CVE-2026-104845

A flaw was found in seroval. A remote attacker can cause a Denial of Service DoS by providing crafted JSON input containing an excessively large array length during data deserialization. Due to missing bounds validation when reconstructing array structures, the application synchronously allocates...

CVE-2026-104843

A flaw was found in uv. An attacker could achieve arbitrary code execution on a Windows system by tricking a user into installing a specially crafted Python wheel package. During archive extraction, files can be written outside the intended target directory, allowing an attacker to place maliciou...

CVE-2026-103630

An use after free flaw was found in the FedCM component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/557323166...

CVE-2026-103624

An use after free flaw was found in the Contextual Tasks component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/561660166...

CVE-2026-30754

A flaw was found in FFmpeg. This memory corruption vulnerability occurs during the Real-time Transport Protocol RTP encoding of H.264/HEVC streams. A remote attacker could exploit this by providing a specially crafted input file, leading to a negative size parameter being passed to a memory copy...

CVE-2026-23933

A flaw was found in Zabbix. The cryptographic key used for signing Frontend sessions was erroneously written to the database seed. In deployments that utilize both SAML authentication and guest users, an attacker could use this key to forge valid session cookies. This could potentially lead to...

CVE-2026-23929

A flaw was found in Zabbix. This prototype pollution vulnerability, specifically within the searchParamsToObject function, allows an attacker to inject malicious data into web pages. By manipulating URL parameters that are not properly filtered, an attacker can achieve persistent Cross-Site...

CVE-2026-95284

A buffer overflow flaw was found in the ANGLE component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/556435507...

CVE-2026-104721

A flaw was found in logback-classic. This path traversal vulnerability allows a remote attacker to create and append log files outside the intended directory. The issue occurs when an unsanitized Mapped Diagnostic Context MDC discriminator value flows into a nested log file path, enabling an...

CVE-2026-18036

A flaw was found in Bouncy Castle. A timing side-channel vulnerability in the NTRU algorithm can lead to information disclosure. The implementation performs variable-time division operations on secret data instead of constant-time calculations, causing processing time to vary depending on the...

CVE-2026-66331

A flaw was found in Apache Thrift's Delphi bindings buffered transport. The component fails to properly restrict or throttle resource allocation when processing input. A remote, unauthenticated attacker could exploit this vulnerability to consume excessive system resources, resulting in a Denial ...

CVE-2026-17508

A flaw was found in Bouncy Castle. Several password-based key derivation functions KDF process cost parameters directly from untrusted input without enforcing upper bounds. An attacker can exploit this vulnerability by supplying crafted input containing excessively high cost parameters, forcing t...

CVE-2026-92955

A flaw was found in vm2. This vulnerability allows an attacker running untrusted code within the sandbox to achieve arbitrary code execution on the host system. By accessing internal host properties through standard output streams, the untrusted code can manipulate process event handlers and esca...

CVE-2026-102937

A flaw was found in virtualenv. An attacker can achieve arbitrary code execution by supplying specially crafted prompt values or environment configurations containing unescaped quote characters when generating Windows virtual environments. When a user executes the resulting activation script, the...

CVE-2026-90440

A flaw was found in Apache Thrift's D language implementation within the TNonblockingServer component. Due to improper handling of exceptional conditions and improper resource shutdown, an uncaught exception can occur during server operations. A remote, unauthenticated attacker could exploit this...

CVE-2026-86537

A flaw was found in Apache Thrift's D language bindings. A remote, unauthenticated attacker could cause a Denial of Service DoS by sending specially crafted input to an affected application. This input triggers an integer underflow or an unhandled exception, causing the process to enter an infini...

CVE-2026-86535

A flaw was found in Apache Thrift. A remote attacker can exploit this vulnerability by submitting specially crafted messages to applications using the Node.js bindings with TJSONProtocol. Successful exploitation can trigger an infinite loop or cause prototype pollution unintended modification of...

CVE-2026-85088

A flaw was found in Apache Thrift. During Transport Layer Security TLS certificate validation, the client libraries improperly evaluate the certificate's Common Name CN when subject alternative name SAN entries do not match the target host. A network-positioned attacker possessing a trusted...

CVE-2026-83745

A flaw was found in Apache Thrift. A remote attacker can cause a Denial of Service DoS against the Node.js and D WebSocket server transports by sending a frame specifying an excessively large payload length. Because the server immediately allocates the declared amount of memory without verifying...

CVE-2026-66858

A flaw was found in Apache Thrift. Multiple language bindings fail to enforce recursion limits when processing skipped fields in incoming messages. A remote, unauthenticated attacker can exploit this vulnerability by sending a message containing deeply nested unknown fields, leading to stack...

CVE-2026-66837

A flaw was found in Apache Thrift. An integer overflow within the PHP bindings leads to a stack-based buffer overflow when processing specially crafted data. A remote, unauthenticated attacker could exploit this flaw to crash the service, leading to a Denial of Service DoS. Mitigation Mitigation...

CVE-2026-66054

A flaw was found in the Apache Thrift C++ bindings. A remote, unauthenticated attacker could cause a Denial of Service DoS by sending specially crafted, highly compressed data payloads. Because the software does not properly restrict resource allocation during decompression, processing these...

CVE-2026-17507

A flaw was found in Bouncy Castle's Messaging Layer Security MLS implementation. Due to an improper signed integer comparison, an out-of-range leaf identifier incorrectly bypasses group membership checks. A group member can exploit this flaw by sending a specially crafted message, causing unbound...

CVE-2026-94084

An invalid memory reference vulnerability exists in Suricata's HTTP/2 application-layer engine during multi-buffer management Http2ThreadMultiBuf. When inspected HTTP/2 response traffic triggers signature rules that evaluate the http.responseheader keyword simultaneously with and without sticky...

CVE-2026-94638

A flaw was found in the Apache Thrift PHP bindings. Due to a lack of limits or throttling on resource allocation, a remote attacker can send crafted requests that consume excessive system resources. This issue can lead to a Denial of Service DoS for the affected service...

CVE-2026-96277

A flaw was found in the Apache Thrift Ruby bindings. This vulnerability allows a remote attacker to cause a Denial of Service DoS due to improper handling of exceptional conditions. By triggering an uncaught exception, an attacker can crash the service and disrupt availability...

CVE-2026-95281

A buffer overflow flaw was found in the ANGLE component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/551708184...

CVE-2026-94657

A flaw was found in Apache Thrift. A remote attacker could exploit improper resource allocation controls in the JavaME bindings to cause a Denial of Service DoS. By sending requests that trigger unbounded resource consumption, an attacker can exhaust system resources and make the service...

CVE-2026-94646

A flaw was found in Apache Thrift's Node.js bindings. Due to improper input validation and prototype pollution—a condition where base JavaScript object properties can be modified—the application fails to safely process incoming data. A remote attacker can exploit this vulnerability by sending...

CVE-2026-94083

A flaw was found in Suricata's DNS over HTTPS 2 DoH2 application-layer protocol parser. When processing a DoH2 request accompanied by an HTTP/1 to HTTP/2 upgrade, Suricata mistakenly executes HTTP/2 state cleanup logic while the protocol handler is in an HTTP/1 state. A remote, unauthenticated...

CVE-2026-93393

A flaw was found in mongo-c-driver. A heap-based buffer overflow exists in the Transport Layer Security TLS transport layer when compiled with the Windows platform TLS backend. A remote server can exploit this flaw by sending crafted encrypted traffic after the TLS handshake completes, causing th...

CVE-2026-85086

A flaw was found in Apache Thrift's Perl bindings. Due to insecure default settings and improper certificate validation, client connections fail to verify the authenticity of remote server certificates. An unauthenticated attacker positioned on the network could exploit this vulnerability to...

CVE-2026-82459

A flaw was found in Apache Thrift. A remote, unauthenticated attacker could cause a Denial of Service DoS by sending specially crafted network traffic to an affected application. Due to an integer underflow in the 32-bit C++ THeaderTransport component, processing this malformed data triggers an...

CVE-2026-82458

A flaw was found in Apache Thrift. Multiple language bindings fail to properly restrict memory allocation when processing input containing excessive size values. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted requests, consuming available memory and...

CVE-2026-97876

A flaw was found in GRUB2. The bootloader insufficiently validates memory addresses passed to the serial configuration command, allowing arbitrary system memory to be targeted instead of a legitimate serial communication device. A local attacker with control over GRUB's boot configuration can...

CVE-2026-85494

A flaw was found in Apache Thrift. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service DoS by sending specially crafted requests to applications utilizing affected language bindings. Flawed input parameter processing and resource allocation can trigger...

CVE-2026-94633

A flaw was found in Apache Thrift's Dart bindings. An unauthenticated remote attacker can exploit this vulnerability by sending input containing inconsistent length parameters, triggering excessive memory allocation. This can lead to system memory exhaustion, resulting in a Denial of Service DoS...

CVE-2026-103505

A flaw was found in the AWS Elastic File System EFS Container Storage Interface CSI Driver. A remote authenticated user with permissions to create persistent storage volumes can supply crafted comma-separated values within volume configuration attributes. This improper input handling allows the...

CVE-2026-93926

A flaw was found in Apache Thrift's THeaderTransport component. Due to a failure to release allocated memory and system resources after their operational lifetime, a remote attacker can exploit this vulnerability by sending network traffic that repeatedly consumes resources. This issue can cause...

CVE-2026-93925

A flaw was found in Apache Thrift. An incorrect bitwise integer shift in the C++ THeaderProtocol implementation can cause a stack-based buffer overflow. A remote, unauthenticated attacker could exploit this vulnerability by sending specially crafted input, resulting in a Denial of Service DoS...

CVE-2026-91777

A flaw was found in FasterXML jackson-databind. This vulnerability allows a remote attacker to cause a Denial of Service DoS by providing specially crafted JSON input to an application that deserializes it into an identity-enabled collection or map. The flaw occurs due to inefficient processing o...

CVE-2023-54404

A flaw was found in zod. A remote attacker can trigger a denial of service DoS by submitting an excessively large array of invalid items to an application that validates input schemas without length constraints. Because the validation process accumulates error records for each failing element...

CVE-2026-94635

A flaw was found in the Apache Thrift Lua bindings. A remote attacker could exploit this vulnerability by sending requests containing inconsistent length parameters, triggering excessive resource allocation without proper limits. This issue can exhaust available system memory or processing...

CVE-2026-95512

A flaw was found in FreeType, specifically within its CID font loader. A remote attacker could exploit this vulnerability by tricking a user into opening content that embeds or references a specially crafted CID-keyed font. This crafted font can cause repeated allocations and decryptions of...

CVE-2026-102514

A flaw was found in PeaZip. When decompressing PEA archives, the application fails to properly validate compressed block sizes, resulting in an out-of-bounds write vulnerability. By convincing a victim to open or extract a specially crafted archive file, an attacker could exploit this flaw to...

CVE-2026-47360

A flaw was found in Apache HTTP Server's modsessioncookie module. When internal redirects alter the SessionCookieRemove configuration, the server may fail to strip the session cookie as expected. This issue can lead to information disclosure by inadvertently forwarding sensitive user session toke...

CVE-2026-56449

A flaw was found in the modproxyhtml module of Apache HTTP Server. An attacker who controls or manipulates HTTP response bodies processed by the proxy can trigger an out-of-bounds memory write. This issue can cause the server process to crash, resulting in a Denial of Service DoS. Mitigation...

CVE-2026-48005

A flaw was found in the modauthdigest module of the Apache HTTP Server. When Digest authentication is configured with nonce-count checking enabled, missing authentication checks allow an unauthenticated remote attacker to submit forged HTTP Authorization headers. This flaw can lead to a Denial of...

CVE-2026-42356

A flaw was found in Apache HTTP Server. An attacker could achieve unintended code execution when an internal redirect generated by a Common Gateway Interface CGI program points to a non-executable file. If the target file resides in a directory configured for CGI execution and lacks a file...

CVE-2026-103923

A flaw was found in KaTeX. When JavaScript prototype pollution is present or an attacker can manipulate configuration prototypes, KaTeX improperly relies on inherited properties instead of strictly validated configuration options. A remote attacker submitting crafted mathematical expressions can...