CVE-2026-119135

A flaw was found in Wasmtime. This vulnerability allows a guest WebAssembly module to cause a Denial of Service DoS by crashing the host application. When the host reads a component model stream that uses a mismatched internal data type, an assertion failure triggers an unhandled panic instead of...

CVE-2026-119132

A flaw was found in wasmtime. This vulnerability allows an untrusted WebAssembly Wasm guest program to cause a Denial of Service DoS by triggering an unhandled host process crash. When converting text between components using overlapping memory buffers, the runtime panics and terminates the host...

CVE-2026-118593

A flaw was found in Red Hat Enterprise Linux 9 kernel builds. An incomplete backport of the CVE-2026-46099 fix in RHEL 9.6 through 9.10 left a localbh imbalance in seg6inputcore, where the drop path returns with bottom halves still disabled. This can lead to softirq starvation and denial of servi...

CVE-2026-116272

A flaw was found in perl-mime-tools. A remote attacker can bypass email security filters by sending a specially crafted message containing duplicate Multipurpose Internet Mail Extensions MIME boundary parameters with nested comments. Because the parser fails to properly normalize parameter names...

CVE-2026-116271

A flaw was found in perl-mime-tools. This vulnerability allows a local attacker to overwrite arbitrary files with the permissions of the application process. When the parser writes message attachments into a shared or world-writable directory, an attacker can pre-create the expected output...

CVE-2026-116269

A flaw was found in MIME-tools. When parsing email attachment filenames that contain hyphenated language tags, the decoder fails to properly process the character set and incorrectly returns an empty filename. A remote attacker can exploit this flaw by sending a specially crafted email message to...

CVE-2026-116268

A flaw was found in perl-MIME-tools. A remote attacker can cause a Denial of Service DoS by supplying specially crafted Multipurpose Internet Mail Extensions MIME headers containing unclosed comments. Due to inefficient parsing of parameters lacking closing parentheses, the parser repeatedly scan...

CVE-2026-116266

A flaw was found in perl-mime-tools. When parsing email headers, the library decodes partially encoded boundary values in multipart messages without flagging the content as ambiguous. A remote attacker can exploit this flaw by sending a specially crafted email message to bypass email security...

CVE-2026-116265

A flaw was found in perl-MIME-tools. A remote attacker can exploit this vulnerability to bypass email security filters by sending an email with specially crafted multipart boundary parameters. Because the parser does not properly validate boundary parameters split across continuations, it process...

CVE-2026-116264

A flaw was found in perl-MIME-tools. This vulnerability allows a remote attacker to bypass email security filters by sending an email with a malformed Content-Type parameter. Because the parser halts processing upon encountering an invalid parameter name, it discards subsequent parameters,...

CVE-2026-118661

A flaw was found in happy-dom. The cookie management component fails to properly validate and match domain attributes, allowing it to accept cookies for unrelated domains and match hostnames without enforcing domain boundaries. In server-side rendering environments, a remote attacker controlling ...

CVE-2026-118256

A flaw was found in vue-i18n. When parameter escaping is enabled, the library fails to properly sanitize named interpolation values if a translation call contains both list and named parameters. A remote attacker could exploit this vulnerability by supplying untrusted input to an application that...

CVE-2026-119188

A flaw was found in node-forge. A remote attacker can trigger a Denial of Service DoS by sending an unexpected Transport Layer Security TLS record during a fragmented handshake sequence. Because the library fails to cleanly halt processing after closing the invalid connection, it throws an uncaug...

CVE-2026-119187

A flaw was found in node-forge. The Transport Layer Security TLS implementation processes incoming records through recursive function calls instead of an iterative loop. An unauthenticated remote attacker can exploit this flaw by sending a network payload containing a large number of small TLS...

CVE-2026-118952

A flaw was found in the Kroxylicious ACL authorizer. Its prefix-matching logic may apply a rule to a principal of a different type, or fail to check a broader matching rule when prefixes overlap. Depending on the ACL configuration, this may allow an authenticated Kafka client to access a resource...

CVE-2026-118764

A flaw was found in minimatch. A remote attacker could exploit this vulnerability to cause a Denial of Service DoS through excessive CPU and memory consumption. By supplying a specially crafted glob expression, an attacker can trigger repetitive pattern segment expansion during compilation at...

CVE-2026-119283

A flaw was found in joserfc. When decrypting a JSON Web Encryption JWE object, the library fails to limit the number of recipient entries processed in a single request. A remote, unauthenticated attacker can exploit this flaw by sending a crafted JWE token with an arbitrarily large recipients...

CVE-2026-119196

A flaw was found in pyasn1. A remote attacker can cause a Denial of Service DoS by sending specially crafted Abstract Syntax Notation One ASN.1 data containing multiple constructed bit string fragments. When decoding these fragments, the library repeatedly copies and shifts accumulated bit data,...

CVE-2026-119195

A flaw was found in pyasn1. A remote attacker can cause a Denial of Service DoS by providing specially crafted ASN.1 Abstract Syntax Notation One encoded data containing numerous fragments. During the decoding of constructed strings or indefinite-length values, the library repeatedly concatenates...

CVE-2026-119194

A flaw was found in pyasn1. A remote attacker could trigger a Denial of Service DoS by sending specially crafted Abstract Syntax Notation One ASN.1 data containing colliding tag identifiers during schemaless decoding. Processing these inputs causes inefficient container lookups that consume...

CVE-2026-118772

A flaw was found in joi. The email validation rule configured to validate multiple addresses uses an inefficient regular expression when splitting input strings. A remote attacker can exploit this flaw by submitting input containing long runs of whitespace, causing excessive computation. This can...

CVE-2026-112900

A flaw was found in Pillow. This vulnerability may allow an attacker to achieve arbitrary code execution when processing Encapsulated PostScript EPS images. Because Pillow invokes the external Ghostscript utility without properly sanitizing user-controlled input filenames, names beginning with...

CVE-2026-112403

A flaw was found in Pillow. A remote attacker could exploit this vulnerability to achieve arbitrary code execution or cause a Denial of Service DoS by supplying a specially crafted lossless JPEG image to an application that downscales images or generates thumbnails. This issue occurs because the...

CVE-2026-112398

A flaw was found in Pillow. A remote attacker can achieve arbitrary code execution by supplying a specially crafted FlashPix FPX image file to an application that processes untrusted inputs. Due to improper handling of image tile data during JPEG decoding, the library writes pixel data beyond the...

CVE-2026-119266

An use after free flaw was found in the Quota component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/575202553...

CVE-2026-119286

A flaw was found in graphql-core. When validating queries that exceed the maximum allowed error threshold, the library reuses an internal error object across multiple requests. This causes Python to retain historical request data in memory for the lifetime of the process. A remote, unauthenticate...

CVE-2026-119271

An use after free flaw was found in the Skia component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/577403270...

CVE-2026-119269

An use after free flaw was found in the Blink component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/577072000...

CVE-2026-119260

An use after free flaw was found in the Frames component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/573264074...

CVE-2026-118669

A flaw was found in oauthlib. In certain token grant flows, the authorization system can authenticate an incoming client while retaining a different, client-supplied identifier for permission and scope validation. A remote, authenticated attacker with lower privileges can exploit this inconsisten...

CVE-2019-25781

A flaw was found in Python-Markdown. An algorithmic complexity vulnerability in inline link parsing allows a remote attacker to cause a Denial of Service DoS by exhausting CPU resources. By submitting specially crafted Markdown text containing repeated unmatched brackets, an attacker can force th...

CVE-2026-118664

A flaw was found in decode-uri-component. A remote attacker can trigger a Denial of Service DoS by sending crafted input containing numerous malformed percent-encoded sequences. When processing this input, an inefficient fallback decoding routine consumes excessive processor resources and blocks...

CVE-2026-115353

A flaw was found in mistune. This flaw allows a remote attacker to read arbitrary files and access sensitive system data through a path traversal vulnerability in the reStructuredText RST include directive. By submitting crafted markup referencing absolute file paths or directory traversal...

CVE-2026-114148

Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally. What privileges could be gained by an attacker who successfully exploited this vulnerability? An attacker who successfully exploited this vulnerability could gain the highest privileges on t...

CVE-2026-115943

A flaw was found in Spreadsheet::XLSX. This vulnerability can lead to arbitrary code execution when the library processes a spreadsheet containing crafted number format conditions. The module improperly evaluates workbook-supplied formatting conditions as code during file parsing. An attacker can...

CVE-2026-115642

A flaw was found in OpenStack keystonemiddleware and Keystone. The code incorrectly treats the presence of the X-Service-Token HTTP header as sufficient to skip enforcement of application credential access rules and can skip related token-binding checks. An attacker who holds an application...

CVE-2026-119052

A flaw was found in llama.cpp. An unauthenticated remote attacker can cause a Denial of Service DoS by sending a specially crafted request with an excessively large message length to the Remote Procedure Call RPC server. Handling this malformed input triggers an unhandled exception, crashing the...

CVE-2026-118694

A flaw was found in markdown2. A remote attacker can cause a Denial of Service DoS by submitting specially crafted Markdown content containing repeated unclosed inline link sequences. Processing these malformed links causes the parser to repeatedly rescan the text, exhausting CPU resources and...

CVE-2026-118319

A memory corruption flaw was found in the Skia component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/576194994...

CVE-2026-103506

A flaw was found in Grafana. When the experimental Kubernetes Single Sign-On SSO settings Application Programming Interface API feature toggle is enabled, the service fails to enforce proper authorization checks. An authenticated user with low-privilege Viewer permissions can exploit this...

CVE-2026-115377

A flaw was found in Incus. An attacker controlling a malicious migration source can exploit an arbitrary file write vulnerability by embedding symbolic links symlinks into transferred storage volumes during migration streams. By directing these links to the underlying host filesystem, the attacke...

CVE-2026-103963

A flaw was found in glib-networking. When establishing connections using Transport Layer Security TLS version 1.3, the client-side session cache does not limit the number of session tickets retained for a single host. A malicious server can exploit this by sending excessive session ticket message...

CVE-2026-117882

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Layout component Mitigation --- CME Mitigation Guidance 2026-11-02 --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending th...

CVE-2026-117876

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Layout: Text and Fonts component Mitigation --- CME Mitigation Guidance 2026-11-02 --- Disclaimer: The following mitigation solutions are provided as a...

CVE-2026-117872

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript: Standard Library component...

CVE-2026-111115

A flaw was found in Apache Kafka. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted request containing a large declared count of tagged fields in flexible request headers. Because the server does not adequately validate or limit this count against th...

CVE-2026-111551

A flaw was found in Apache Kafka. Several deserialization routines in the client and Streams libraries allocate memory directly based on an input's declared size field without validating whether enough data is actually available. An attacker who can send crafted messages to affected topics or...

CVE-2026-111108

A flaw was found in Apache Kafka. Due to improper input validation during protocol request parsing, the service pre-allocates disproportionately large memory collections based on the sender's declared array element count without verifying that the request buffer contains sufficient data. A remote...

CVE-2026-117866

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation due to use-after-free in the Graphics: Canvas2D component Mitigation --- CME Mitigation Guidance 2026-11-02 --- Disclaimer: The following mitigation solution...

CVE-2026-117865

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript: GC component Mitigation --- CME Mitigation Guidance 2026-11-02 --- Disclaimer: The following mitigation solutions are provided as a courtesy,...