CVE-2026-75131

A flaw was found in NetworkManager-l2tp. This privilege escalation vulnerability allows local users, who have permissions to create VPN connections, to execute arbitrary code as root. This is achieved by injecting options into the pppd Point-to-Point Protocol Daemon through a specially crafted VP...

CVE-2026-84474

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The provisioning-callback secret hostconfigkey is exposed to users holding only the read-level viewjobtemplate permission -- both in the job template API representation and in the activity stream -- and the...

CVE-2026-84475

automation-controller: InventorySource.sourcevars lacks preventsearch, enabling zero-privilege cross-tenant extraction of inline inventory-plugin credentials via the credentialtypes FieldLookupBackend count-oracle...

CVE-2026-54280

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. A remote attacker could exploit this vulnerability by disconnecting during a payload write, leading to improper closure of resources. This can cause temporary resource starvation, resulting in a Denial of Service DoS...

CVE-2026-6669

A flaw was found in PgBouncer. A malicious or compromised PostgreSQL backend can exploit a missing upper bound on the key derivation iteration count during SCRAM Salted Challenge Response Authentication Mechanism authentication. This can lead to uncontrolled CPU consumption in PgBouncer,...

CVE-2026-19888

A flaw was found in PgBouncer. Missing validation of a mandatory attribute in the SCRAM client-final-message parser allows an unauthenticated remote attacker to crash the process. By sending a malformed message, the parser can report success while a required value remains unset, leading to a NULL...

CVE-2026-84486

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Four debug views that trigger the internal task, dependency, and workflow schedulers are configured to allow any user including unauthenticated clients and are routed in production builds because their URL include i...

CVE-2026-96546

A one-byte out-of-bounds heap read flaw was found in GIMP's uncompressed DDS image loader. When a user opens an uncompressed DDS image, the file-dds plug-in performs an unconditional one-byte look-ahead after processing the final pixel. This may cause the plug-in to crash if the byte immediately...

CVE-2026-71465

RunAdHocCommand.buildargs appends limit as bare positional args.appendlimit instead of using args.extend'-l', limit like RunJob. A limit beginning with - is parsed as an ansible CLI option. Currently limited to short-circuit flags --version, --help since injected element displaces required patter...

CVE-2026-71464

LaunchConfigurationBaseSerializer.scmbranch has no validatescmbranch leading-dash check, unlike Project/JobTemplate/JobLaunch serializers. Schedule and WFJT Node accept --upload-pack=/bin/id as scmbranch. Currently blocked at runtime by jobs.py:1502 ValueError check defense-in-depth, but the API...

CVE-2026-71463

Notification template Jinja AST whitelist only inspects static Getattr nodes. Dynamic subscripts job'job'+'env' and % if job.id 100 % conditional gating bypass both the AST check and the test-render stub has small job.id. At runtime, the gated branch executes and exceptions write full tracebacks...

CVE-2026-96807

A flaw was found in Flatpak. A malicious sandboxed application can manipulate a symlink, causing the regenerateldcache function to write files to an unintended location. While the attacker cannot control the content or filenames, this vulnerability could lead to a low impact on system integrity o...

CVE-2026-96808

A flaw was found in Flatpak. A malicious local user in an active local session could exploit a symlink traversal vulnerability in the revokefs writer. This flaw allows an attacker to modify files belonging to a different revokefs session after they have been validated. Consequently, an attacker...

CVE-2026-96675

A flaw was found in alsa-lib. This denial of service vulnerability exists in the multi PCM plugin due to a failure to validate sparse binding indices before array access. A local attacker can supply a malicious ALSA configuration file with sparse bindings. This can trigger an out-of-bounds array...

CVE-2026-96674

A flaw was found in alsa-lib. This vulnerability involves an integer overflow in the src/topology/ctl.c component, where combined topology element sizes are computed using 32-bit arithmetic. This allows an attacker to supply specially crafted topology files that can cause size calculations to wra...

CVE-2026-71462

StringListPathField.tointernalvalue calls os.path.exists on unbounded user-supplied paths. 200 vs 400 response reveals existence of arbitrary absolute paths on the controller-web pod. Tenant superuser can confirm /etc/tower/SECRETKEY, k8s service-account token, receptor sockets, ConfigMap mount...

CVE-2026-63275

A flaw was found in LibreOffice. When a user opens a specially crafted document containing embedded CFF fonts, a stack-based buffer overflow can occur when reading the hints of a glyph due to improper bounds checking. This issue can cause memory corruption, resulting in an application crash...

CVE-2026-76648

CopyAPIView awx/awx/api/generics.py:873 sets permissionclasses = IsAuthenticated,, so DRF's getobject performs no object-level RBAC. The get handler lines 988–991 explicitly guards with request.user.canaccessobj.class, 'read', obj — but post lines 1001–1010 does not. POST only checks:...

CVE-2026-96545

An out-of-bounds heap read flaw was found in GIMP's TIM image loader. When a user opens a crafted 4bpp TIM image that causes promotion to an RGBA layer, the file-tim plug-in allocates an undersized row buffer but processes it using the larger RGBA row size. This can copy adjacent heap contents in...

CVE-2026-96544

An integer overflow flaw was found in GIMP's PVR image loader. When a user opens a crafted PVR image, unchecked multiplication of attacker-controlled dimensions in pvrdecoderect can result in an undersized heap allocation followed by an out-of-bounds read. This may disclose adjacent heap contents...

CVE-2026-96541

A denial-of-service flaw was found in gnome-remote-desktop. An unauthenticated remote attacker can open RDP connections without completing the handshake and retain the connection-throttling slots indefinitely because no pre-authentication handshake deadline is enforced. By exhausting the global...

CVE-2026-71461

HostList.list catches bare Exception and returns stre verbatim. Via hostfilter, any authenticated user triggers Django FieldError leaking complete Host model relation graph including internal reverse accessors or PostgreSQL DataError leaking raw database error strings. Two primitives:...

CVE-2026-71458

URLModificationMiddleware resolves named-URL lookups against unfiltered Model.objects before RBAC. The 403→404 shim only rewrites 403 responses, leaving the pk=0 miss path with a different 404 detail string. Differential "Not found." vs "No matches..." reveals whether a named resource org,...

CVE-2026-71460

/api/v2/config/ is protected only by IsAuthenticated. licenseinfo accountnumber, subscriptionid, poolid, sku, supportlevel, instance counts returned to any authenticated user. The superuser/auditor gate only covers projectbasedir/projectlocalpaths/customvirtualenvs, not licenseinfo. Enables socia...

CVE-2026-71459

JobJobEventsChildrenSummary view has no model/parentmodel. ModelAccessPermission.checkgetpermissions falls through returns True for any authenticated user. The view uses raw getobjector404Job, pk without DRF object-level permission check. Zero-privilege user reads event tree structure,...

CVE-2026-63276

A flaw was found in LibreOffice. When a user exports a document with crafted embedded fonts to PDF, a stack-based buffer overflow can occur during the conversion of CFF fonts to Type 1 fonts due to improper bounds checking. This issue can cause memory corruption, resulting in an application crash...

CVE-2026-6668

A flaw was found in PgBouncer. An unauthenticated remote attacker can exploit an integer overflow in the packet buffer growth logic by providing sufficiently large input. This causes the buffer size computation to overflow, leading to an infinite loop. As a result, a CPU core is saturated, and al...

CVE-2026-71300

A flaw was found in Apache Camel Atmosphere Websocket. This improper input validation vulnerability allows a remote attacker to inject specific Exchange headers, such as websocket.connectionKey.list, which are not properly filtered. By manipulating these headers, an attacker can take control of t...

CVE-2026-65583

A flaw was found in Apache CXF. The OpenID Connect OIDC relying-party token validation in Apache CXF could accept specially crafted self-issued ID tokens. This bypasses necessary claim checks, such as issuer, subject, audience, and time, leading to an authentication bypass. This vulnerability...

CVE-2026-64958

A flaw was found in Apache CXF. This vulnerability allows a remote attacker to perform a denial of service DoS attack by sending a message with an excessive number of attachment headers. This can lead to the affected system becoming unresponsive or unavailable...

CVE-2026-61899

A flaw was found in Apache Tapestry tapestry-core. A remote attacker could exploit this vulnerability by manipulating URLs to download sensitive classpath assets. This could lead to unauthorized access to internal application resources...

CVE-2026-18165

A flaw was found in @fastify/oauth2, an OAuth 2.0 plugin for Fastify. This vulnerability allows a remote attacker to perform a Login Cross-Site Request Forgery CSRF attack. By planting predictable OAuth state and code verifier cookies, an attacker can trick a victim's browser into completing an...

CVE-2026-88840

BusyBox TLS getclienthello reads past the end of the input buffer when parsing a truncated ClientHello message. Mitigation Do not use BusyBox sslserver in production deployments. Upstream should add a bounds check to verify len 0 before reading the compression-methods length byte...

CVE-2026-88839

BusyBox passwd/group tokenize references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers. Mitigation Ensure /etc/group and /etc/passwd are writable only by root and protected by mandatory access controls. Monitor these files for unauthorized modifications...

CVE-2026-88837

BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check. Mitigation Do not use BusyBox httpd for password-protected resources. If it must be used, configure authentication with SHA-512 $6$ hashes, which are correctly detected...

CVE-2026-88835

BusyBox dpkg readpackagefield steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read. Mitigation Do not use the BusyBox dpkg applet to process untrusted .deb packages. Use the full dpkg implementation if Debian package handling is needed...

CVE-2026-88831

BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients. Mitigation Audit all BusyBox httpd configuration files for syntactically valid CIDR prefix lengths. Implement network-level access controls...

CVE-2026-86319

A flaw was found in java-json-tools json-patch. A remote attacker can exploit a vulnerability in the JsonPatch.apply function within the Patch Operation Handler component. By manipulating input, an attacker can cause excessive resource consumption, leading to a Denial of Service DoS condition...

CVE-2026-85718

A flaw was found in AsyncHttpClient. When configured with connection limits, the library can leak a connection permit if a Transport Layer Security TLS handshake fails before completion. This permit leak can lead to resource exhaustion, allowing a remote attacker to cause a denial of service by...

CVE-2026-86512

A flaw was found in java-json-tools json-patch. This vulnerability, located in the CopyOperation.apply and MoveOperation.apply functions, allows for improper access controls. A remote attacker could exploit this to potentially perform unauthorized operations, leading to impacts on confidentiality...

CVE-2026-47321

A flaw was found in Apache MINA's CompressionFilter class. A remote attacker could exploit this vulnerability by sending specially crafted compressed data. The CompressionFilter does not properly limit the size of decompressed data, which can lead to an uncontrolled increase in memory usage. This...

CVE-2026-75432

A flaw was found in yaml-cpp. A remote attacker could exploit this vulnerability by manipulating the scanner component's handling of indentation, leading to the disclosure of sensitive information...

CVE-2026-91866

A flaw was found in Neethi. A remote attacker could exploit this vulnerability by providing specially crafted WS-Policy documents. This could force Neethi's policy-intersection to perform an exponential amount of work, leading to a denial of service DoS by consuming excessive CPU resources...

CVE-2026-88832

BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images. Mitigation Avoid processing untrusted filesystem images with BusyBox blkid or findfs. Use the util-linux versions of these utilities...

CVE-2026-88830

A unit confusion in BusyBox TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted ClientKeyExchange message. Mitigation Do not use the BusyBox sslserver applet in production environments. Use a well-maintained TLS implementation such...

CVE-2026-87908

A flaw was found in multiparty, a Node.js library for parsing multipart/form-data request bodies. The parser does not properly limit the memory used when accumulating headers of a single multipart part. An unauthenticated attacker can exploit this by sending a request with a large volume of heade...

CVE-2026-85721

A flaw was found in the AsyncHttpClient AHC library. A remote attacker, by sending a specially crafted, small compressed HTTP response, could exploit a vulnerability in the automatic response decompression mechanism. This flaw, caused by the lack of a cumulative output-size limit, allows the...

CVE-2026-75516

A flaw was found in the RabbitMQ Java client. A malicious AMQP Advanced Message Queuing Protocol server, or a man-in-the-middle attacker, can modify connection parameters and inject oversized frames. This can cause the client to allocate a large amount of memory, leading to memory exhaustion and...

CVE-2026-72903

A flaw was found in Tabby, a terminal emulator. A remote attacker, operating a malicious SFTP server, could exploit a path traversal vulnerability. This occurs when the server returns a specially crafted filename containing backslashes, which are then misinterpreted by Tabby's Windows-native path...

CVE-2026-69219

A flaw was found in the RabbitMQ Java client library. A malicious AMQP Advanced Message Queuing Protocol peer can exploit this by sending a specially crafted message during the pre-authentication phase. This message can cause the client to allocate an excessively large amount of memory, leading t...