONTYPE POSTGIS and metadata such as gmltype=Integer are configured, b...

8.2CVSS5.9AI score0.00408EPSS
SaveExploits0References10
OSV
OSV
added 2026/09/21 12:00 a.m.7 views

UBUNTU-CVE-2026-11573

Uncontrolled recursion CWE-674 in the QDomDocument/QDomNode serializ...

7.1CVSS5.8AI score0.00387EPSS
SaveExploits0References5
OSV
OSV
added 2026/09/21 12:00 a.m.6 views

UBUNTU-CVE-2026-93451

snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed Snappy.uncompressArray methods that allocate output arrays by dividing uncompressed length by element size but pass the undivided length to native code. Attackers controlling compressed input can cause misaligned lengt...

6.9CVSS6.3AI score0.00296EPSS
SaveExploits0References6
OSV
OSV
added 2026/09/21 12:00 a.m.4 views

UBUNTU-CVE-2026-94056

Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack memory...

7.5CVSS5.8AI score0.00245EPSS
SaveExploits0References3
OSV
OSV
added 2026/09/21 12:00 a.m.3 views

UBUNTU-CVE-2026-85717

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and from 3.0.9 to 3.0.11, a client configured with a client-wide Realm and redirect following can disclose credentials after a cross-origin...

6.8CVSS6AI score0.00333EPSS
SaveExploits0References6
OSV
OSV
added 2026/09/21 12:00 a.m.2 views

UBUNTU-CVE-2026-54770

WebOb provides objects for HTTP requests and responses. Prior to 1.8.1...

6.1CVSS6.4AI score0.00339EPSS
SaveExploits0References3
OSV
OSV
added 2026/09/21 12:00 a.m.4 views

OPENSUSE-SU-2026:11838-1 pijul-1.0.0~beta.23-1.1 on GA media

These are all security issues fixed in the pijul-1.0.0beta.23-1.1 package on the GA media of openSUSE Tumbleweed...

7.5CVSS5.6AI score0.00571EPSS
SaveExploits1References3
OSV
OSV
added 2026/09/21 12:00 a.m.3 views

ALSA-2026:69308 Important: yggdrasil security update

yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker. Security Fixes: mime: golang: Golang MIME: Denial of Service via...

7.5CVSS5.8AI score0.00568EPSS
SaveExploits0References12
OSV
OSV
added 2026/09/21 12:00 a.m.3 views

UBUNTU-CVE-2026-84449

libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.19.6, OpRGB2432toYCbCr::convertcolorspace stores image-plane strides in an integer width that can overflow for extremely large RGB images created through heifimagecreate and heifimageaddplane. The resulting wrapped stride caus...

3.7CVSS5.8AI score0.00339EPSS
SaveExploits0References5
OSV
OSV
added 2026/09/21 12:00 a.m.4 views

UBUNTU-CVE-2026-50291

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to versions 3.0.16.0 and 3.1.11.0, processing a crafted BMP file through oiiotool or an application linked to OpenImageIO can reach BMP palette handling in...

5.5CVSS5.7AI score0.00135EPSS
SaveExploits0References9
OSV
OSV
added 2026/09/21 12:00 a.m.3 views

ALSA-2026:69095 Important: libtiff security update

The libtiff packages contain a library of functions for manipulating Tagged Image File Format TIFF files. Security Fixes: libtiff: libtiff: Arbitrary code execution via processcommandopts function CVE-2026-52490 For more details about the security issues, including the impact, a CVSS score,...

8.4AI score0.00403EPSS
SaveExploits0References4
OSV
OSV
added 2026/09/21 12:00 a.m.4 views

UBUNTU-CVE-2026-63447

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.5 until 8.0.6, the FTP parser in src/app-layer-ftp.c can continue allocating transactions after app-layer.protocols.ftp.max-tx is reached while processing one large chunk...

7.5CVSS5.8AI score0.00361EPSS
SaveExploits0References7
OSV
OSV
added 2026/09/21 12:00 a.m.5 views

UBUNTU-CVE-2026-91147

A flaw was found in cockpit-ws. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service DoS by sending a specially crafted request. When the WebService.UrlRoot is configured and a request is made to the exact URL-root prefix without a trailing slash, cockpit-ws c...

5.9CVSS5.8AI score0.00328EPSS
SaveExploits0References4
OSV
OSV
added 2026/09/21 12:00 a.m.4 views

UBUNTU-CVE-2026-77528

Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, WebSocket endpoints that accept permessage-deflate and rely on maxMessagePayloadSize enforce that limit against the compressed frame length before inflation but do not recheck the...

5.3CVSS5.8AI score0.00401EPSS
SaveExploits0References6
OSV
OSV
added 2026/09/21 12:00 a.m.4 views

UBUNTU-CVE-2026-61818

pgpartman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, undopartition reads partconfig.timeencoder as unrestricted text and interpolates it without identifier quoting into a dynamically executed SELECT statement. A role with partmanuser access can store...

8.5CVSS6AI score0.00409EPSS
SaveExploits0References5
OSV
OSV
added 2026/09/21 12:00 a.m.5 views

UBUNTU-CVE-2026-53534

JabRef is a desktop application for managing BibTeX and BibLaTeX libraries. Prior to 6.0-alpha.6, when jabsrv or JabRef's built-in HTTP server is enabled, the GET /better-bibtex/cayw endpoint accepts an external command query parameter and CAYWQueryParams.getCommand passes it through...

7.5CVSS5.9AI score0.00353EPSS
SaveExploits0References6
OSV
OSV
added 2026/09/21 12:00 a.m.6 views

UBUNTU-CVE-2026-65970

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.1.16.0, a crafted ZIP-compressed TIFF processed with TIFF multithreading enabled can make TIFFInput::readnativescanlines return through an error path while...

5.3CVSS5.9AI score0.00373EPSS
SaveExploits0References6
OSV
OSV
added 2026/09/21 12:00 a.m.4 views

ALSA-2026:69130 Important: openssh security update

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fixes: openssh: OpenSSH: sftp client allows attacker to control downloaded file location...

7.5CVSS6.7AI score0.0025EPSS
SaveExploits0References12
OSV
OSV
added 2026/09/21 12:00 a.m.4 views

UBUNTU-CVE-2026-86049

Jupyter Server is the backend for Jupyter web applications. Prior to version 2.21.0, the 5xx request logging path in jupyterserver/log.py copies the Referer header into a JSON header block without applying the token scrubbing used for the request URI. A request that returns HTTP 500 while the...

7.1CVSS5.8AI score0.00238EPSS
SaveExploits0References6
OSV
OSV
added 2026/09/21 12:00 a.m.4 views

UBUNTU-CVE-2026-63349

AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. In 4.14.0, AnyIO accepts the POSIX extragroups argument in anyio.runprocess and anyio.openprocess, but openprocess forwards the group argument to the backend instead of extragroups...

7CVSS5.8AI score0.00108EPSS
SaveExploits0References7
OSV
OSV
added 2026/09/21 12:00 a.m.4 views

OPENSUSE-SU-2026:11840-1 python3-pytest-ansible-26.8.0-1.1 on GA media

These are all security issues fixed in the python3-pytest-ansible-26.8.0-1.1 package on the GA media of openSUSE Tumbleweed...

7.8CVSS5.9AI score0.00222EPSS
SaveExploits0References1
OSV
OSV
added 2026/09/21 12:00 a.m.4 views

UBUNTU-CVE-2026-94106

getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject arbitrary commands executed with the privileges of the process embedding...

8.8CVSS6AI score0.01663EPSS
SaveExploits0References12
OSV
OSV
added 2026/09/21 12:00 a.m.5 views

UBUNTU-CVE-2026-86000

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9, the selector parser in src/soupsieve/cssparser.py defines IDENTIFIER with adjacent quantified groups over overlapping character classes, and VALUE embeds IDENTIFIER for attribute selectors. When an...

5.3CVSS6.4AI score0.00441EPSS
SaveExploits0References5
OSV
OSV
added 2026/09/21 12:00 a.m.4 views

UBUNTU-CVE-2026-63448

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the SMB parser can retain force-completed transactions on flows where Suricata sees payload in only one direction, including async-oneside flows, becaus...

5.9CVSS5.8AI score0.00439EPSS
SaveExploits0References12
OSV
OSV
added 2026/09/21 12:00 a.m.4 views

OPENSUSE-SU-2026:11842-1 rke2-1.36-1.36.4+rke2r1-1.1 on GA media

These are all security issues fixed in the rke2-1.36-1.36.4+rke2r1-1.1 package on the GA media of openSUSE Tumbleweed...

9.8CVSS8.1AI score0.99525EPSS
SaveExploits20References1
OSV
OSV
added 2026/09/21 12:00 a.m.4 views

UBUNTU-CVE-2026-93558

A flaw was found in Netty's WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnerability by using HTTP/1.1 pipelining to send requests faster than the application can respond. This leads to an unbounded growth of a per-connection queue, consuming excessive...

7.5CVSS5.7AI score0.00702EPSS
SaveExploits0References5
OSV
OSV
added 2026/09/21 12:00 a.m.4 views

UBUNTU-CVE-2026-93494

A flaw was found in Netty's StompSubframeDecoder component. A remote attacker can exploit this vulnerability by sending a specially crafted STOMP frame body without its terminating null byte. This causes the decoder to allocate a ByteBuf a buffer for bytes that is never released, leading to a...

7.5CVSS5.9AI score0.00409EPSS
SaveExploits0References5
OSV
OSV
added 2026/09/21 12:00 a.m.4 views

UBUNTU-CVE-2026-93568

A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty's HTTP-object conversion path incorrectly processes these requests as regular HTTP/1.1 CONNECT requests, leading to a loss of critical...

7.5CVSS5.8AI score0.00548EPSS
SaveExploits0References5
OSV
OSV
added 2026/09/21 12:00 a.m.3 views

ALSA-2026:69277 Important: corosync security update

The corosync packages provide the Corosync Cluster Engine and C APIs for AlmaLinux cluster software. Security Fixes: corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly CVE-2026-81665 For more details about the security issues, including...

7.5CVSS6.2AI score0.00379EPSS
SaveExploits0References4
OSV
OSV
added 2026/09/21 12:00 a.m.5 views

UBUNTU-CVE-2026-91205

A flaw was found in cockpit-files. A local unprivileged attacker can exploit a race condition during directory creation with owner assignment. By controlling a writable parent directory, the attacker can replace a newly created directory with a symbolic link symlink before the ownership change...

6CVSS5.8AI score0.00077EPSS
SaveExploits0References4
OSV
OSV
added 2026/09/21 12:00 a.m.5 views

UBUNTU-CVE-2026-91142

A flaw was found in Cockpit. An integer overflow vulnerability in the dolastlog function, specifically in the offset calculation for lastlog entries on ILP32 Integer, Long, Pointer 32-bit builds, can be exploited. A low-privileged authenticated user with a specially provisioned large User ID UID...

3.6CVSS5.8AI score0.00092EPSS
SaveExploits0References4
OSV
OSV
added 2026/09/21 12:00 a.m.5 views

UBUNTU-CVE-2026-54633

PoDoFo is a C++17 PDF manipulation library. From version 1.0.0 until 1.1.1, processing a crafted PDF with an Indexed color-space image can cause a heap out-of-bounds read in PdfColorSpaceFilterIndexed::FetchScanLine in src/podofo/main/PdfColorSpaceFilter.cpp. PODOFOINVARIANT does not perform a...

6.9CVSS5.8AI score0.00132EPSS
SaveExploits0References6
OSV
OSV
added 2026/09/21 12:00 a.m.4 views

UBUNTU-CVE-2026-63451

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, a locally supplied detection rule that combines frame inspection without content and a transformed match without content can make...

3.3CVSS6.2AI score0.00128EPSS
SaveExploits0References8
OSV
OSV
added 2026/09/21 12:00 a.m.4 views

UBUNTU-CVE-2026-92382

usbredir: usbredir: unbounded isopacketdesc index in usbredirhostisopacket leads to heap out-of-bounds write...

4.1CVSS5.8AI score0.00136EPSS
SaveExploits0References3
OSV
OSV
added 2026/09/21 12:00 a.m.4 views

UBUNTU-CVE-2026-94057

Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent after a rejection during DATA processing...

4CVSS5.8AI score0.00162EPSS
SaveExploits0References3
OSV
OSV
added 2026/09/21 12:00 a.m.6 views

UBUNTU-CVE-2026-75892

In osmo-ggsn 1.14.0 an out of bounds write issue was found in the gtpdecodepdpctx function through the PDP context GSN-Address sub-field, leading to memory corruption...

6.5CVSS5.8AI score0.00168EPSS
SaveExploits0References3
OSV
OSV
added 2026/09/21 12:00 a.m.7 views

UBUNTU-CVE-2026-68914

Mojolicious is a real-time web framework for Perl. Prior to 9.47, the pure-Perl implementation of Mojo::JSON does not limit nesting depth when Cpanel::JSON::XS is unavailable or MOJONOJSONXS is enabled. An attacker who can supply untrusted JSON to decodejson, fromjson, or j can submit deeply nest...

8.7CVSS5.8AI score0.00263EPSS
SaveExploits0References4
OSV
OSV
added 2026/09/21 12:00 a.m.3 views

UBUNTU-CVE-2026-94054

Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write...

7CVSS5.8AI score0.00273EPSS
SaveExploits0References3
OSV
OSV
added 2026/09/21 12:00 a.m.3 views

UBUNTU-CVE-2026-93019

Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tgapaletteread. The reader unpacks the two-byte colour map length into a signed short, so a length of 32768 or more becomes negative. tgapaletteread casts that value to sizet and asks...

9.1CVSS5.8AI score0.00606EPSS
SaveExploits0References7
OSV
OSV
added 2026/09/21 12:00 a.m.6 views

UBUNTU-CVE-2026-93588

ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a NULL pointer dereference in the PNM coder. When the coder reaches a memory resource limit at a specific point during processing, the failed allocation is not handled and a NULL pointer is dereferenced, which can lead to a denial of servi...

3.1CVSS5.5AI score0.00255EPSS
SaveExploits0References4
OSV
OSV
added 2026/09/21 12:00 a.m.6 views

UBUNTU-CVE-2026-92768

A flaw was found in cockpit-machines. This vulnerability allows a local attacker to expose sensitive Virtual Machine VM credentials, including plaintext passwords, by inspecting process command-line arguments during VM creation or installation. The cockpit-machines component passes password value...

5.5CVSS5.8AI score0.00104EPSS
SaveExploits0References4
OSV
OSV
added 2026/09/21 12:00 a.m.5 views

UBUNTU-CVE-2026-63449

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the SIP parser in rust/src/sip/parser.rs stores request and response body lengths in 16-bit fields. A SIP body larger than 65,536 bytes can truncate the...

3.7CVSS5.8AI score0.00245EPSS
SaveExploits0References8
OSV
OSV
added 2026/09/21 12:00 a.m.4 views

UBUNTU-CVE-2026-71855

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, src/flow-hash.c can treat an IPv4 and IPv6 flow as equal without comparing the IP family when their raw address words, ports, protocol, VLAN, recursion...

5.9CVSS5.7AI score0.00312EPSS
SaveExploits0References9
Total number of security vulnerabilities2101896