CVE-2026-57819

A flaw was found in Apache CXF. This vulnerability allows a remote attacker to initiate a Denial of Service DoS attack. The issue arises because the component does not enforce a default limit on the number of form parameters processed in a JAX-RS message, enabling an attacker to send requests wit...

CVE-2026-65432

A flaw was found in Apache CXF. The framework's initial processing of a Web Services Description Language WSDL document disables XML DTDs Document Type Definitions and external entities. However, any WSDL or XML Schema Definition XSD documents imported by the top-level WSDL are processed by a...

CVE-2026-63435

A flaw was found in Mail, an internet library for Ruby. The library's decoding of RFC 2047 encoded-words in email headers was vulnerable to an overly greedy charset capture. A remote attacker could exploit this by crafting a malformed encoded-word in an address display name or local part. This...

CVE-2026-88038

A flaw was found in the cookies Node.js library. This vulnerability allows a remote attacker to inject additional cookie attributes into the Set-Cookie header by providing untrusted data to the domain or path options. This occurs because the library's validation for these options is permissive,...

CVE-2026-80047

A flaw was found in the Hugging Face Transformers library. A remote attacker could exploit this vulnerability by enticing a user to load a model using the GenerativePreTrainedModel.loadcustomgenerate function. This function writes remote Python files to the local disk without requiring explicit...

CVE-2026-95307

An ui misrepresentation flaw was found in the ExtensionsMenu component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/423956129...

CVE-2026-95363

An ui misrepresentation flaw was found in the FileSystem component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/522344883...

CVE-2026-95328

A confused deputy flaw was found in the Mobile component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/553148673...

CVE-2026-95300

A missing authorization flaw was found in the DevTools component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/545449081...

CVE-2026-95323

An ui misrepresentation flaw was found in the Chromium component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/546438368...

CVE-2026-95314

An incorrect authorization flaw was found in the HID component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/517802696...

CVE-2026-95374

An incorrect authorization flaw was found in the Network component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/543464436...

CVE-2026-95385

An inappropriate implementation flaw was found in the PlatformIntegration component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/517192965...

CVE-2026-95289

An incorrect authorization flaw was found in the Scroll component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/549911100...

CVE-2026-95321

An ui misrepresentation flaw was found in the Payments component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/545879261...

CVE-2026-95295

An information leak flaw was found in the Mobile component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/517596255...

CVE-2026-103626

An incorrect authorization flaw was found in the FileSystem component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/553114097...

CVE-2026-103628

An out of bounds write flaw was found in the WebGL component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/549995090...

CVE-2026-95360

A race condition flaw was found in the Editing component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/517584808...

CVE-2026-95303

An incomplete cleanup flaw was found in the SmartCard component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/517442714...

CVE-2026-95330

An improper state validation flaw was found in the Downloads component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/517163294...

CVE-2026-95346

An ui misrepresentation flaw was found in the Chromoting component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/514059630...

CVE-2026-95337

An ui misrepresentation flaw was found in the Messages component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/514019137...

CVE-2026-105083

A flaw was found in ImageMagick. A local attacker with permission to modify the security policy configuration file can bypass defined security restrictions by supplying an alternate XML document type declaration DOCTYPE. Due to improper parsing of certain DOCTYPE declarations, the configuration...

CVE-2026-104477

A flaw was found in showdown. The link and image parsers fail to properly sanitize or escape double quotation marks in destination URLs when rendering HTML attributes. A remote attacker could exploit this flaw by supplying crafted Markdown input containing malicious event handlers, leading to...

CVE-2026-67408

A flaw was found in rabbitmq-server. An authenticated user with access to a virtual host can cause a Denial of Service DoS by sending a specially crafted HTTP request to the stream management application programming interface API. The server allocates substantial memory to process stream binding...

CVE-2026-66071

A flaw was found in rabbitmq-server where its OAuth2 authentication backend improperly converts token scope values into Erlang runtime atoms. In deployments where an Identity Provider IdP allows users to influence scope contents within their signed JSON Web Tokens JWTs, an authenticated attacker...

CVE-2026-95294

An ui misrepresentation flaw was found in the Browser component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/513992281...

CVE-2026-104874

A flaw was found in multidict. The multidict C extension fails to release object references during certain items-view union and subtraction operations. An attacker could exploit this vulnerability by supplying crafted input sequences to applications performing these operations, triggering...

CVE-2026-103877

A flaw was found in Apache Directory LDAP API. When a client calls loadSchema to search an LDAP server's subschema, a rogue or compromised server, or a network attacker able to intercept the connection before TLS is established, can return a crafted schema object containing a serialized Java clas...

CVE-2026-103885

A flaw was found in Apache Directory LDAP API. This vulnerability allows an attacker to cause a Denial of Service DoS by submitting specially crafted telephone numbers to an LDAP Lightweight Directory Access Protocol server using the library. Processing these malformed inputs causes indefinite CP...

CVE-2026-104873

A flaw was found in langgraph-sdk. This vulnerability allows an authenticated attacker to bypass authorization controls to access, modify, or delete resources belonging to other users. The issue occurs because resource-scoped authorization decorators fail to restrict handlers to specified actions...

CVE-2026-102731

A flaw was found in Apache Directory LDAP API. A malicious LDAP peer or a network attacker able to intercept the connection can send a small BER-encoded response with an excessive size value, causing the client to allocate a large amount of memory before receiving the data. This can trigger an...

CVE-2026-103552

A flaw was found in Apache Directory LDAP API's api-ldap-codec-core component. Before LDAP bind, an unauthenticated client can send a deeply nested search filter to an LDAP server using the affected decoder, causing recursive decoding to exhaust the server thread's stack and trigger a...

CVE-2026-61373

A flaw in Apache Thrift's Java TSaslNonblockingServer can allocate resources without limit while processing SASL frames. A remote, unauthenticated attacker could exploit this to exhaust server resources and cause a denial of service. Apache Thrift libthrift versions before 0.25.0 are affected;...

CVE-2026-96292

A flaw was found in Apache Thrift's Lua bindings. A remote attacker could exploit this vulnerability by sending specially crafted input that triggers inefficient regular expression processing. This can cause excessive resource consumption, resulting in a Denial of Service DoS on the affected...

CVE-2026-94650

A flaw was found in Apache Thrift. An uncontrolled recursion vulnerability in the C GLib library bindings allows a remote, unauthenticated attacker to send specially crafted input to an affected application. Processing this input triggers excessive nested function calls that exhaust stack memory,...

CVE-2026-66081

A flaw was found in Apache Thrift's C GLib bindings. A remote, unauthenticated attacker could exploit this vulnerability by sending specially crafted input that triggers the access of an uninitialized pointer. This access can cause the application to crash, resulting in a Denial of Service DoS...

CVE-2026-104988

A flaw was found in Dogtag PKI pki-core. The CMCAuthForEST authentication plugin fails open when an EST fullcmc enrollment request is submitted via BasicAuth without an end-user TLS client certificate. The SSLCLIENTCERT session attribute retains the EST subsystem's agent certificate, which causes...

CVE-2026-104855

A flaw was found in wasmtime. Execution preemption checks during bulk operations can expose an invalid intermediate state if an application mutates or continues using the execution store after a cancellation or trap. Under these conditions, an attacker executing WebAssembly code can cause memory...

CVE-2026-95369

An inappropriate implementation flaw was found in the XML component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/513049042...

CVE-2026-104861

A flaw was found in probe-image-size. An unauthenticated remote attacker can exploit this vulnerability to cause a Denial of Service DoS by supplying specially crafted Scalable Vector Graphics SVG input. Due to inefficient pattern matching and input handling during SVG parsing, processing unclose...

CVE-2026-103623

An use after free flaw was found in the MediaStream component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/565742180...

CVE-2026-94637

A flaw was found in the Apache Thrift Go library. A remote attacker could exploit this vulnerability by submitting specially crafted, highly compressed data to an affected service. Due to improper handling during decompression, the resulting data amplification can exhaust system resources, leadin...

CVE-2026-83663

A flaw was found in Apache Thrift. A remote attacker can cause a Denial of Service DoS by sending specially crafted network frames with zero payload bytes to an affected Go service. When processing these empty frames, the transport recursively calls its read function rather than iterating in a...

CVE-2026-94544

A flaw was found in Next.js. Pending cache operations do not properly separate Draft Mode requests from standard requests when fulfilling matching cache keys. Under concurrent request conditions, an unauthenticated user can receive unpublished draft content generated during an editor's session. I...

CVE-2026-94483

A flaw was found in Next.js Image Optimization, which can lead to information disclosure via Server-Side Request Forgery SSRF. In configurations where remote image optimization is enabled with host allowlists, the application can follow attacker-controlled Domain Name System DNS resolution after...

CVE-2026-95381

An improper input validation flaw was found in the Printing component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/497603247...

CVE-2026-104844

A flaw was found in postcss-selector-parser. A remote attacker could exploit this vulnerability by submitting a specially crafted CSS selector containing numerous class or ID identifiers to an application that parses untrusted input. Due to inefficient processing and repeated scanning during...

CVE-2026-23930

A flaw was found in Zabbix. An unauthenticated user can exploit this vulnerability by sending specially crafted requests to the Frontend's popup.testtriggerexpr action. This can lead to a denial of service DoS by causing a disproportionate load on the Frontend webserver, making the service...