60861 matches found
DEBIAN-CVE-2026-73491
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.alloweduri? does not reject javascript: URIs whose scheme is split or prefixed with the HTML5 named whitespace character...
DEBIAN-CVE-2026-73430
Russh is a Rust SSH client & server library. Prior to 0.62.4, an unauthenticated SSH client can cause a denial of service by sending SSHMSGKEXECDHINIT with a 32-byte all-zero QC value. Curve25519Kex::serverdh in russh/src/kex/curve25519.rs accepts the all-zero peer public value and computes an...
DEBIAN-CVE-2026-73429
Russh is a Rust SSH client & server library. Prior to 0.62.4, a malicious SSH server can crash a russh client session with a malformed KEXECDHREPLY containing a server ephemeral value that is not 32 bytes long. The client-side Curve25519Kex::computesharedsecret function in...
DEBIAN-CVE-2026-66898
A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during backup import and restore operations. When importing or restoring a backup archive, LXD fails to validate instance and storage volume names contained within the archive metadata. An attacker can exploi...
DEBIAN-CVE-2026-19654
A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during oversize-frame recovery can cause an invalid internal message length and terminate rsyslogd. No confidentiality or integrity impact, privilege escalation, or code...
DEBIAN-CVE-2026-16033
A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained file creation. When processing image metadata templates, LXD fails to properly sanitize or restrict template file paths from escaping the instance templates directory specifically affecti...
DEBIAN-CVE-2026-73433
A flaw was found in GStreamer gst-plugins-good avidemux. When parsing FUJIFILM metadata in an AVI strd chunk, gstavidemuxparsestrd decrements a remaining-length counter by fixed offsets 98 and 10 bytes without verifying sufficient data remains. For crafted strd payloads of exactly 106 or 107 byte...
DEBIAN-CVE-2026-73434
A flaw was found in GStreamer gst-plugins-good avidemux. In gstavidemuxriffparsevprp, the number of available gstriffvprpvideofielddesc entries is calculated by dividing the remaining buffer size by the attacker-controlled vprp-fields value, rather than by sizeofgstriffvprpvideofielddesc. This ca...
DEBIAN-CVE-2026-73415
jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.10 and 4.6.2, in packages/imageviewer/src/widget.ts, JupyterLab's ImageViewer uses URL.createObjectURL for a specially crafted SVG image and revokes the blo...
DEBIAN-CVE-2026-63299
An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code paths fail to verify resource limits during volume operations: the storagePoolVolumeTypePostMove function omits the limits.AllowVolumeCreation check before...
DEBIAN-CVE-2026-63295
An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass project-level container isolation restrictions. When a project is configured with restrictions on container privileges such as enforcing restricted.containers.privilege=isolated, LXD fails to enforce the...
DEBIAN-CVE-2026-63294
A link following vulnerability in LXD allows an attacker to achieve root command execution on the host system. During the import or unpacking of crafted image or backup archives, LXD fails to properly validate and confine the backup.yaml file when it exists as a symbolic link. An attacker can...
DEBIAN-CVE-2026-63296
An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project restrictions during instance migration. When migrating an instance to a target project, LXD accepts configuration overrides without validating the new configuration against the target project's...
DEBIAN-CVE-2026-63298
An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration handling allows an authenticated attacker to inject arbitrary configuration directives. By supplying newline characters within the 'nvidia.driver.capabilities' or 'nvidia.require.' configuration...
DEBIAN-CVE-2026-63300
An improper validation vulnerability in the instancePostMigration function in lxd/instancepost.go of LXD allows an authenticated attacker with cancreateinstances permissions on a restricted project to bypass project-level security restrictions. When migrating an instance between projects, LXD fai...
DEBIAN-CVE-2026-63293
A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system. When importing or unpacking an image archive, LXD fails to validate whether the metadata.yaml file is a symbolic link. An attacker can exploit this flaw by providing a...
DEBIAN-CVE-2026-63297
An authorization bypass vulnerability in LXD due to a timing flaw during configuration merging allows an authenticated attacker to bypass target project restrictions during cross-project instance copies. When copying an instance to a target project, LXD performs restriction checks before...
DEBIAN-CVE-2026-62420
An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project security restrictions during cross-project instance migrations. When moving an instance cross-project to a different cluster member via POST /1.0/instances/name with migration: true, project: ,...
DEBIAN-CVE-2026-73295
Material for MkDocs is a powerful documentation framework built on top of MkDocs. From 7.2.0 until 9.7.7, the mountSearchSuggest function in src/templates/assets/javascripts/components/search/suggest/index.ts contains a DOM-based cross-site scripting vulnerability in the optional search.suggest...
DEBIAN-CVE-2026-48554
Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to authenticated remote code execution via unfiltered NOTIFICATION-family macro substitution through the comdata parameter. When a notification command references $NOTIFICATIONCOMMENT$ or $NOTIFICATIONAUTHOR$ in a...
DEBIAN-CVE-2026-48553
Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 are vulnerable to authenticated remote code execution via custom-variable macro injection through the Nagios Remote Data Processor NRDP. When a custom variable defined on a host, service, or contact is referenced in a shell-executed command...
DEBIAN-CVE-2026-48550
Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to reflected cross-site scripting in cmd.cgi via the NagFormId parameter. An unauthenticated remote attacker can craft a malicious link that, when followed by an authenticated user, executes arbitrary JavaScript in the victim'...
DEBIAN-CVE-2026-48551
Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 contain a cross-site request forgery protection bypass via a self-supplied double-submit cookie. An attacker can supply matching cookie and request parameter values to bypass CSRF protection, enabling unauthenticated attackers to run command...
DEBIAN-CVE-2026-48552
Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to DOM-based cross-site scripting in jsonquery.js. Unencoded JSON string values reflected from stored fields are inserted into the DOM without sanitization, allowing attackers to run arbitrary JavaScript in the victim's browse...
DEBIAN-CVE-2026-12074
Bulletin has no description...
DEBIAN-CVE-2026-12061
Bulletin has no description...
DEBIAN-CVE-2026-12072
Bulletin has no description...
DEBIAN-CVE-2026-19548
Multiple Use-After-Free vulnerabilities were found in the addarchiveelement function in ld/ldmain.c of the GNU linker ld, a component of binutils. The root cause is that pluginmaybeclaim in ld/plugin.c frees the original BFD object via bfdclose/bfddeletebfd when entry-thebfd-myarchive == NULL, bu...
DEBIAN-CVE-2026-15803
In Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity XXE processing when parsing untrusted XML-based RDF data or query results, permitting DOCTYPE declarations, external entity references, and external DTD loading. This is due to an incomplete fix for...
DEBIAN-CVE-2026-52076
Bulletin has no description...
DEBIAN-CVE-2026-52064
Bulletin has no description...
DEBIAN-CVE-2026-52062
Bulletin has no description...
DEBIAN-CVE-2026-52060
Bulletin has no description...
DEBIAN-CVE-2026-52059
Bulletin has no description...
DEBIAN-CVE-2026-52067
Bulletin has no description...
DEBIAN-CVE-2026-52072
Bulletin has no description...
DEBIAN-CVE-2026-52069
Bulletin has no description...
DEBIAN-CVE-2026-52078
Bulletin has no description...
DEBIAN-CVE-2026-52048
Bulletin has no description...
DEBIAN-CVE-2026-52050
Bulletin has no description...
DEBIAN-CVE-2026-52071
Bulletin has no description...
DEBIAN-CVE-2026-52047
Bulletin has no description...
DEBIAN-CVE-2026-52061
Bulletin has no description...
DEBIAN-CVE-2026-52073
Bulletin has no description...
DEBIAN-CVE-2026-52068
Bulletin has no description...
DEBIAN-CVE-2026-52056
Bulletin has no description...
DEBIAN-CVE-2026-52053
Bulletin has no description...
DEBIAN-CVE-2026-52051
Bulletin has no description...