CVE-2026-99005

A flaw was found in the Linux kernel's Intel i915 graphics driver. A race condition during power management state transitions allows background tasks to access hardware registers without holding the required power management locks after the graphics device has entered a parked state. A local user...

CVE-2026-118179

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Clicking a news: or snews: link that referenced a message-ID made Thunderbird connect, without asking, to the host and port given in the link, even if it was not a configured news server. Li...

CVE-2026-118180

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: When logging in to a Matrix account, Thunderbird used the homeserver address provided in the server's login response without validating it. A malicious or compromised homeserver could provid...

CVE-2026-118177

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: When looking for calendars in a directory on a server, during account setup or when adding a new network calendar, Thunderbird accepted calendar locations pointing to other servers, local...

CVE-2026-118176

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Thunderbird's check that prevents mailbox: URLs from accessing files on remote Windows network shares could be bypassed using extended-length UNC paths. Displaying a specially crafted email...

CVE-2026-118175

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: When replying to, forwarding, or editing a crafted email message as new, Thunderbird could embed parts of a different message stored in the same folder into the message being composed, witho...

CVE-2026-117688

A flaw was found in the client registration component of Keycloak, an open-source identity and access management solution. When a vault provider is used to store sensitive information, an authenticated client owner can use a specially crafted reference to trick the system into revealing secrets. ...

CVE-2026-117627

A flaw was found in the JWT Authorization Grant implementation of the keycloak-services component. When an OIDC or Google identity provider is configured with specific login restrictions, such as claim filtering, these checks are correctly applied during standard browser logins but are skipped...

CVE-2026-118174

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment's content to offer importing the key. A sender could mark the attachment as...

CVE-2026-118030

A flaw was found in the HOTP authentication mechanism of the keycloak-services component, which provides identity and access management services. The issue occurs because the system validates a one-time password and updates its internal counter in two separate steps without proper locking. An...

CVE-2026-117859

A flaw was found in the Pushed Authorization Request PAR implementation of the keycloak-services component. The issue occurs when an authentication flow is restarted, which incorrectly clears the internal markers used to track PAR consumption while leaving the request active. This allows an...

CVE-2026-117557

A flaw was found in SDLimage. By tricking a user or application into processing a specially crafted Interleaved Bitmap ILBM image file, an attacker can trigger an out-of-bounds read condition during image decoding. This can lead to a Denial of Service DoS by causing the application to crash, or...

CVE-2026-117555

A flaw was found in cimg. An integer overflow vulnerability in the BMP image loader when calculating row dimensions can trigger an out-of-bounds memory read. An attacker can exploit this flaw by supplying a specially crafted BMP image file to an application using the library, potentially causing ...

CVE-2026-117548

A NULL pointer dereference flaw was found in 389-ds-base. This flaw occurs when a ModifyDN rename operation uses an attribute's schema alias name such as "commonName" instead of its canonical name such as "cn" as the new relative distinguished name. An authenticated attacker with the ModifyDN...

CVE-2026-116695

A flaw was found in Crass. When parsing malformed URL tokens containing escaped backslashes, Crass incorrectly treats the closing parenthesis as escaped, retaining style declarations that web browsers interpret as active Cascading Style Sheets CSS. A remote attacker could supply crafted CSS to an...

CVE-2026-116773

A flaw was found in russh. An unbounded memory allocation issue allows a malicious Secure Shell SSH server to cause a Denial of Service DoS on connecting clients. By repeatedly sending crafted pre-authentication extension packets, the server forces the client to store an unlimited number of...

CVE-2026-116689

A flaw was found in follow-redirects, which can lead to information disclosure. The library improperly validates the sensitiveHeaders configuration option when handling header lists defined across different execution contexts, causing the list of protected headers to be discarded. Consequently,...

CVE-2026-116684

A flaw was found in the Model Context Protocol MCP Python SDK. This vulnerability allows a remote authenticated attacker to bypass authentication and gain unauthorized access to an MCP server by presenting a valid token issued for a different service. The issue occurs because server-side...

CVE-2026-116686

A flaw was found in mcp. Client sessions validate server-declared schema documents using a default resolver that automatically retrieves external network and local filesystem references. A malicious server can exploit this flaw to cause a Denial of Service DoS by stalling client sessions...

CVE-2026-116678

A flaw was found in Vaultwarden. When internal icon downloading is enabled, the server fails to properly validate secondary favicon web addresses extracted from untrusted pages against network access restrictions. A remote, unauthenticated attacker can exploit this vulnerability to cause...

CVE-2026-116674

A flaw was found in systeminformation. When processing network statistics on BSD-based systems, caller-controlled interface names are improperly handled during internal cache lookups. An attacker capable of supplying input to the network statistics function can trigger prototype pollution,...

CVE-2026-116632

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: A malicious web page could insert arbitrary text into the FaceTime call prompt shown by iOS, potentialy allowing it to display a phishing message inside system UI...

CVE-2026-114731

A flaw was found in Roundcube Webmail. This flaw allows a remote attacker to trigger a Denial of Service DoS by exhausting server memory. The application's stylesheet proxy fails to enforce size limits or read timeouts when retrieving external content. By directing the proxy to fetch an...

CVE-2026-114729

A flaw was found in Roundcube Webmail. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing Scalable Vector Graphics SVG animations with an unvalidated animation attribute. The application's HTML sanitizer fails to inspect this attribute for remote...

CVE-2026-114726

A flaw was found in Roundcube Webmail. This vulnerability allows a remote attacker to inject arbitrary email headers by sending an email containing encoded carriage return and line feed CRLF control characters within the sender display name. When an affected user bounces or resends the message, t...

CVE-2026-116590

A flaw was found in snappy-java. This vulnerability allows an attacker to cause a Denial of Service DoS by crashing the Java Virtual Machine JVM. The issue occurs because memory copying routines fail to validate array bounds and buffer lengths before passing them to native memory operations. By...

CVE-2026-116498

A missing authorization flaw was found in Kiali, where the namespace health, ztunnel pod log, and ztunnel configuration dump API endpoints returned data about namespaces the caller had no RBAC access to, reading ztunnel data with the Kiali ServiceAccount without checking the caller's permissions...

CVE-2026-116053

A flaw was found in mycli. A local attacker can execute arbitrary operating system commands by supplying crafted input that bypasses safety checks in the special command whitelist. This allows malicious commands to run with the permissions of the user running the application. Mitigation Avoid...

CVE-2026-115823

A flaw was found in Starman. The web server improperly sends message bodies for HTTP responses that should contain headers only, such as HEAD requests and certain status codes. A remote attacker can exploit this behavior over persistent connections to cause HTTP response desynchronization between...

CVE-2026-114728

A flaw was found in Roundcube Webmail. The HTML message sanitizer fails to properly normalize all valid CSS escape sequences when inspecting external resource attributes. A remote attacker can exploit this flaw by sending a crafted email that bypasses remote content blocking, causing external...

CVE-2026-115722

A flaw was found in RPly. The parser improperly validates property definitions in file headers, allowing invalid list types to trigger out-of-bounds function calls. An attacker could exploit this vulnerability by tricking a user into opening a specially crafted Polygon File Format PLY file...

CVE-2026-114719

A flaw was found in Roundcube Webmail. A remote attacker could conduct a Cross-Site Request Forgery CSRF attack to alter email classifications without user consent. By enticing an authenticated user into following a malicious link, the attacker exploits improper parameter handling in the markasju...

CVE-2026-114725

A flaw was found in Roundcube Webmail. The application fails to properly sanitize newline characters in specific email header fields, including References, In-Reply-To, Message-ID, and From parameters. A remote authenticated attacker can exploit this vulnerability to inject arbitrary headers into...

CVE-2026-114717

A flaw was found in roundcubemail. When forwarding an email as an attachment, the application uses the original message's subject line directly to construct the attachment name without properly sanitizing line breaks. A remote attacker can exploit this vulnerability by sending an email containing...

CVE-2026-114714

A flaw was found in Roundcube Webmail. When using the squirrelmailusercopy plugin with a file-based backend, the application constructs file paths from user login names without properly sanitizing path separators. An authenticated remote attacker can exploit this path traversal vulnerability by...

CVE-2026-114655

A flaw was found in libmongocrypt. The library constructs requests to external Key Management Service KMS providers without properly validating or encoding values sourced from key vault documents, provider configurations, or service responses. An attacker with write access to the key vault...

CVE-2026-112381

A flaw was found in Apache Traffic Server. A race condition can allow an unauthenticated remote attacker to cause a Denial of Service DoS by crashing the server. This vulnerability occurs when a client terminates a POST request connection while the server is processing a chunked origin response,...

CVE-2026-111817

A flaw was found in Apache Traffic Server. When configured to drop HTTP chunked trailers, the proxy incorrectly waits for data bytes that it has already discarded, stalling the transfer until the connection times out. A remote attacker can exploit this condition by sending chunked transfers,...

CVE-2026-98998

A flaw was found in the Linux kernel's TH1520 HDMI bridge driver. During device removal, the driver's teardown callback retrieves driver private data using an incorrect data structure type and passes an invalid pointer to the cleanup routine. A local privileged user could trigger this issue when...

CVE-2026-98997

A flaw was found in the Linux kernel's AMDGPU graphics driver. In the user queue implementation, the driver fails to verify whether a buffer object was designated for queue doorbells before placing it in the doorbell domain. A local user can exploit this vulnerability by submitting a shared memor...

CVE-2026-98994

A flaw was found in the Linux kernel. A local user could exploit a race condition in the statmount facility to cause a use-after-free condition, resulting in a kernel crash and Denial of Service DoS. When querying an unmounted filesystem mount via an open file descriptor, the kernel fails to...

CVE-2026-98995

A flaw was found in the Linux kernel. A local user can cause a denial of service DoS or potentially escalate privileges by triggering a use-after-free condition in the mount namespace subsystem. When moving file system mount points, the kernel fails to clear a reference pointer on the former pare...

CVE-2026-98992

A flaw was found in the Linux kernel. When performing a recursive bind mount on a lazily unmounted namespace or process file held open by a file descriptor, the kernel fails to verify that the mount tree is still active. A local user could exploit this vulnerability to duplicate and access...

CVE-2026-98993

A flaw was found in the Linux kernel's mount namespace subsystem. A local attacker can trigger an unmount flag inheritance issue when cloning a lazily unmounted mount that is kept open by a file descriptor. This improper flag inheritance leads to incorrect reference counting and a use-after-free...

CVE-2026-98991

A flaw was found in the Linux kernel. A local attacker can cause a Denial of Service DoS by triggering a use-after-free flaw, which occurs when the system accesses memory after it has been released. During certain unmount operations, the kernel fails to verify whether a filesystem mount is alread...

CVE-2026-95664

A flaw was found in the Apache Camel camel-aws2-s3 component. An attacker with permission to upload or name objects in an Amazon Simple Storage Service Amazon S3 bucket consumed by a Camel route can provide a crafted object key containing expression language syntax. When the component processes t...

CVE-2026-93236

A flaw was found in the Linux kernel's Meson video decoder driver. When processing video format negotiation requests with an unsupported format on the output queue, the driver improperly falls back to a format that may not be supported by the platform format table. This issue leads to a NULL...

CVE-2026-93224

A flaw was found in the Linux kernel. This vulnerability can lead to a Denial of Service DoS due to improper error handling during connection cleanup in the Remote Direct Memory Access RDMA server subsystem. When a connection accept operation fails before registration completes, the kernel...

CVE-2026-93223

A flaw was found in the Linux kernel's Tegra video driver, which can lead to a Denial of Service DoS. When parsing video input channels, the driver improperly drops an object reference during error handling without having previously acquired it. A local user could exploit this vulnerability by...

CVE-2026-93221

A flaw was found in the Linux kernel's NFS daemon nfsd. A race condition occurs when multiple internal processes concurrently access the graceended flag without proper synchronization. This can lead to memory corruption, including double-free vulnerabilities and attempts to read from freed memory...