CVE-2026-85594

A flaw was found in Traefik. The software fails to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation within the Kubernetes Ingress provider. This vulnerability allows a namespace-limited tenant, even if excluded from the...

CVE-2026-87933

A flaw was found in DaveGamble cJSON. The cJSONUtilsMergePatch function in cJSONUtils.c is vulnerable to a use-after-free error. A remote attacker could exploit this memory corruption vulnerability, potentially leading to information disclosure, data corruption, or denial of service...

CVE-2026-85596

A flaw was found in Traefik. This vulnerability allows a remote attacker to bypass authentication, gaining unauthorized access to protected routes. This occurs due to a conflict in how Traefik handles Transport Layer Security TLS options when specific Kubernetes Ingress objects are configured. Th...

CVE-2026-67309

A flaw was found in Traefik. This path traversal vulnerability exists in the Kubernetes Ingress NGINX provider's RewriteTarget middleware. A remote attacker can craft a special request that uses dot-segment traversal to bypass authentication mechanisms like BasicAuth, DigestAuth, or ForwardAuth...

CVE-2026-89298

A flaw was found in the Dynamic Client Registration service of Keycloak, an open-source identity and access management solution. The issue occurs when a user with the view-clients role accesses the client registration endpoint to retrieve client details. Due to a failure to mask sensitive...

CVE-2026-86321

A flaw was found in jackson-coreutils. This server-side request forgery SSRF vulnerability occurs when applications use the JsonLoader.fromURL function with untrusted input. A remote attacker can exploit this to induce the server to make arbitrary requests. This could lead to unauthorized...

CVE-2026-45761

A flaw was found in Suricata, a network Intrusion Detection System IDS, Intrusion Prevention System IPS, and Network Security Monitoring NSM engine. A local attacker, by providing a specially crafted rule with mixed-case frame syntax, could trigger a heap buffer overflow. This vulnerability occur...

CVE-2026-45752

A flaw was found in Suricata, a network Intrusion Detection System. When specific detection transforms are chained, the decompress transform pipeline can attempt to read from an inspection buffer after it has been reallocated and freed. This use-after-free vulnerability can be triggered by a...

CVE-2026-45751

A flaw was found in Suricata, a network Intrusion Detection System. A remote attacker could exploit a use-after-free vulnerability in the inspection-buffer helper. This occurs when a chained transform reallocates a buffer, leaving an inspection pointer referencing freed memory. This issue,...

CVE-2026-87776

A flaw was found in the compression Node.js and Express middleware. A remote unauthenticated attacker can exploit this vulnerability by repeatedly initiating and then prematurely aborting connections while compressed responses are being sent. This action prevents the zlib stream, used for...

CVE-2026-86145

A flaw was found in PCRE2. An out-of-bounds write vulnerability exists in the pcre2dfamatch function due to improper size checking when reusing cached workspace blocks. A remote attacker could exploit this by providing a specially crafted regular expression or a recursive pattern in conjunction...

CVE-2026-46387

A flaw was found in Suricata, a network Intrusion Detection System, Intrusion Prevention System, and Network Security Monitoring engine. A remote attacker could send a specially crafted HTTP/2 DATA payload with a high compression ratio. This could cause Suricata's HTTP/2 decompression path to...

CVE-2026-45770

A flaw was found in Suricata, a network Intrusion Detection System. A specially crafted Lua rule that registers an excessive number of flow variables can corrupt the Lua detection state. This could allow an attacker to bypass Suricata's restricted Lua sandbox, potentially leading to unauthorized...

CVE-2026-45762

A flaw was found in Suricata, a network Intrusion Detection System. The IP defragmentation tracker lookup did not properly verify the IP address family of incoming packets. A remote attacker could send specially crafted fragmented IPv4/IPv6 traffic, causing an IPv6 fragment to be incorrectly...

CVE-2026-45759

A flaw was found in Suricata, a network Intrusion Detection System IDS, Intrusion Prevention System IPS, and Network Security Monitoring NSM engine. A remote attacker could exploit this vulnerability by sending crafted HTTP traffic with large Content-Disposition headers. This could lead to...

CVE-2026-45747

A flaw was found in Suricata, a network Intrusion Detection System. A remote attacker could exploit a NULL dereference vulnerability in the Lua TLS certificate information helper. This vulnerability occurs when a Lua script attempts to retrieve certificate details from TLS Transport Layer Securit...

CVE-2026-76922

A flaw was found in Wireshark. A local attacker could exploit a crash in the Bluetooth BR/EDR FHS protocol dissector, requiring user interaction. This vulnerability could lead to a denial of service, making the application unavailable to users. Mitigation To mitigate this issue, users should avoi...

CVE-2026-76920

A flaw was found in Wireshark. This vulnerability, located in the 3gpp phone log file parser, could allow a local attacker to trigger a crash by enticing a user to open a specially crafted log file. This could lead to a Denial of Service DoS. Mitigation To mitigate this issue, users should avoid...

CVE-2026-14978

A flaw was found in go-slug. A local attacker could bypass .terraformignore exclusions, leading to sensitive files being included in Terraform slug uploads. This is caused by improper handling of Unicode normalization during path matching. Mitigation Upgrade to go-slug 0.18.3 or later. Where an...

CVE-2026-88045

A flaw was found in rclone. A remote attacker can exploit a memory exhaustion vulnerability in the S3 streamed multipart path. By manipulating the Content-Length or X-Amz-Decoded-Content-Length headers, an attacker can cause the application to reserve excessive memory without sending the declared...

CVE-2026-72099

A flaw was found in the dm-integrity component of the Linux kernel. This vulnerability arises from an error where a hashoffset variable is incremented twice, leading to incorrect memory access. A local attacker could exploit this issue to trigger a system crash, resulting in a denial of service...

CVE-2026-49837

A flaw was found in GoBGP, an open-source Border Gateway Protocol BGP implementation. A remote attacker could send a specially crafted BGP OPEN message, causing the BGP OPEN capability parser to misinterpret data. This issue arises because the parser may read capability values beyond their declar...

CVE-2026-77159

A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost function. The function uses a path-based chown on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd running as...

CVE-2026-87654

A flaw was found in Chromium's ANGLE component. A remote attacker could exploit a buffer overflow vulnerability by enticing a user to visit a specially crafted HTML page. This could lead to the execution of arbitrary code outside the browser's security sandbox, potentially compromising the affect...

CVE-2026-89046

A flaw was found in zstd-jni. This out-of-bounds read vulnerability in the Zstd.getFrameContentSize function occurs because it fails to validate negative srcPosition arguments. A remote attacker can supply negative offset values, bypassing bounds checks and accessing the native frame-header parse...

CVE-2026-87650

A flaw was found in Google Chrome's WebGL component. A remote attacker could exploit an out-of-bounds read vulnerability by tricking a user into visiting a specially crafted HTML page. This could potentially allow the attacker to execute arbitrary code outside of the browser's security sandbox,...

CVE-2026-87646

A flaw was found in Google Chrome's Web Authentication component. A remote attacker could exploit a use-after-free vulnerability by tricking a user into visiting a specially crafted HTML page. This could lead to the execution of arbitrary code outside of the browser's security sandbox...

CVE-2026-87643

A flaw was found in Google Chrome. An integer overflow vulnerability exists in the Graphics Processing Unit GPU. A remote attacker could exploit this by enticing a user to visit a specially crafted HTML page. This could potentially lead to arbitrary code execution outside of the browser's securit...

CVE-2026-87637

An use after free flaw was found in the Extensions component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=534863145...

CVE-2026-87638

A flaw was found in Google Chrome's Media component. A remote attacker could exploit an out-of-bounds write vulnerability by enticing a user to visit a specially crafted HTML page. This could potentially allow the attacker to execute arbitrary code outside of the browser's security sandbox...

CVE-2026-87621

A flaw was found in ANGLE, a component of Google Chrome. This out-of-bounds write vulnerability allows a remote attacker to potentially execute arbitrary code. By tricking a user into visiting a specially crafted HTML page, an attacker could bypass the browser's security sandbox and execute...

CVE-2026-87613

A flaw was found in Chromium Extensions. A remote attacker could exploit an incorrect reference resolution vulnerability by sending crafted network traffic. This could potentially allow the attacker to execute arbitrary code outside of the browser's security sandbox...

CVE-2026-87628

An use after free flaw was found in the Cast component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=553770012...

CVE-2026-87607

A flaw was found in Google Chrome. This vulnerability, known as a 'use after free' error, occurs when a program attempts to use memory after it has been deallocated. This can allow a remote attacker to potentially execute arbitrary code outside the browser's security sandbox when a user visits a...

CVE-2026-87578

An use after free flaw was found in the Receiver component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=517371367...

CVE-2026-87581

An use after free flaw was found in the Payments component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=553129531...

CVE-2026-87859

A flaw was found in morgan, an HTTP request logger middleware for Node.js. An unauthenticated remote attacker can exploit this vulnerability by injecting an unescaped double quote into a log field they control, such as the User-Agent or Referer header. This causes the log field to close...

CVE-2026-76927

A flaw was found in Wireshark. A remote attacker could exploit a vulnerability in the H.245 protocol dissector. By crafting and sending malformed H.245 protocol data, an attacker could cause the Wireshark application to crash when a user processes this untrusted network data, leading to a denial ...

CVE-2026-87569

A flaw was found in Google Chrome. Missing authorization in the Views component allows a remote attacker, leveraging social engineering, to bypass system access restrictions. This can be achieved by enticing a user to open a specially crafted HTML page...

CVE-2026-87558

An use after free flaw was found in the Payments component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=553128689...

CVE-2026-87548

A flaw was found in the Installer component of Google Chrome. A remote attacker could exploit this vulnerability by enticing a user to visit a specially crafted HTML page. This improper state validation could allow the attacker to bypass system access restrictions, potentially leading to...

CVE-2026-87528

A type confusion flaw was found in the Rust component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=539569491...

CVE-2026-87526

A flaw was found in Chromium. A remote attacker leveraging social engineering could exploit a use-after-free vulnerability in the Passwords component. This could potentially allow the attacker to execute arbitrary code outside the sandbox via user interface interaction...

CVE-2026-87527

A flaw was found in the WebGL component of Chromium-based browsers. This buffer overflow vulnerability allows a remote attacker to execute arbitrary code outside of the browser's security sandbox. This can be triggered by a specially crafted HTML page, potentially leading to a complete compromise...

CVE-2026-87520

A flaw was found in Dawn, a component of Google Chrome. This use-after-free vulnerability allows a remote attacker to execute arbitrary code outside the sandbox. Exploitation occurs when a user visits a specially crafted HTML page. This could lead to a complete compromise of the affected system...

CVE-2026-87512

A flaw was found in chromium-browser. A use-after-free vulnerability in ANGLE allows a remote attacker to execute arbitrary code outside the sandbox. This can be exploited by enticing a user to visit a specially crafted HTML page, leading to a complete compromise of the affected system...

CVE-2026-87504

A flaw was found in Google Chrome. This use-after-free vulnerability allows a remote attacker to execute arbitrary code outside the browser's security sandbox. This exploitation occurs when a user is persuaded through social engineering to install a specially crafted Chrome extension...

CVE-2026-87492

A flaw was found in DevTools in Google Chrome. This incorrect authorization vulnerability allows a remote attacker to potentially execute arbitrary code outside the browser's security sandbox. The exploitation occurs when a user interacts with a specially crafted HTML page, leading to a severe...

CVE-2026-87488

An use after free flaw was found in the WebGL component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=546252753...

CVE-2026-87474

A flaw was found in Google Chrome. A use-after-free vulnerability in the Payments component could allow a remote attacker to execute arbitrary code outside of the browser's security sandbox. This exploitation is possible by enticing a user to visit a specially crafted HTML page...