CVE-2026-97059

A flaw was found in DCMTK. This heap over-read vulnerability exists in the ConcatenationLoader component, where it copies pixel data frames without properly validating the buffer length against the declared number of frames. A remote attacker could exploit this by crafting malicious Digital Imagi...

CVE-2026-88385

A flaw was found in mxml. A remote attacker could cause a Denial of Service DoS by supplying specially crafted, malformed XML data to an application utilizing the library. When handling parsing errors, the parser fails to release certain allocated text nodes, leading to a persistent memory leak o...

CVE-2026-84383

A critical heap buffer overflow vulnerability exists in libheif versions 1.22.0 through 1.23.1. When decoding a maliciously crafted HEIF, HEIC, or AVIF file using nested iden and auxl references, HeifPixelImage::transferchannelfromimageas can inappropriately append duplicate Alpha planes with...

CVE-2026-93545

A flaw was found in libXi. An out-of-bounds read vulnerability in the XListInputDevices function allows a malicious X server to crash connected client applications. By returning specially crafted input device data when a client requests device information, the server can trigger an application...

CVE-2026-93542

A flaw was found in libXi. An out-of-bounds read vulnerability occurs during the parsing of X Input Extension XI2 device class data. A malicious X server can exploit this vulnerability by sending specially crafted class responses to a connected client application. This causes the client to read...

CVE-2026-94281

A flaw was found in libXi. An out-of-bounds read vulnerability exists in the XListInputDevices function during the parsing of input device classes. A malicious X server can exploit this flaw by returning crafted device information, causing an attached X client application to crash and resulting i...

CVE-2026-88372

A flaw was found in libsndfile. An attacker could exploit this vulnerability by tricking a user or service into processing a specially crafted MAT4 MATLAB v4 audio file. Due to an integer overflow during header parsing in the mat4readheader function, this can cause memory corruption and trigger a...

CVE-2026-93544

A flaw was found in libXi. This out-of-bounds read vulnerability allows a malicious X server to cause a Denial of Service DoS against attached client applications. By returning a specially crafted response to an XIQueryDevice request, the server triggers an invalid memory read within the client,...

CVE-2026-59281

A flaw was found in Spring MVC and WebFlux applications. When these applications are configured to obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors or Errors.getFieldError accessors, they become vulnerable...

CVE-2026-67233

A flaw was found in RabbitMQ. An authenticated monitoring user, who is intended to have read-only access, can exploit an improper authorization vulnerability. This allows them to delete or restart 'shovels' in any virtual host they can access, leading to a denial of service or disruption of messa...

CVE-2026-94574

A flaw was found in GNU wget Windows builds from eternallybored.org. A hardcoded configuration file path is writable by unprivileged users, allowing arbitrary code execution or local privilege escalation via the useaskpass configuration option...

CVE-2026-93604

A flaw was found in vm2. Untrusted guest code can exploit this vulnerability when the crypto builtin is explicitly allowlisted for a NodeVM Node.js Virtual Machine. By calling the crypto.setFips function, an attacker can modify the FIPS Federal Information Processing Standards mode of the entire...

CVE-2026-63343

A flaw was found in Incus, a system container and virtual machine manager. An authenticated Incus user can exploit this vulnerability by providing a malicious image containing a metadata.yaml symlink that points to an arbitrary host path. This allows the user to read or overwrite any file on the...

CVE-2026-61781

A flaw was found in pgpartman. A low-privileged database user with specific INSERT and UPDATE permissions can exploit a SQL injection issue in the createpartitiontime function. This allows the user to store malicious SQL code, which is later executed with superuser privileges by the pgpartmanbgw...

CVE-2026-97058

A flaw was found in sprintf-js. A remote attacker, by controlling format strings, can inject precision values that exceed ECMAScript limits. This lack of validation leads to uncaught RangeError exceptions, allowing the attacker to abort calling operations with a minimal payload, resulting in a...

CVE-2026-90959

A path traversal vulnerability was found in pulpcore. The content upload API accepts a 'fileurl' parameter that allows users with file repository privileges to specify a local file URL for Pulp to download and store. A URL scheme validation check uses a string prefix comparison that only rejects...

CVE-2026-61822

A flaw was found in pgpartman. A user with partmanuser access can exploit an exception handling issue in the runmaintenance function. By crafting a failing partition set with a low maintenance order, an attacker can cause the maintenance process to prematurely terminate. This leads to a denial of...

CVE-2026-61821

A flaw was found in pgpartman. A user with partmanuser access can bypass authorization checks in the droppartitionid and droppartitiontime functions. This allows them to move retained child tables to schemas where they typically lack CREATE privileges. The relocation is performed with elevated...

CVE-2026-61820

A flaw was found in pgpartman. A local user with partmanuser privileges, who owns a template table, can exploit a SQL injection issue within the inherittemplateproperties function. By crafting a malicious column name, the user can bypass proper escaping, allowing arbitrary SQL commands to be...

CVE-2026-61817

A flaw was found in pgpartman. A user with partmanuser privileges can exploit a SQL injection vulnerability by storing malicious SQL in the partconfig.timedecoder value. This malicious SQL is then executed without proper validation during certain maintenance operations. This can lead to privilege...

CVE-2026-97057

A flaw was found in redis-parser. This vulnerability allows a malicious or compromised Redis endpoint to trigger an uncaught RangeError by sending a crafted RESP REdis Serialization Protocol header with an excessively large declared length. The flaw occurs because redis-parser fails to validate t...

CVE-2026-67238

A flaw was found in RabbitMQ, a messaging and streaming broker. An authenticated AMQP Advanced Message Queuing Protocol client can trigger an atom-table exhaustion by sending specially crafted reply-to queue names for decoding. This can lead to the entire Erlang Virtual Machine VM crashing,...

CVE-2026-67220

A flaw was found in RabbitMQ, a messaging and streaming broker. An authenticated low-privilege AMQP Advanced Message Queuing Protocol user can exploit this vulnerability by creating bindings on an x-jms-topic exchange with specially crafted selector strings. This action causes an exhaustion of...

CVE-2026-66080

A flaw was found in RabbitMQ. A highly privileged remote attacker, with the rabbitmqstreammanagement plugin enabled and access to the target vhost, can exploit an unbounded allocation vulnerability in the super-stream partitions. This allows the attacker to allocate a large amount of memory,...

CVE-2026-66075

A flaw was found in RabbitMQ, a messaging and streaming broker. A remote attacker with monitoring user credentials can exploit an authorization flaw to restart federation links. This unauthorized action disrupts message flow, leading to a denial of service DoS for affected services. This...

CVE-2026-66069

A flaw was found in RabbitMQ. A user with a monitoring tag, when the Management plugin is enabled, can reset the per-node authentication-attempt counters. This action, which should be restricted to administrators, allows the monitoring-tagged user to erase evidence of brute-force login attempts...

CVE-2026-67405

A flaw was found in RabbitMQ's Web-MQTT and Web-STOMP handlers. These handlers do not properly validate the Origin header during a WebSocket upgrade. When specific non-default configurations are enabled, such as usehttpauth=true for Web-STOMP or sslcertlogin=true for both plugins, an attacker can...

CVE-2026-67231

A flaw was found in RabbitMQ. The trust-store plugin incorrectly validates client certificates by only matching the issuer name and serial number, rather than using the full certificate for path validation. This allows a remote attacker, who knows the issuer name and serial number of a whiteliste...

CVE-2026-67218

A flaw was found in RabbitMQ. A user with management tag and virtual host vhost access, but lacking configure permissions, can exploit a vulnerability in the HTTP API for super-stream creation. This flaw allows the user to bypass permission checks and create persistent cluster-wide resources, suc...

CVE-2026-66079

A flaw was found in RabbitMQ. An unauthenticated network attacker can exploit an issue in the AMQP 1.0 listener by sending a specially crafted 19-byte frame. This causes the system to attempt to build a list of approximately 4 billion empty elements, exhausting heap memory and terminating the...

CVE-2026-61819

A flaw was found in pgpartman. A database user with partmanuser privileges can exploit a SQL injection vulnerability by crafting a malicious parent-table name. When the extension is configured to use pgjobmon, this crafted input is improperly processed during an exception, allowing the injection...

CVE-2026-66070

A flaw was found in RabbitMQ. When the management plugin is configured with a wildcard Cross-Origin Resource Sharing CORS origin, it incorrectly reflects the attacker's origin and allows credentials. This vulnerability enables a malicious web page to leverage a signed-in administrator's cached...

CVE-2026-61818

A flaw was found in pgpartman. The undopartition function improperly handles input from partconfig.timeencoder, allowing it to be interpreted as executable SQL code. A user with partmanuser access can inject malicious SQL, which then executes with the privileges of the user invoking undopartition...

CVE-2026-95521

A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a % macro construct causes rpm to execute an attacker-controlled shell command via popen while relocating the source file list. This allows arbitrary command execution as t...

CVE-2026-95519

A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using rpm -q -p or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened,...

CVE-2026-79312

A flaw was found in webpy. The session component reads the session identifier from the request cookie and reuses it across authentication state changes without ever rotating it. This allows a pre-authentication session identifier to persist into the authenticated session, enabling an attacker who...

CVE-2026-79311

A flaw was found in webpy. The renderjinja template adapter does not enable automatic HTML escaping when initializing the Jinja2 environment. Applications using this adapter that render user-controlled data in templates are vulnerable to cross-site scripting XSS. Mitigation Mitigation for this...

CVE-2026-94416

An authorization bypass was found in the Ansible Automation Platform AAP gateway. The gateway API allows an authenticated administrator to create a new service key for the Controller service cluster. Because service-key creation is not restricted to the installer-provisioned provisioning path, an...

CVE-2026-79616

A flaw was found in Qt Quick. This out-of-bounds read vulnerability occurs when parsing untrusted SVG path strings in the Context2D.path or PathSvg.path properties. A local attacker with low privileges could exploit this flaw with user interaction to cause a Denial of Service DoS. Mitigation...

CVE-2026-79680

A flaw was found in the Qt VNC Server module. A remote attacker, by using a specially modified VNC client that violates the Remote Framebuffer RFB protocol, can bypass the password authentication mechanism. This allows the attacker to gain unauthorized remote access to the shared application,...

CVE-2026-63132

A flaw was found in OpenBao, an open source identity-based secrets management system. A remote unauthenticated attacker could exploit a timing attack vulnerability in the handleLogicalRecovery path to infer a highly privileged recovery token. This token could then be used to authorize recovery mo...

CVE-2026-95622

A flaw was found in ModemManager. When parsing a Cell Broadcast Message, some 3GPP data-coding-scheme values 8-bit and reserved character sets are not handled. The process hits a reachable assertion and aborts. An attacker who can deliver a crafted Cell Broadcast PDU over the radio network, or vi...

CVE-2026-97311

A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The endpoints used to retrieve groups associated with a specific role do not properly check for individual group visibility permissions. This allows a delegated administrator with basic search privileg...

CVE-2026-88841

BusyBox dpkg writestatusfile does not reset a stale field cursor between package stanzas, causing out-of-bounds reads and status file corruption when removing multiple packages. Mitigation Do not use the BusyBox dpkg applet for package management on systems where package integrity is critical...

CVE-2026-96577

A flaw was found in oc-mirror. During mirroring operations, the embedded local cache registry binds to all network interfaces without authentication or encryption instead of restricting access to the local system. An unauthenticated attacker on an adjacent network can connect to the exposed servi...

CVE-2026-77421

A flaw was found in the JLine built-in nano editor's regular expression regex search mode. A remote attacker could exploit this by providing a specially crafted search term. This could lead to excessive central processing unit CPU consumption, causing the editor session to become unresponsive and...

CVE-2026-77420

A flaw was found in JLine, a Java library for handling console input. An attacker who can control application or user configuration can supply a specially crafted regular expression to the HISTORYIGNORE configuration variable. This malicious input can cause excessive CPU consumption when commands...

CVE-2026-97185

A flaw was found in GIMP. When processing a specially crafted GIMPressionist preset file, the plug-in does not properly validate vector indices before writing into fixed-size arrays. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to...

CVE-2026-97152

A flaw was found in Nanomsg. A remote attacker could exploit a buffer overflow vulnerability in the WebSocket transport by sending a specially crafted Sec-WebSocket-Version header. This issue arises from an unchecked copy operation using snprintf. Successful exploitation of this flaw could lead t...

CVE-2026-67240

A flaw was found in RabbitMQ, a messaging and streaming broker. An authenticated AMQP 1.0 consumer with read and write permissions on a stream queue can exploit a Regular Expression Denial of Service ReDoS vulnerability. This occurs when a crafted LIKE filter is processed, leading to excessive CP...