CVE-2026-90815

A flaw was found in FFmpeg. An out-of-bounds read can occur in the Convolution Filter when processing a specially crafted file due to insufficient bounds checks. This issue can lead to an application crash, resulting in a denial of service. Mitigation Do not process untrusted files using the...

CVE-2026-91964

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server can exploit a heap-based buffer overflow vulnerability in the negosendnegotiationrequest function. By sending a specially crafted Server Redirection PDU message with an attacker-controlled LoadBalanceInfo field, the serve...

CVE-2026-91963

A flaw was found in FreeRDP. An uninitialized heap memory disclosure vulnerability exists in the urbdrc USB redirection channel. A malicious Remote Desktop Protocol RDP server can exploit this by inducing failing USB transfers, allowing it to read uninitialized heap memory from the client. This...

CVE-2026-91955

A flaw was found in FreeRDP. FreeRDP contains a flaw where it fails to validate client-supplied desktop dimensions during the Graphics Command Channel GCC negotiation. A remote attacker can exploit this by sending crafted Remote Desktop Protocol RDP packets with zero or oversized dimensions. This...

CVE-2026-91950

A flaw was found in FreeRDP, where an out-of-bounds read vulnerability exists in the rdpdrdumppacket function. This is due to a 32-bit unsigned integer wraparound during buffer bounds validation. A malicious RDP server can send a specially crafted RDPDR packet, bypassing security checks and causi...

CVE-2026-91948

A flaw was found in FreeRDP. An authenticated client can send specially crafted, oversized messages to the server when the CHANNELOPTIONSHOWPROTOCOL feature is active. This can cause a buffer underflow, leading to corruption of memory and potentially allowing an attacker to execute malicious code...

CVE-2026-91947

A flaw was found in FreeRDP server. This use-after-free vulnerability exists in the DRDYNVC parser, where a channel pointer is dereferenced after its synchronization lock has been released. An authenticated client can exploit this by racing AUDIN channel closure messages against DRDYNVC data...

CVE-2026-55774

A flaw was found in OpenBao, an open source identity-based secrets management system. An authenticated user with specific access to lease revocation functions could revoke a lease in a different namespace if the foreign lease identifier was known. This bypasses Access Control List ACL isolation,...

CVE-2026-55776

A flaw was found in OpenBao. An authenticated user with write access to the transit secrets engine could trigger a server crash by creating a key with specific asymmetric key types and a 'derived' parameter set to true. This vulnerability, caused by a double-unlock of a mutex, leads to a denial o...

CVE-2026-55775

A flaw was found in OpenBao, an identity-based secrets management system. An authenticated user with specific permissions on /sys/namespaces/root within a non-root namespace could exploit a vulnerability in the namespace path canonicalization process. This flaw allows the user to perform...

CVE-2026-55701

A flaw was found in the OpenTelemetry Collector Contrib's githubreceiver component. An unauthenticated attacker can bypass authentication mechanisms, including required headers and HMAC validation, when the 'Secret' field is empty. This allows the attacker to submit arbitrary webhook payloads,...

CVE-2026-55770

A flaw was found in OpenBao. When the LDAP authentication backend is configured, an attacker can manipulate a username with special characters to alter the LDAP search query. This allows the attacker to select a different directory entry, potentially gaining unauthorized access to secrets,...

CVE-2026-91991

A flaw was found in Tornado. An attacker can bypass security validation in the setcookie function by using capitalized or legacy keyword arguments. This allows the attacker to inject arbitrary cookie attributes, such as Domain or SameSite, and modify cookie security settings. The consequence is t...

CVE-2026-91986

A flaw was found in gix-transport. This vulnerability allows a remote attacker to inject control characters, specifically NUL, Carriage Return CR, and Line Feed LF bytes, into git-daemon connect requests by crafting malicious git URLs. This injection can lead to spoofing of virtual hosts or the...

CVE-2026-91990

A flaw was found in Tornado. This memory amplification vulnerability exists in the parsemultipartformdata function, where multipart data is processed before validating the maximum number of parts. A remote attacker can exploit this by sending specially crafted multipart requests with numerous...

CVE-2026-91992

A flaw was found in Tornado's CurlAsyncHTTPClient. This vulnerability occurs because pycurl handles are reused across requests without proper state clearing. A remote attacker can exploit this by issuing requests through the same client instance, leading to the unintended persistence of sensitive...

CVE-2026-85234

A flaw was found in tftp-hpa. When the in.tftpd remap engine processes an inverse remap rule that also aborts with a non-empty custom error message, it can pass invalid match offsets to the genmatchstring function. This leads to out-of-bounds read/write operations. A remote, unauthenticated...

CVE-2026-82677

A flaw was found in valkey-io valkey. A remote attacker could exploit a double free vulnerability in the moduleTimerHandler function within the Module Timer subsystem src/module.c. This flaw could lead to a denial of service. Mitigation Restrict access to high-privilege administrative users capab...

CVE-2024-58384

A flaw was found in Tornado's CurlAsyncHTTPClient component. This vulnerability, known as CRLF Carriage Return Line Feed injection, occurs because the client fails to properly reject carriage return and line feed characters in HTTP request headers. A remote attacker can exploit this by injecting...

CVE-2026-82631

A flaw was found in Valkey. A use-after-free vulnerability exists within the handleClientsBlockedOnKey function of the Blocked-on-keys Subsystem. A remote attacker could exploit this flaw, leading to a denial of service. The complexity of exploiting this vulnerability is high...

CVE-2026-79699

A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header e.g. victim/.wh. can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or...

CVE-2026-79705

A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not...

CVE-2026-45765

A flaw was found in Suricata. DNP3 reassembly could buffer data without sufficient parser-level bounds. A remote attacker sending crafted DNP3 traffic may cause Suricata to consume excessive memory, potentially resulting in a denial of service. Mitigation Disable DNP3 parsing in the Suricata...

CVE-2026-45764

A type confusion flaw was found in Suricata's HTTP/2 protocol parsing engine. When processing network traffic, Suricata fails to properly validate protocol state transitions during HTTP/2 frame handling. A remote, unauthenticated attacker could exploit this vulnerability by transmitting specially...

CVE-2026-85013

A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a location visible to the victim's MODULEPATH. When the victim uses Bash completion for module or ml commands, the malicious module name, containing shell...

CVE-2026-55451

A flaw was found in gettext-converter. This vulnerability, known as prototype pollution, occurs in the js2i18next function when processing untrusted translation data. An attacker can craft malicious translation keys containing proto to modify the global Object.prototype. This can lead to a denial...

CVE-2026-59230

A flaw was found in Apache Camel's camel-mail component. The MimeMultipart data format copies MIME headers from an incoming message onto the Camel message when unmarshalling with headersInline=true, without applying a HeaderFilterStrategy. An attacker who can provide a crafted MIME message may...

CVE-2026-85595

An authentication bypass vulnerability was discovered in Traefik's digestAuth middleware. When an incoming request contains a username that does not exist in the configured authentication store, the application fails to reject the request and instead evaluates the credential against an empty stri...

CVE-2026-85484

A flaw was found in HTML::FormHandler for Perl. This vulnerability allows a remote attacker to inject malicious script into web pages. The component fails to properly escape option group labels and radio button labels when rendering them into HTML. This can lead to Cross-Site Scripting XSS attack...

CVE-2026-84968

A flaw was found in the MongoDB PHP driver. An unauthenticated attacker can exploit an out-of-bounds read vulnerability in the BSON decoding component by supplying specially crafted input. This can cause a small amount of adjacent process memory to be copied into an error message. Consequently,...

CVE-2026-84308

A flaw was found in phpseclib, a PHP secure communications library. This vulnerability arises from non-constant-time X25519 scalar multiplication, where data-dependent conditional modular reductions create observable timing differences or variations in libgmp call counts. A local attacker, capabl...

CVE-2026-87500

A flaw was found in ANGLE, a graphics engine used in Google Chrome. This vulnerability, caused by improper validation of an array index, allows a remote attacker to execute arbitrary code outside of the browser's security sandbox. Exploitation can occur when a user visits a specially crafted HTML...

CVE-2026-87494

A flaw was found in Google Chrome. This vulnerability, a use-after-free error, allows a remote attacker to execute arbitrary code outside of the browser's security sandbox. Exploitation occurs when a user is tricked into visiting a specially crafted HTML page, typically through social engineering...

CVE-2026-85625

A flaw was found in sift sift.js. The component's handling of query keys allows for prototype pollution, where an attacker can modify the Object.prototype.$where property. This manipulation can lead to arbitrary code execution when benign filter calls are made or when an untrusted query object...

CVE-2026-85485

A flaw was found in HTML::FormHandler for Perl. This vulnerability allows a remote attacker to inject malicious script code into web pages. The component fails to properly escape certain error messages when rendered into HTML. This can lead to a Cross-Site Scripting XSS vulnerability, enabling an...

CVE-2026-53659

A flaw was found in http4k, a functional toolkit for Kotlin HTTP applications. The ServerFilters.GZip and RequestFilters.GunZip functions, along with underlying Gzip request-body decompression, do not limit the decompressed size of incoming data. An unauthenticated client can exploit this by...

CVE-2026-19931

A flaw was found in libcurl. This vulnerability allows an attacker to reuse an HTTP connection set up for a given hostname using Negotiate authentication. When an initial request is made with empty credentials, a subsequent user's request can be sent over a previously authenticated connection...

CVE-2026-91926

A flaw was found in gss-ntlmssp. A memory leak occurs in the NTLM target-info parser when a crafted NTLM CHALLENGE message contains duplicated string-valued AVPAIR entries. The parser allocates memory for each string value but does not free the previous allocation when the same AVPAIR type appear...

CVE-2026-86818

A flaw was found in fast-uri, a Node.js URI parser. In versions 4.1.3 and 4.1.4, the mailto parser incorrectly handles percent-encoded query field names. This desynchronization between parsing and serialization allows an attacker to inject arbitrary recipients, subjects, or body content into mail...

CVE-2026-86472

A flaw was found in fast-uri, a dependency-free URI parser. This vulnerability occurs because the software folds the host to lowercase before percent-decoding it, allowing percent-encoded uppercase characters to bypass this normalization. A remote attacker could exploit this by crafting a malicio...

CVE-2026-91786

A flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon's declared dimensions against the actual data buffer size. A malicious or compromised remote search provider could exploit this by providing oversized icon...

CVE-2026-91840

A flaw was found in NetworkManager-vpnc. This vulnerability allows a local unprivileged user to escalate privileges to root. By injecting a newline character into the VPN username field, an attacker can manipulate the vpnc configuration to execute an arbitrary program with root privileges when th...

CVE-2026-82049

A flaw was found in Python's tarfile module. This module's data and tar extraction filters are vulnerable to specially crafted archives containing a hard link to a symbolic link. An attacker could exploit this by providing a malicious archive. This could lead to unauthorized modification of file...

CVE-2026-91826

A flaw was found in rLottie, an open-source library for rendering vector animations. An attacker could exploit a stack-based buffer overflow vulnerability by providing a specially crafted vector animation. This could lead to memory corruption, potentially causing a denial of service or other...

CVE-2026-91841

A flaw was found in NetworkManager-vpnc, a VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by injecting a newline character into the CA-File path. This manipulation allows the user to execute arbitrary commands as the root user, leading to local privilege...

CVE-2026-91838

A flaw was found in NetworkManager-sstp, the SSTP VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by embedding special characters, known as shell metacharacters, into VPN connection profile fields such as CA certificate or proxy settings. These unescaped...

CVE-2026-91839

A flaw was found in NetworkManager-fortisslvpn, the FortiSSLVPN plugin for NetworkManager. The nm-fortisslvpn-service improperly handles carriage-return/line-feed CR/LF characters in VPN connection profile credentials. A local unprivileged user can exploit this by crafting a malicious VPN profile...

CVE-2026-91837

A flaw was found in NetworkManager-iodine, the iodine VPN plugin for NetworkManager. A local unprivileged user can exploit a vulnerability in how the 'nameserver' setting is processed when establishing an iodine VPN connection. By embedding shell metacharacters special characters that can execute...

CVE-2026-53495

A flaw was found in containerd. When the Container Runtime Interface CRI plugin is enabled on Linux, repeated use of CRI ExecSync by exec probes or lifecycle hooks can cause goroutines to become indefinitely blocked. This leads to resource exhaustion and can terminate the containerd process, maki...

CVE-2026-75092

A privilege escalation flaw was found in the scanmysql actor of leapp-upgrade-el9toel10 provided by leapp-repository. During RHEL 9 to RHEL 10 upgrades, the actor runs: mysqld --validate-config --log-error-verbosity=2 directly as root in the Leapp actor context, bypassing the packaged MySQL syste...