CVE-2026-15605

A flaw was found in wandb. A remote attacker could exploit the use of a weak hash algorithm during artifact integrity validation in the ArtifactManifestEntry.download function. This could potentially lead to a low impact on confidentiality, allowing for limited information disclosure...

CVE-2026-58472

A flaw was found in GNU Wget. A remote attacker can exploit a heap buffer overflow vulnerability in the htmlquotestring function by providing a specially crafted HTML attribute. This can lead to memory corruption and potentially result in arbitrary code execution or a denial of service. Mitigatio...

CVE-2026-59674

A flaw was found in suricata. This vulnerability, related to improper handling of symbolic links, allows a local suricata user to escalate their privileges to root. By exploiting this, an attacker could gain full control over the affected system. Mitigation No mitigation is necessary for Red Hat'...

CVE-2026-12482

A flaw was found in Keras. An attacker can exploit a vulnerability in the tar archive processing to bypass security validations. This allows for the creation of symbolic links symlinks outside of the intended directory, which could lead to unauthorized access to or modification of files on the...

CVE-2026-58470

An integer overflow in GNU Wget's parsecontentrange function allows malicious servers to send crafted Content-Range headers. This triggers undefined behavior and download desynchronization, potentially causing a denial of service or data integrity issues for the client. Mitigation To mitigate thi...

CVE-2026-53364

A flaw was found in the Linux kernel's Bluetooth Host Controller Interface HCI connection handling. The hcilebigterminate function, which is responsible for terminating Bluetooth connections, allocates memory but fails to free it under specific conditions when certain flags are not set. This memo...

CVE-2026-53365

A flaw was found in the Linux kernel's vsock/virtio component. This vulnerability occurs during zerocopy completion for large messages fragmented into multiple socket kernel buffers skbs. An issue in how user arguments uargs are handled for these buffers can lead to pinned user pages not being...

CVE-2026-39246

A flaw was found in the decompress package for Node.js. The package creates symlinks from archive entries during extraction without validating the link target against the output directory, because the existing containment check only applies to regular file entries. An attacker who can supply a...

CVE-2026-48978

A flaw was found in oras-go. The auth.Client in oras-go does not properly validate the scheme or host of the realm URL provided in a registry's WWW-Authenticate: Bearer challenge. A remote attacker, operating a malicious registry or performing a man-in-the-middle attack, could exploit this to...

CVE-2026-53539

A flaw was found in Python-Multipart, a streaming multipart parser. A remote attacker can exploit this vulnerability by submitting a specially crafted application/x-www-form-urlencoded body. This can cause the QuerystringParser to perform inefficient processing, leading to excessive CPU...

CVE-2026-12478

The fix for CVE-2026-0716 commit 6ff7ef0, libsoup 3.6.6 placed the integer overflow guard inside the if masked block, leaving unmasked server-to-client frames unprotected. A malicious WebSocket server can send a crafted unmasked frame with a payload length near UINT64MAX to trigger an OOB read in...

CVE-2026-15416

A flaw was identified in Argo CD, the GitOps engine used by Red Hat OpenShift GitOps, that could allow an unauthenticated attacker with network access to the Argo CD repo-server to achieve remote code execution. Under certain conditions, the attacker may then manipulate cached data to deploy...

CVE-2026-12413

A flaw was found in Libreswan's IKEv2 fragment reassembly mechanism. When a VPN gateway processes incoming split network packets fragments containing unexpected data, an off-by-one boundary validation error triggers an internal program safety check assertion failure. A remote, unauthenticated...

CVE-2026-51537

A flaw was found in OpENer. An out-of-bounds read vulnerability exists in the Connection Manager when processing malformed ForwardOpen requests. A remote attacker can send a specially crafted Ethernet/IP ENIP frame with an insufficient Common Industrial Protocol CIP ForwardOpen/LargeForwardOpen...

CVE-2026-50722

A flaw was found in Libreswan's implementation of IKEv2 authentication when processing signatures utilizing the RSASSA-PKCS1-v15 scheme. The RSAauthenticatehashsignaturepkcs115rsa function does not correctly validate the DER encoding of the ASN.1 digest. A remote, unauthenticated attacker could...

CVE-2026-59869

A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial o...

CVE-2026-50721

A flaw was found in Libreswan's implementation of IKEv1 authentication via raw RSA signatures. When processing an IKEv1 packet using PKCS 1 v1.5 RSA encryption, the RSAauthenticatehashsignaturerawrsa function fails to properly validate the length of the authentication hash. A remote,...

CVE-2026-60103

A flaw was found in Blender. A remote attacker could exploit an out-of-bounds read vulnerability by providing a specially crafted .blend file. This vulnerability occurs when the application processes a malicious memberindex value without proper validation, leading to an attempt to access memory...

CVE-2026-50162

A flaw was found in oras-go. The file content store, intended to confine writes to a specified working directory, does not properly account for symbolic link symlink traversal. A remote attacker, by providing a specially crafted blob title, could exploit this vulnerability to create files outside...

CVE-2026-39245

A flaw was found in the decompress component. An improper path containment check allows a local attacker to perform directory traversal. This vulnerability, when combined with unvalidated symlink creation, enables an attacker to write arbitrary files to directories outside the intended extraction...

CVE-2026-48702

A flaw was found in Rekor. The Package.Unmarshal function, which processes Alpine Package Keep APK files, decompresses gzip streams without limiting the total decompressed size. A remote attacker can exploit this by crafting a malicious APK file with a high compression ratio, causing the server t...

CVE-2026-44024

A flaw was found in Fluentd, a data collector. This vulnerability allows a remote attacker to achieve arbitrary file write and potentially remote code execution by sending untrusted tags containing path traversal characters. The issue arises from insufficient validation of the $tag placeholder in...

CVE-2026-54911

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps or ujson.dump or ujson.encode have a rejectbytes=False option. When set, they may accept malformed or truncated UTF-8 byte sequences, silently rewriting them into different...

CVE-2026-52846

A flaw was found in Caddy, an extensible server platform. The stripHTML template function, intended to remove HTML tags from input, fails to reliably process certain malformed HTML. This oversight allows dangerous content to remain in the output, which, if subsequently rendered as HTML, can lead ...

CVE-2026-50168

A flaw was found in the @angular/platform-server package of Angular. This vulnerability allows remote attackers to bypass host allowlist constraints and direct server-side outgoing requests to arbitrary external endpoints. This occurs due to a parser differential between the strict WHATWG URL...

CVE-2026-15538

A flaw was found in PrimeFaces PrimeReact. A remote attacker can exploit a weakness in the ObjectUtils.mutateFieldData function within the component API. This allows for the improper modification of object prototype attributes, potentially leading to unexpected behavior or further attacks. This...

CVE-2026-29008

A flaw was found in U-Boot. A network-adjacent attacker can exploit an integer underflow vulnerability in the tcprxstatemachine function by sending a specially crafted TCP SYN+ACK packet. This can cause the bootloader to crash, leading to a Denial of Service DoS and preventing the device from...

CVE-2026-29009

A flaw was found in U-Boot. A buffer overflow vulnerability exists in the nfsreadlinkreply function when the Network File System NFS command is enabled. A malicious or compromised NFS server can exploit this by sending multiple relative symlink targets, exceeding the buffer's capacity. This can...

CVE-2026-23560

A flaw was found in Xen. A virtual machine administrator vm-admin can exploit this by setting the VM.other-config:issystemdomain parameter, which allows them to mark a virtual machine as a system domain. This can lead to the virtual machine being ignored and remaining operational during critical...

CVE-2026-54428

A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system's configured header list size...

CVE-2026-60108

A flaw was found in Zeek. An uncontrolled memory consumption vulnerability in the FTP analyzer allows unauthenticated remote attackers to cause a denial of service. This occurs when a crafted FTP control session with a large ADAT control line is sent, exploiting the NVTAnalyzer component's lack o...

CVE-2026-60109

A flaw was found in Zeek's Kerberos protocol analyzer. An unauthenticated remote attacker can exploit a vulnerability by sending a specially crafted Kerberos KRBERROR message. This can lead to a null pointer dereference due to a mismatch in the parser and analyzer state, causing the Zeek sensor t...

CVE-2026-42486

A flaw was found in Xen. A virtual machine administrator vm-admin can set the VM.platform:hvmserial parameter, which should be restricted to the pool-admin role. This improper restriction allows the vm-admin to perform arbitrary file writes in dom0, potentially leading to system compromise...

CVE-2026-23562

A flaw was found in Xen. A virtual machine administrator vm-admin, a user with limited privileges, could bypass security checks related to PCI passthrough configuration. This allowed the vm-admin to gain unauthorized access to host hardware. This could lead to privilege escalation, enabling the...

CVE-2026-59858

A command injection vulnerability in Vim's C omni-completion script allows an attacker to execute arbitrary commands if a user is tricked into opening a maliciously crafted tags file and manually invoking the autocomplete feature. Mitigation Users are advised to avoid opening untrusted C source...

CVE-2026-55807

A flaw was found in Drupal core. This Server-Side Request Forgery SSRF vulnerability allows an attacker to induce the server to make requests to an arbitrary domain, potentially leading to information disclosure or access to internal network resources...

CVE-2026-55808

A flaw was found in Drupal core. This improper neutralization of input during web page generation, commonly known as Cross-site Scripting XSS, allows an attacker to inject malicious scripts into web pages. When a user views an affected page, these scripts can execute in their browser. This could...

CVE-2026-15584

A privilege escalation vulnerability was found in the incluster-checks tool for OpenShift. The tool creates privileged debug pods with host filesystem access in the shared default namespace, where any user with the standard edit role can exec into them and obtain root access on cluster nodes...

CVE-2026-53538

A flaw was found in Python-Multipart, a tool used for processing web form data. A remote attacker could exploit a vulnerability where the software incorrectly interprets certain characters as separators in web form data. This difference in interpretation compared to standard web practices allows ...

CVE-2026-62147

The Tempo Operator's gateway component failed to consistently apply namespace-scoped redaction on some query API response paths when query RBAC was enabled, allowing an authenticated user to read span attributes belonging to other tenants' namespaces. Mitigation There is no mitigation or workarou...

CVE-2026-59856

A flaw was found in Vim, an open-source command-line text editor. The PHP omni-completion script improperly handles specially crafted input. When a victim opens a malicious PHP file and invokes omni-completion, an unescaped class or trait name can be interpreted as Ex commands. This allows a remo...

CVE-2026-15551

A flaw was found in rlottie, a Samsung Open Source library. This vulnerability, stemming from an integer overflow or wraparound, could allow a local attacker with low privileges to cause a buffer overflow. Exploitation requires user interaction and may lead to a denial of service or other memory...

CVE-2026-59857

An out-of-bounds write vulnerability in Vim's spellsoundfoldsal function allows an attacker to corrupt memory and crash the editor Denial of Service by supplying a specially crafted word during spell sound-folding. Mitigation This vulnerability can be mitigated by preventing Vim from automaticall...

CVE-2026-12080

A flaw was found in the QEMU Guest Agent qga. A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use TOCTOU...

CVE-2026-15574

A flaw was found in the vllm-orchestrator-gateway component. The system's production binary logs all incoming authorization headers and full chat payloads, which may contain personally identifiable information PII and secrets, to persistent logs. This sensitive data, including bearer tokens and...

CVE-2026-58252

A flaw was found in NATS Server. An authenticated user could bypass configured access restrictions and receive messages on subjects that were explicitly denied. This occurs when a wildcard subscription overlaps with a wildcard deny rule but is not a direct subset, or when queue subscriptions...

CVE-2026-58251

A flaw was found in NATS Server, a high-performance messaging system. An authenticated user with specific permissions could bypass security rules designed to deny access to certain message subjects. This bypass occurs when a queue subscription is used, allowing the user to access information that...

CVE-2026-58208

A flaw was found in NATS Server. An unauthenticated client with access to the WebSocket listener could exploit a vulnerability where requests for the MQTT-over-WebSocket path were incorrectly routed into MQTT handling, even when MQTT was not configured. This allowed the client to access...

CVE-2026-58253

A flaw was found in NATS Server. When the noauthuser configuration is enabled, a parser optimization intended for client connections can inadvertently apply to route or leafnode listeners. This allows an unauthenticated attacker on an adjacent network to bypass inter-server authentication...

CVE-2026-14683

A flaw was found in HdrHistogram. A local attacker can exploit a vulnerability in the decodeFromCompressedByteBuffer function by manipulating the lengthOfCompressedContents argument. This manipulation leads to uncontrolled memory allocation, which can result in a Denial of Service DoS condition,...