ALPINE-CVE-2026-62268

borgbackup is an opensource, deduplicating archiver with compression and authenticated encryption. Prior to 1.4.5 and 2.0.0b22, extracting a malicious archive can follow a symlinked parent path or resolve embedded dot-dot path components and delete or overwrite files outside the extraction...

ALPINE-CVE-2026-123158

sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass related to misinterpretation of whether a string is intended to be a password hash. For some configurations of accounts, any password between 256 and 1024 characters...

ALPINE-CVE-2026-107891

musl libc before 1.2.7, when an untrusted regular expression is used with regcomp, has multiple integer overflows, possibly leading to incorrect allocation sizes and out-of-bounds heap writes...

ALPINE-CVE-2026-109518

On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic including a malicious mirror or proxy between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified...

ALPINE-CVE-2026-121009

SQL::Abstract versions from 1.9001 before 2.00000104 for Perl skip the injectionguard check for function names given with -func. injectionguard is documented to apply to every function name, but only the -name = ... shorthand goes through it. The explicit -func = $name, ... form puts $name into t...

ALPINE-CVE-2026-121008

SQL::Abstract::Tree versions before 2.00000104 for Perl allow cross-site scripting via unescaped SQL text and bind values in the html profile. The html profile wraps keywords and placeholders in span elements and breaks lines with br elements, so its output is meant to go into a page as is. The...

ALPINE-CVE-2026-121007

SQL::Abstract versions from 1.9001 before 2.00000104 for Perl allow SQL injection via the where values of a nested statement in an identifier position. A nested statement such as -select = ... in a position where plain scalars are identifiers treats its own plain scalars as identifiers too. These...

ALPINE-CVE-2026-102703

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. A common access pattern is a batch of Grant Copy operations acting on adjacent address ranges in the same source or destination page. For performance reasons, Xen caches...

ALPINE-CVE-2026-102704

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. A common access pattern is a batch of Grant Copy operations acting on adjacent address ranges in the same source or destination page. For performance reasons, Xen caches...

ALPINE-CVE-2026-119741

rsync before 3.5.2 contains a denial of service vulnerability in the delta-transfer sender's hashsearch in match.c that allows malicious receivers to trigger unbounded strong-checksum work at consecutive offsets. Unauthenticated attackers pulling from a public daemon module can supply weak...

ALPINE-CVE-2026-114582

An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. django.contrib.gis.gdal.SpatialReference and related transform methods and srs/srid setters do not restrict GDAL’s file and network access when parsing string input, which allows attackers to trigger...

ALPINE-CVE-2026-113593

An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. The django.middleware.cache.UpdateCacheMiddleware and the django.views.decorators.cache.cachepage decorator generate identical cache keys for requests that omit a header listed in the response’s Vary...

ALPINE-CVE-2026-111211

An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. django.contrib.gis.forms.widgets.BaseGeometryWidget.deserialize, used by django.contrib.gis.forms.GeometryField, does not escape invalid submitted values before logging them, which allows remote attacker...

ALPINE-CVE-2026-108147

An issue was discovered in Django 6.1 before 6.1.3, 6.0.4 before 6.0.10, and 5.2.13 before 5.2.19. django.http.multipartparser.MultiPartParser is subject to excessive memory consumption when processing multipart file uploads with base64 Content-Transfer-Encoding, which could be buffered entirely ...

ALPINE-CVE-2026-111362

An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. django.contrib.gis.gdal.OGRGeometry does not restrict external coordinate reference system definitions in GeoJSON input, which allows remote attackers to cause server-side requests to attacker-selected...

ALPINE-CVE-2026-119364

ProFTPD through 1.3.9e and 1.3.10rc1 through 1.3.10rc4 contains a link-following vulnerability in modcopy that allows authenticated FTP users to bypass Limit WRITE restrictions via symlinks. Attackers can place a symlink in a writable directory and use SITE COPY or SITE CPTO to overwrite files in...

ALPINE-CVE-2026-119147

ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorization bypass in the modsftp copy-file extension handler that skips Limit WRITE checks for new destination files. Authenticated SFTP users can copy any readable file to a new path in write-denied directories, creating files where uploads are...

ALPINE-CVE-2026-119146

ProFTPD before 1.3.9e and 1.3.10rc5 contains a buffer overflow vulnerability in the modrewrite int:utf8trans RewriteMap that allows remote attackers to overwrite static buffers. Attackers can send FTP command arguments longer than 1024 bytes, without authentication if pre-login commands are...

ALPINE-CVE-2026-114148

Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally...

ALPINE-CVE-2026-79656

A user with read access to Grafana's server logs, or to a log store they are shipped to, can recover the OAuth and OIDC access, refresh and ID tokens of users who sign in through the Generic OAuth, Google or GitLab providers. Grafana writes these tokens to its logs unredacted when an access or ID...

ALPINE-CVE-2026-93524

A buffer overread in CheckKeySyms in X.Org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to leak small amounts of information from X server memory or potentially crash the X server...

ALPINE-CVE-2026-93523

A heap buffer overflow caused by a XIPassiveUngrabDevice request with an out-of-range modifier value in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context...

ALPINE-CVE-2026-93536

A use after free caused by missing lifecycle management of gesture sprites in GestureBuildSprite in X.Org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash the X server or potentially execute code...

ALPINE-CVE-2026-88967

A user with query access to an Azure Monitor data source in Grafana can cause server-side requests to an attacker-controlled endpoint that disclose the data source's Azure access token server-side request forgery...

ALPINE-CVE-2026-88858

A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expression uncontrolled recursion. A user with permission to provision alert rules can make the outage persist across restarts...

ALPINE-CVE-2026-100105

A user with permission to edit contact points but not their protected fields can change protected settings, such as a contact point's destination URL, by switching an integration to a legacy schema version, which can expose stored credentials and redirect alert notifications incorrect authorizati...

ALPINE-CVE-2026-93522

A heap buffer overflow caused by mismatched size usage in CopyArea CPU-to-FBO path in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in the X server context...

ALPINE-CVE-2026-93521

A buffer overflow in RandR ChangeProviderProperty requests in X.Org X Server before 2.1.25 and XWayland before 24.4.14 could be used by authenticated X clients to crash or execute code within the X server context...

ALPINE-CVE-2026-93518

An integer truncation issue in XkbResizeKeyType that could lead to a heap buffer overflow by authenticated X clients in X.org X server before 21.1.25 and XWayland before 24.1.14 could be exploited for crashes or potential code execution in the X server...

ALPINE-CVE-2026-93519

A buffer overflow when handling pointer barriers in the XFIXES extension in X.Org X server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context...

ALPINE-CVE-2026-93520

A heap buffer overflow caused by mismatching size calculations between XkbAllocNames and ChangeKeycodeRange in X.org X server before 2.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context...

ALPINE-CVE-2026-93517

A heap buffer overflow in handling GLX RenderLarge request where dataBytes exceeds cmdlen in X.org X server before 21.1.25 and XWayland before 24.1.14 that could be be triggered by an authenticated X client could cause crashes or code execution in X server context...

ALPINE-CVE-2026-93516

A use-after-free caused by lack of lifecycle management when adding / removing XInput master devices in X.org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X Clients to crash the X server or potentially execute code in X server context...

ALPINE-CVE-2026-93515

A use-after-free in presentclearwindownotifies in the X.org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by malicious X clients to crash or potentially execute code in the X server context...

ALPINE-CVE-2026-118370

libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow...

ALPINE-CVE-2026-117610

libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2 in lib/xmlparse.c that mishandles the XMLTOKNONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing...

ALPINE-CVE-2026-88812

A double free in XKB SetGeometryin X.Org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by attached clients to cause a crash or potentially code in the x server context...

ALPINE-CVE-2026-109088

A malicious X server could send malformed RECORD EnableContext reolies that can cause a X client using the parsereplycallcallback function in libXtst before 1.2.6 to enter a endless loop...

ALPINE-CVE-2026-109089

A buffer overflow when handling DEVICERESOLUTION in libXi before 1.8.4 could overflow a heap, triggered by a malicious X server...

ALPINE-CVE-2026-109090

A malicious X server could cause a heap overflow by injecting a large DEVICEENABLE reply when processed by libXi before 1.8.4...

ALPINE-CVE-2026-116591

compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable ...

ALPINE-CVE-2026-116587

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. Prior to 4.1.6, go-jose parses attacker-controlled RSA modulus and prime values from...

ALPINE-CVE-2026-116196

Rclone before v1.75.2 contains a credential exposure vulnerability in the b2 backend that leaks the live account Authorization token and SSE-C keys on HTTP redirects from --b2-download-url hosts. Attackers can observe a same-host HTTPS-to-HTTP downgrade redirect to capture the cleartext B2 token,...

ALPINE-CVE-2026-116192

rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http and netstorage backend requests by supplying a double-slash root on an existing named remote via --rc-serve. Attackers can make HEAD/GET requests to...

ALPINE-CVE-2026-116189

rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS block. Attackers controlling the release distribution path can prepend an unsigned checksum line matching a malicious...

ALPINE-CVE-2026-116195

Rclone before 1.75.2 contains a path traversal vulnerability in the local backend's translateLink function, which trims the .rclonelink suffix from a path after the containment check, so a name can resolve outside the destination root. Attackers can plant a directory named ...rclonelink in a sour...

ALPINE-CVE-2026-116194

Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in the pCloud backend's localhost OAuth callback, which disables the state check and trusts the hostname parameter. Malicious web pages can send a stateless request to port 53682 during authorization, planting...

ALPINE-CVE-2026-116193

Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip authentication by sending OPTIONS requests. Attackers can probe arbitrary paths and compare Allow header values to determine whether files or collections exist...

ALPINE-CVE-2026-116190

rclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend that forwards operator-configured custom credential headers to different hosts on HTTP 3xx redirects. Attackers who control or influence a cross-host redirect can capture headers such as...

ALPINE-CVE-2026-116191

Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..' path component. Attackers can send MKCOL /.. to plant a VFS node, then PUT, MOVE, COPY, or MKCOL to create, overwrite, o...