214703 matches found
CVE-2026-92240
A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged ' ID' response, crashing Thunderbird. The affected parsing path is...
CVE-2026-92021
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript Engine: JIT component...
CVE-2026-92020
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component...
CVE-2026-92009
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component...
CVE-2026-92007
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component...
CVE-2026-92081
A flaw was found in fastify. When a route registers a response trailer and is served over HTTP/2, fastify incorrectly sets the 'Transfer-Encoding: chunked' header. This leads to an unhandled exception in Node.js, causing the server process to crash and resulting in a Denial of Service DoS. A...
CVE-2026-77860
A vulnerability in Unbound's serve-expired code path allows a remote attacker to bypass pending-query limits using specially crafted DNS queries. By causing a security counter to double-decrement, the attacker can hold an arbitrary number of pending queries from a single source, resulting in a...
CVE-2026-85501
A flaw was found in Unbound. This vulnerability, termed 'ReTrap', allows a remote attacker to launch algorithmic complexity attacks on the Domain Name System Security Extensions DNSSEC validation process. By serving malicious zones or responses, an attacker can exploit various mechanisms, such as...
CVE-2026-82720
A use-after-free vulnerability in Unbound's DNS-over-HTTPS DoH stream cleanup code allows a remote attacker to cause a denial of service DoS. When DoH support is compiled, sending a specially crafted DoH connection under specific failure conditions—such as an RPZ drop query or heavy traffic—cause...
CVE-2026-80225
A flaw was found in Unbound. A malicious actor can exploit a vulnerability in the TCP/DoT reading procedure, which lacks a limit on consecutive reads. By continuously streaming distinct uncached names over a TCP/DoT connection, an attacker can monopolize a worker's event loop. This can lead to a...
CVE-2026-78227
A flaw was found in Unbound. This vulnerability occurs in the DNS-over-QUIC DoQ stream output buffer when a client sends a RESETSTREAM, causing the output buffer to be freed while retransmission entries still point to it. A remote attacker, by querying Unbound over DoQ, withholding acknowledgment...
CVE-2026-77955
A vulnerability in Unbound allows tampered DNS records in ZONEMD-configured zones below a trust anchor to be served or saved before integrity checks complete. Asynchronous DS/DNSKEY resolution creates a time window where unverified data is processed. If this compromised data is written to disk, i...
CVE-2026-82717
A flaw was found in Unbound. Improper handling of buffer positions and compression pointers in Unbound's CNAME synthesis allows a remote attacker to corrupt heap memory via upstream DNS responses. This vulnerability can result in a denial of service DoS or, under specific conditions, remote code...
CVE-2026-81634
A flaw was found in Unbound. This vulnerability allows a remote attacker to cause a heap buffer overflow during the processing of DNSSEC responses. By sending a specially crafted DNSSEC response, a malicious server or an attacker tampering with network traffic can trigger this flaw. This could le...
CVE-2026-19248
A flaw was found in Qt. This vulnerability, specifically an unbounded recursion in the QDomNode destructor during QDomDocument XML parsing, allows a remote attacker to trigger a denial-of-service DoS crash. By processing untrusted XML input, the affected system can become unresponsive, leading to...
CVE-2026-92091
A flaw was found in jwcrypto. The JWK.importkey function validates the keyops JWK member for duplicate values using an algorithm with On^2 time complexity, and the length of keyops is not bounded. A remote, unauthenticated attacker can supply a JWK with a large keyops array to an application that...
CVE-2026-89739
A flaw was found in the Linux kernel's USB dwc3 gadget driver. A race condition exists where a delayed operation might try to access memory that has already been freed. This can lead to a use-after-free vulnerability, which a local attacker could potentially exploit to cause a system crash denial...
CVE-2026-92358
A flaw was found in the first broker login flow of Keycloak. When a user confirms an account-linking request from a different browser, a temporary proof is created to validate the link. However, this proof is not properly cleared after the link is established or when the user later manually remov...
CVE-2026-92220
A flaw was found in vllm-project vLLM. A remote attacker can exploit this vulnerability by manipulating specific arguments within the MoRIIO Acknowledgement Handler component. This manipulation can lead to excessive resource consumption, potentially impacting the availability of the system...
CVE-2026-91714
An observable discrepancy flaw was found in the Fonts component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=517710554...
CVE-2026-91719
A code injection flaw was found in the XML component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=542115030...
CVE-2026-91744
A race condition flaw was found in the PlatformIntegration component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=520019273...
CVE-2026-91715
A type confusion flaw was found in the ServiceWorker component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=558367547...
CVE-2026-91712
A race condition flaw was found in the Extensions component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=521486621...
CVE-2026-91740
A flaw was found in Skia, a 2D graphics library used in Google Chrome. This vulnerability, stemming from an uninitialized resource, allows a remote attacker to obtain sensitive cross-origin data. By crafting a malicious HTML page, an attacker can trick a user into visiting it, leading to the...
CVE-2026-91735
An incorrect authorization flaw was found in the WebUI component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=552416113...
CVE-2026-91725
An observable discrepancy flaw was found in the CSS component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=518032534...
CVE-2026-91733
A flaw was found in Skia, a 2D graphics library used in chromium-browser. This improper state validation vulnerability allows a remote attacker, who has already compromised the renderer process, to read memory outside of the security sandbox. This can be achieved by enticing a user to open a...
CVE-2026-91748
A race condition flaw was found in the Extensions component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=521559611...
CVE-2026-91720
An uninitialized resource flaw was found in the ANGLE component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=523470135...
CVE-2026-91739
A missing authorization flaw was found in the Transactions Platform component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=521951328...
CVE-2026-91732
A missing authorization flaw was found in the AppManifest component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=511062248...
CVE-2026-91746
An integer overflow flaw was found in the Compositing component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=556260782...
CVE-2026-91734
An incorrect authorization flaw was found in the Core component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=516780835...
CVE-2026-91728
An integer overflow flaw was found in the V8 component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=556715288...
CVE-2026-91724
An use after free flaw was found in the Input component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=552283275...
CVE-2026-91747
A flaw was found in Skia, a 2D graphics library used in Google Chrome. A remote attacker, after compromising the renderer process, could exploit a use-after-free vulnerability by crafting a malicious HTML page. This could allow the attacker to obtain sensitive cross-origin data...
CVE-2026-91736
An use after free flaw was found in the DOM component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=553121008...
CVE-2026-91713
A missing authorization flaw was found in the Browser component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=523715133...
CVE-2026-91709
A type confusion flaw was found in the ServiceWorker component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=547815507...
CVE-2026-91717
A missing authorization flaw was found in the Android component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=549225472...
CVE-2026-91730
An incomplete cleanup flaw was found in the GetUserMedia component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=543640868...
CVE-2026-91723
A race condition flaw was found in the WebAppInstalls component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=474131239...
CVE-2026-91708
A race condition flaw was found in the Network component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=553115724...
CVE-2026-91745
An use after free flaw was found in the V8 component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=558734727...
CVE-2026-92000
A flaw was found in adm-zip. A remote attacker could exploit this vulnerability by crafting a malicious ZIP archive containing highly compressible entries that declare a zero uncompressed size. This oversight prevents the application of zlib decompression output limits, leading to excessive memor...
CVE-2026-91741
A type confusion flaw was found in the CacheStorage component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=546413288...
CVE-2026-91743
A race condition flaw was found in the Core component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=516947138...