AZL-89136 CVE-2026-42497 affecting package perl for versions less than 5.38.2-510

Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory. makespecialfile passes the tar header's linkname to link without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode...

AZL-87357 CVE-2026-8376 affecting package perl for versions less than 5.38.2-512

Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perlstudychunk in regcompstudy.c checked the size of the joined substring buffer in characters...

AZL-88278 CVE-2026-5223 affecting package rust for versions less than 1.90.0-9

Cargo incorrectly handled symlinks inside of crate tarballs downloaded from third-party registries, allowing a malicious crate to override the source code of another crate from the same registry. The severity of the vulnerability is medium for users of third-party registries. Users of crates.io a...

AZL-88275 CVE-2026-5222 affecting package rust for versions less than 1.75.0-30

Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol. If a hosting provider allowed multiple registries to be hosted with arbitrary names within the same domain, an attacker able to publish crates in a registry could obtain the...

AZL-88281 CVE-2026-5222 affecting package rust for versions less than 1.90.0-9

Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol. If a hosting provider allowed multiple registries to be hosted with arbitrary names within the same domain, an attacker able to publish crates in a registry could obtain the...

AZL-88272 CVE-2026-5223 affecting package rust for versions less than 1.75.0-30

Cargo incorrectly handled symlinks inside of crate tarballs downloaded from third-party registries, allowing a malicious crate to override the source code of another crate from the same registry. The severity of the vulnerability is medium for users of third-party registries. Users of crates.io a...

AZL-87351 CVE-2026-46300 affecting package kernel for versions less than 6.6.141.1-1

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skbtrycoalesce can attach paged frags from @from to @to. If @from has SKBFLSHAREDFRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backe...

AZL-87348 CVE-2026-43503 affecting package kernel for versions less than 6.6.141.1-1

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: propagate shared-frag marker through frag-transfer helpers Two frag-transfer helpers pskbcopyfclone and skbshift fail to propagate the SKBFLSHAREDFRAG bit in skbshinfo-flags when moving frags from source to...

AZL-98697 CVE-2026-39824 affecting package golang 1.27.1-1

NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString a 16-bit number of bytes, it returns a truncated string rather than an error...

AZL-87164 CVE-2026-39824 affecting package buildah 1.43.1-3

NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString a 16-bit number of bytes, it returns a truncated string rather than an error...

AZL-87215 CVE-2026-39824 affecting package cri-o 1.30.1-1

NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString a 16-bit number of bytes, it returns a truncated string rather than an error...

AZL-87269 CVE-2026-39824 affecting package kata-containers-preview 3.27.0~preview2-2

NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString a 16-bit number of bytes, it returns a truncated string rather than an error...

AZL-87161 CVE-2026-39824 affecting package azl-otel-collector 0.127.0-1

NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString a 16-bit number of bytes, it returns a truncated string rather than an error...

AZL-87299 CVE-2026-39824 affecting package podman 5.6.1-10

NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString a 16-bit number of bytes, it returns a truncated string rather than an error...

AZL-87885 CVE-2026-42502 affecting package kube-vip-cloud-provider for versions less than 0.0.10-6

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-87960 CVE-2026-42506 affecting package kubevirt for versions less than 1.7.1-7

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-87876 CVE-2026-42506 affecting package kube-vip-cloud-provider for versions less than 0.0.10-6

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-87594 CVE-2026-42506 affecting package dasel for versions less than 2.8.1-4

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-88341 CVE-2026-42502 affecting package telegraf for versions less than 1.31.0-23

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-88308 CVE-2026-27136 affecting package sriov-network-device-plugin for versions less than 3.7.0-6

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-87597 CVE-2026-42502 affecting package dasel for versions less than 2.8.1-4

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-87375 CVE-2026-27136 affecting package application-gateway-kubernetes-ingress for versions less than 1.7.7-5

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-87531 CVE-2026-42502 affecting package containerd2 for versions less than 2.2.4-4

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-87681 CVE-2026-27136 affecting package docker-compose for versions less than 2.27.0-11

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-87209 CVE-2026-42506 affecting package cri-o 1.30.1-1

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-87152 CVE-2026-42506 affecting package azl-otel-collector 0.127.0-1

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-87149 CVE-2026-42502 affecting package azl-otel-collector 0.127.0-1

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-87549 CVE-2026-42502 affecting package containerized-data-importer for versions less than 1.62.0-6

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-87323 CVE-2026-42506 affecting package podman 5.6.1-10

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-87639 CVE-2026-42502 affecting package docker-buildx for versions less than 0.14.0-15

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-87372 CVE-2026-42502 affecting package application-gateway-kubernetes-ingress for versions less than 1.7.7-5

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-87363 CVE-2026-42506 affecting package application-gateway-kubernetes-ingress for versions less than 1.7.7-5

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-87317 CVE-2026-42502 affecting package podman 5.6.1-10

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-87335 CVE-2026-27136 affecting package yq 4.45.1-1

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-87579 CVE-2026-42506 affecting package cri-tools for versions less than 1.32.0-6

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-87477 CVE-2026-42506 affecting package cf-cli for versions less than 8.7.11-6

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-88365 CVE-2026-42506 affecting package telegraf for versions less than 1.31.0-22

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-87780 CVE-2026-42506 affecting package gh for versions less than 2.62.0-16

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-87504 CVE-2026-42506 affecting package cni-plugins for versions less than 1.4.0-6

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-87534 CVE-2026-27136 affecting package containerd2 for versions less than 2.2.4-2

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-87864 CVE-2026-42502 affecting package keda for versions less than 2.14.1-14

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-87495 CVE-2026-27136 affecting package cloud-provider-kubevirt for versions less than 0.5.1-4

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-87822 CVE-2026-42506 affecting package influxdb for versions less than 2.7.5-17

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-87588 CVE-2026-42502 affecting package cri-tools for versions less than 1.32.0-6

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-87744 CVE-2026-42502 affecting package gh for versions less than 2.62.0-17

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-88170 CVE-2026-27136 affecting package packer for versions less than 1.9.5-15

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-87456 CVE-2026-42502 affecting package cf-cli for versions less than 8.7.11-7

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-87471 CVE-2026-27136 affecting package cf-cli for versions less than 8.7.11-6

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-88302 CVE-2026-42506 affecting package sriov-network-device-plugin for versions less than 3.7.0-6

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-87155 CVE-2026-27136 affecting package azl-otel-collector 0.127.0-1

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...