221824 matches found
CVE-2026-88007
A flaw in Traefik's HTTP/3 ConnContext allows unauthenticated remote attackers to bypass authentication on backends using connection-bound NTLM or Negotiate protocols. Missing service.AddTransportOnContext calls lead to shared kerberosRoundTripper transports, enabling attackers to hijack persiste...
CVE-2026-76890
A flaw was found in Wireshark's sharkd component. A remote attacker could exploit an expired pointer dereference, which leads to a crash in the sharkd service. This vulnerability could result in a denial of service DoS for affected systems, requiring user interaction to trigger the flaw. Mitigati...
CVE-2026-47699
A flaw was found in guest-components. This vulnerability allows an attacker to achieve container escape and gain unauthorized access to the underlying pod virtual machine. When unpacking a crafted Open Container Initiative OCI image layer, the archive extraction routine fails to restrict hard lin...
CVE-2026-90462
A flaw was found in SSSD. When configured with the LDAP access provider and ldapaccessorder including ppolicy or lockout, a fail-open condition in the LDAP ppolicy access check can occur if a user lookup returns zero results. This can incorrectly return success and cache an allow decision,...
CVE-2026-88009
A flaw was found in Traefik, an open source HTTP reverse proxy and load balancer. This vulnerability allows a remote attacker to bypass security controls by sending a specially crafted HTTP/1 request. The request target is incorrectly processed, leading to cross-vhost routing bypass, path-scoped...
CVE-2026-84200
A flaw was found in Kyverno. This policy exception handling flaw allows a remote attacker to bypass security policies. By crafting a resource name that matches a less restrictive exception pattern, an attacker can circumvent policies, such as those blocking hostPath volumes, leading to unauthoriz...
CVE-2023-54356
A flaw was found in Kyverno. The software supports insecure 3DES cipher suites on its TLS endpoints. A remote attacker could exploit this vulnerability, known as the Sweet32 attack, to recover small amounts of plaintext data. This exploitation requires very long-lived TLS connections carrying lar...
CVE-2026-59940
A flaw was found in Seroval, a JavaScript JS value stringification library. The seroval.fromJSON function allows a remote attacker to provide specially crafted JSON Promise control nodes. These nodes can operate on deserialized values without proper verification, leading to unintended server-side...
CVE-2026-89258
A flaw was found in Hugo, a static site generator. This vulnerability allows an attacker, who can place a symbolic link symlink in a mounted directory, to bypass path confinement. This bypass enables functions performing direct resource lookups to follow the symlink and read files outside the...
CVE-2026-71557
A flaw was found in go-git, an extensible Git implementation library. Maliciously crafted reference names, which can contain directory-traversal sequences, are not properly sanitized. This vulnerability allows an attacker to write files outside of the intended reference storage directory,...
CVE-2026-95619
A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability. Mitigation Mitigation for...
CVE-2026-76929
A flaw was found in Wireshark. A local attacker, by enticing a user to open a specially crafted Pcapng file, could trigger an out-of-bounds read vulnerability in the Pcapng file parser. This could lead to an application crash, resulting in a denial of service. Mitigation To mitigate this...
CVE-2026-76641
A flaw was found in Expat. Attackers can exploit an out-of-bounds read vulnerability by processing XML with external entity parsers created via XMLExternalEntityParserCreate. This can lead to memory corruption. Specifically, a mismatch in struct sizes can cause a read past memory boundaries,...
CVE-2026-76926
A flaw was found in Wireshark. A remote attacker could exploit this by providing a specially crafted BUSMASTER file, which triggers a reachable assertion in the BUSMASTER file parser, leading to an abnormal exit. This could result in a denial of service DoS, making the application unavailable...
CVE-2026-48802
A flaw was found in python-engineio, a Python implementation of the Engine.IO realtime client and server. A remote attacker can exploit a vulnerability in the heartbeat mechanism by sending specific packets, leading to the creation of excessive background threads. This can result in a Denial of...
CVE-2026-80255
A flaw was found in curl. When a Set-Cookie: header uses a tab character instead of a space before the Secure attribute, curl incorrectly stores the cookie without the Secure flag. This can lead to information disclosure, as the cookie may then be sent over unencrypted HTTP connections to the sam...
CVE-2026-95516
A flaw was found in the ZBar barcode reader library. A heap-buffer-overflow write of one byte occurs when processing Structured-Append QR codes where the buffer size calculation does not account for NUL separator bytes inserted between decoded segments. An attacker could exploit this by crafting ...
CVE-2026-95508
A heap-based buffer overflow was found in the DHCPv6 and TFTP response builders of libslirp. When the host is configured with a small interface MTU, a guest-supplied DHCPv6 CLIENTID option or TFTP blksize option can overflow the reply buffer with attacker-controlled content and length, resulting ...
CVE-2026-95507
An out-of-bounds read was found in the NC-SI OEM response handler of libslirp. A truncated NC-SI OEM Ethernet frame causes ncsirsphandleroem to read up to 4 bytes beyond the supplied packet length and reflect the value into the response sent to the guest, resulting in guest-observable disclosure ...
CVE-2026-95511
A privilege escalation vulnerability was found in CUPS when used with the cups-filters serial backend. A local user who is a member of the lpadmin group can configure a printer that uses a privileged serial backend. The CUPS scheduler does not restrict the path component of non-file device URIs, ...
CVE-2026-95503
A flaw was found in the Kerberos federation provider of Keycloak, an open-source identity and access management solution. When Kerberos password authentication is used without SPNEGO, the system fails to verify the identity of the Key Distribution Center KDC by requesting a server ticket. This...
CVE-2026-82208
A flaw was found in libcurl when using the wolfSSL backend. When CA Certificate Authority caching is enabled and a CURLOPTSSLCTXFUNCTION callback is used to replace the trust store, libcurl can silently reinstall the cached store. This can lead to a scenario where a certificate that should be...
CVE-2026-79147
A flaw was found in Skia, a 2D graphics library used in Google Chrome. A remote attacker, after compromising the renderer process, could exploit this vulnerability by tricking a user into visiting a specially crafted HTML page. This could potentially lead to the disclosure of sensitive informatio...
CVE-2026-78914
A flaw was found in Skia, a 2D graphics library used in Chromium. A remote attacker could exploit an uninitialized resource vulnerability by tricking a user into opening a specially crafted HTML page. This could potentially allow the attacker to read sensitive memory within the browser's sandbox,...
CVE-2026-94640
A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service DoS by sending a large number of unique requests. The rpcbind service records previously unseen RPC Remote Procedure Call statistics in unbounded in-memory lists, leading to...
CVE-2026-93056
A flaw was found in the Linux kernel. Specifically, within the USB gadget audio class 1 UAC1 legacy driver, a programming error related to handling string attributes could lead to a critical system failure. A local attacker could trigger this vulnerability by attempting to write to certain...
CVE-2026-93159
A flaw was found in the atmel-sha204a cryptographic hardware random number generator HWRNG driver in the Linux kernel. When an Inter-Integrated Circuit I2C transfer fails, the driver does not properly clear a pointer to allocated work data. This oversight can lead to subsequent read attempts...
CVE-2026-90439
A flaw was found in NGINX ngxhttpv3module. A limited heap buffer overflow can occur during a Transport Layer Security TLS handshake when using HTTP/3 with certain OpenSSL versions. This vulnerability may allow remote attackers to cause a denial-of-service DoS on the NGINX system. Additionally, it...
CVE-2026-93433
A flaw was found in libstoragemgmt. An attacker with control over a local or virtual storage device could provide specially crafted SCSI Small Computer System Interface Vital Product Data VPD page 0x80 data. This malformed data, specifically an untrusted page length field, can lead to a stack...
CVE-2026-92072
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions in the Safe Browsing component...
CVE-2026-84138
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Denial-of-service in the PDF Viewer component...
CVE-2026-84137
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Spoofing issue in the DOM: Core & HTML component...
CVE-2026-84136
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Other issue in the DOM: Navigation component...
CVE-2026-84135
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Other issue in Firefox Focus for Android...
CVE-2026-84134
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Other issue in the Profile Backup component...
CVE-2026-84132
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Information disclosure in the Networking: HTTP component...
CVE-2026-84130
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Information disclosure in the Graphics: WebGPU component...
CVE-2026-84117
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in Firefox for Android...
CVE-2026-84118
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript: GC component...
CVE-2026-84126
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions in the Layout: Grid component...
CVE-2026-84124
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component...
CVE-2026-84123
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation due to use-after-free in the Graphics: WebGPU component...
CVE-2026-84140
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Site isolation issue in the DOM: Navigation component Mitigation Update to Firefox ESR 153.2, Firefox ESR 140.15, or Firefox 155 or later. Red Hat will provide updated Firefox...
CVE-2026-84139
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Clickjacking issue in the DOM: Events component...
CVE-2026-84133
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Site isolation issue in the DOM: Push Subscriptions component...
CVE-2026-84642
A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: The values of the mail.allowedattachmenthostnames advanced config setting were used in a regular expression without escaping. For some possible valid hostnames, this could allow certain...
CVE-2026-84141
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Integer overflow in the Graphics: ImageLib component...
CVE-2026-80231
A flaw was found in libcurl. This vulnerability allows libcurl to incorrectly reuse an existing HTTPS connection for a given hostname, even when a different Native CA Store setting CURLSSLOPTNATIVECA is specified for the new connection. This could potentially lead to a client trusting a malicious...