CVE-2026-84975

A flaw was found in PJSIP, a multimedia communication library, specifically within its OpenSSL and GnuTLS Transport Layer Security TLS backends. This vulnerability allows a remote attacker to bypass server identity verification by using a specially crafted TLS certificate containing an embedded...

CVE-2026-54633

A flaw was found in PoDoFo, a C++ PDF manipulation library. Processing a specially crafted PDF file containing an Indexed color-space image can lead to a heap out-of-bounds read. This vulnerability occurs in the PdfColorSpaceFilterIndexed::FetchScanLine function due to insufficient validation of...

CVE-2026-77396

A flaw was found in PJSIP. A heap buffer overflow vulnerability exists in the AVI Audio Video Interleave parser. A remote attacker could exploit this by providing a specially crafted AVI file. When an application processes this file, it can lead to memory corruption, potentially allowing the...

CVE-2026-83603

A flaw was found in Netdata. The ndsudo helper command, which operates with root privileges, can be exploited by a low-privileged Netdata service account. This account can direct the root fail2ban-client to a malicious UNIX socket. Consequently, attacker-controlled code can be executed with root...

CVE-2026-71543

A flaw was found in OpenBao, an open-source identity-based secrets management system. Templated Access Control List ACL, Public Key Infrastructure PKI, and Secure Shell SSH policies could substitute attacker-controlled identity data without properly rejecting syntax-significant characters. This...

CVE-2026-48977

A flaw was found in OpenSlide, a C library for reading whole slide image files. A remote attacker could exploit a vulnerability in the parselevel0xml function by providing a specially crafted Ventana BIF file with nonpositive row or column tile counts. This manipulation leads to attacker-controll...

CVE-2026-62943

A flaw was found in btrbk. btrbk's sshfilterbtrbk.sh script, used for creating snapshots and remote backups of Btrfs subvolumes, constructs an allowlist with an incomplete command match. This allows a user, restricted through an authorizedkeys forced command, to append additional commands after a...

CVE-2026-54634

A flaw was found in Hamlib, a library for controlling ham radio equipment. A remote, unauthenticated attacker could exploit a vulnerability in the rigctld sendraw command. This flaw involves writing data beyond the intended memory boundary stack out-of-bounds write, which could cause the daemon t...

CVE-2026-53940

A flaw was found in Conda, a system-level binary package and environment manager. An unvalidated entry-point command in a noarch:python package's metadata allows a malicious package to use path traversal. This enables writing files outside the intended installation directory or overwriting existi...

CVE-2026-77164

A flaw was found in Nextcloud. An unauthenticated remote attacker can exploit a Server-Side Request Forgery SSRF vulnerability in the Circles component. By sending a specially crafted request to the public endpoints, the attacker can force the server to make GET requests to internal network...

CVE-2026-87902

A flaw was found in WordPress. An unauthenticated attacker can exploit a vulnerability in the getpagetemplate function's page-template resolution. This allows the attacker to include a chosen readable local PHP file from outside the active theme directories. If specific server and active theme...

CVE-2026-95814

A flaw was found in Vaultwarden. This vulnerability allows revoked and not-yet-confirmed organization members to bypass authorization checks. By exploiting missing status filters in specific access-restriction queries, these unauthorized members can retain read, write, delete, and attachment acce...

CVE-2026-93987

A flaw was found in rclone. The rclone serve docker volume plugin contains a path traversal vulnerability. A highly privileged attacker, by submitting a crafted Docker VolumeDriver.Create request with a malicious volume name, can cause the rclone plugin process to create a directory and mount a...

CVE-2026-79079

A flaw was found in CrossWire Xiphos. A local attacker could exploit this vulnerability by manipulating specific components related to URL handling and menu popups. This could lead to arbitrary code execution on the affected system...

CVE-2026-91018

A flaw was found in lwIP Lightweight IP, a widely used open-source TCP/IP stack. This double free vulnerability allows an adjacent network attacker to potentially execute arbitrary code, corrupt memory, or cause a denial of service DoS on the affected system. The most severe impact is the...

CVE-2026-93986

A flaw was found in rclone. This path traversal vulnerability allows a remote attacker to craft special names in server and third-party listing responses. These crafted names, containing directory traversal sequences, could potentially enable writing outside the intended destination directory...

CVE-2026-81884

A flaw was found in radare2. A remote attacker could exploit a heap out-of-bounds read vulnerability in the Mach-O LCDATAINCODE parser. This occurs when opening a specially crafted Mach-O file with the non-default bin.verbose option enabled, leading to a read beyond the allocated buffer. This...

CVE-2026-84449

A flaw was found in libheif, a HEIF and AVIF file format decoder and encoder. An integer overflow can occur when processing extremely large RGB images, specifically during the calculation of image-plane strides. This overflow leads to an invalid memory access during the RGB-to-YCbCr color...

CVE-2026-81882

A flaw was found in radare2. The binary property-list Unicode parser did not properly terminate strings, leading to an underallocation of memory. A local attacker could exploit this by providing specially crafted binary property-list data and executing specific commands pFB or pFBj. This could...

CVE-2026-76805

A flaw was found in Nuclei, a vulnerability scanner. A malicious scan target can exploit a vulnerability in the Dynamic Application Security Testing DAST/fuzz mode where response content is evaluated twice and reinterpreted as template syntax. This allows the scan target to disclose sensitive...

CVE-2026-76804

A flaw was found in Nuclei, a vulnerability scanner. An untrusted workflow, which is a set of instructions for the scanner, could bypass a security control designed to restrict file access. This bypass allows the workflow to load templates that read local files from the scanner host, even when fi...

CVE-2026-76802

A flaw was found in Nuclei, a vulnerability scanner. The Dynamic Application Security Testing DAST template loading process fails to enforce signature checks for code templates. This allows an attacker to craft a malicious template containing unsigned code, which, when processed by an operator...

CVE-2026-61570

A flaw was found in MPXJ. The MerlinReader component, when processing XML from a Merlin project SQLite database, is vulnerable to an XML External Entity XXE attack due to default settings that enable doctype declarations and external entities. A remote attacker could exploit this by providing a...

CVE-2026-96446

A flaw was found in the Pushed Authorization Request PAR implementation of Keycloak. The issue occurs when the silent authentication path prompt=none is used, which allows the authorization process to skip certain steps if a user is already logged in. Due to this bypass, the security rule that...

CVE-2026-94057

A flaw was found in Exim. A remote attacker could exploit a vulnerability known as SMTP smuggling by sending crafted data after a rejection during the DATA processing phase. This manipulation could lead to a mismatch between the intended sent message and the actual received message, potentially...

CVE-2026-84448

A flaw was found in libheif, a library for decoding and encoding HEIF and AVIF image files. An application that uses the libheif writer API to construct region metadata may be vulnerable to a heap out-of-bounds read. This occurs because the heifregionitemaddregioninlinemaskdata function accepts...

CVE-2026-84451

A flaw was found in libheif. A remote attacker could exploit an integer overflow vulnerability when processing a crafted uncompressed image tile. This overflow leads to an out-of-bounds read, which can cause tile-processing applications to crash, resulting in a denial of service. Mitigation...

CVE-2026-81885

A flaw was found in radare2, a reverse engineering framework. By opening a specially crafted NE executable file, an attacker could trigger an an infinite loop within the application's relocation parser. This continuous processing would consume excessive CPU and memory, leading to a denial of...

CVE-2026-81883

A flaw was found in radare2, a reverse engineering framework. The Lua 5.3 bytecode function parser did not properly validate the length of function-metadata fields after a function-name string. By opening or inspecting a specially crafted Lua 5.3 bytecode file, a local user could trigger an...

CVE-2026-81880

A flaw was found in radare2. The Apple Preferred Executable Format PEF loader in radare2 is vulnerable to uncontrolled resource consumption. A remote attacker could exploit this by providing a specially crafted Apple PEF file. The PEF loader accepts relocSecCount values that are not properly...

CVE-2026-96445

A flaw was found in the Conditional OTP authenticator of Keycloak, an identity and access management solution. The issue occurs when the system evaluates specific HTTP headers to determine if a one-time password OTP should be skipped, but fails to verify if those headers came from a trusted sourc...

CVE-2026-94054

A flaw was found in Exim. When the Proxy-Protocol is used with an attacker-controlled proxy, a remote attacker could exploit an out-of-bounds write vulnerability. This could lead to data corruption, denial of service, or potentially arbitrary code execution, allowing the attacker to execute...

CVE-2026-84450

A flaw was found in libheif. A remote attacker could provide a specially crafted image file that, when processed by the libheif library, can lead to an integer overflow during crop calculations. This issue can cause assert-enabled builds to abort, resulting in a denial of service DoS. In release...

CVE-2026-81886

A flaw was found in radare2. The Windows 64-bit crash-dump dmp64 parser in radare2 is vulnerable to uncontrolled memory allocation. A local user could exploit this by opening a specially crafted full-memory Windows crash dump, leading to the parser repeatedly allocating memory without proper...

CVE-2026-81881

A flaw was found in radare2, a reverse engineering framework. Its Mach-O Swift metadata parser contains a heap out-of-bounds read vulnerability. By processing a specially crafted Mach-O file, a local user could trigger an error that causes the application to terminate. This leads to a denial of...

CVE-2026-81878

A flaw was found in radare2, a UNIX-like reverse engineering framework. The CPython bytecode .pyc marshal parser is vulnerable to an integer overflow. By opening or inspecting a specially crafted .pyc file, an attacker can trigger a heap out-of-bounds write. This can lead to heap memory corruptio...

CVE-2026-81879

A flaw was found in radare2, a UNIX-like reverse engineering framework. The ELF parser incorrectly handles program-header array allocation and iteration. When processing a specially crafted ELF file, the parser may iterate beyond the allocated program-header array due to a mismatch between the...

CVE-2026-96442

A code execution flaw was found in Emacs, affecting versions prior to 31.2. The Flymake mode using language backends other than Lisp would execute arbitrary code from the edited file while performing syntax checking. Viewing or editing untrusted files using Emacs could lead to arbitrary code...

CVE-2026-94571

A flaw was found in OpenStack Octavia. An authenticated user who can create or update L7 policies on their own load balancer can inject arbitrary HAProxy configuration directives through the redirecturl or redirectprefix fields. The URL validator does not reject control characters such as tabs an...

CVE-2026-94572

A flaw was found in OpenStack Octavia. The tlsciphers field on listeners and pools does not reject control characters or spaces. An authenticated project member can embed extra text in that field so that HAProxy treats it as additional configuration rather than a cipher list. This can change...

CVE-2026-94056

A flaw was found in Exim. When the Proxy-Protocol is used with an attacker-controlled proxy, an attacker can read certain uninitialized data from stack memory. This information disclosure could potentially expose sensitive data. Mitigation To prevent information disclosure, ensure that Exim is no...

CVE-2026-84447

A flaw was found in libheif, a software library for decoding and encoding HEIF and AVIF image files. A remote attacker could exploit this by providing a specially crafted image file. This crafted file could cause the library to repeatedly process the same image data, leading to excessive use of t...

CVE-2026-84446

A flaw was found in libheif, a HEIF and AVIF file format decoder and encoder. A remote attacker could provide a crafted HEIF file containing malicious sequence timing and edit-list data. This could lead to non-terminating decode loops and unbounded memory allocation, resulting in severe CPU and...

CVE-2026-84444

A flaw was found in libheif, a HEIF and AVIF file format decoder and encoder. When processing uncompressed tiled images with the WITHUNCOMPRESSEDCODEC enabled, the heifcontextaddimagetile function can accept a specially crafted image tile with mismatched dimensions. This can lead to an...

CVE-2026-84384

A flaw was found in libheif, a HEIF and AVIF file format decoder and encoder. A remote attacker could exploit this vulnerability by providing a crafted HEIF or AVIF file containing malicious metadata or image data. This could cause the application to consume an unbounded amount of memory during...

CVE-2026-63450

A flaw was found in Suricata, a network Intrusion Detection System IDS and Intrusion Prevention System IPS. A remote attacker can exploit a vulnerability in the FTP parser where sending a RETR or STOR command before PORT or PASV negotiation is incorrectly treated as a fatal error. This error...

CVE-2026-57226

A flaw was found in Suricata, a network Intrusion Detection System IDS. When the non-default SWF Small Web Format decompression feature is enabled with an unsafe decompression depth, a remote attacker can send a specially crafted SWF response. This can trigger a heap buffer overflow during HTTP S...

CVE-2026-57225

A flaw was found in Suricata, a network Intrusion Detection System. A NULL pointer dereference vulnerability exists when loading JSON or NDJSON datasets. This occurs because the system incorrectly assumes a configured valuekey will always resolve to a string. A trusted or untrusted dataset or rul...

CVE-2026-63449

A flaw was found in Suricata, a network Intrusion Detection System IDS and Intrusion Prevention System IPS. The Session Initiation Protocol SIP parser incorrectly handles large SIP message bodies. When a SIP message body exceeds 65,536 bytes, the parser truncates its length, preventing the full...

CVE-2026-65970

A flaw was found in OpenImageIO, a toolset for image file manipulation. A remote attacker could exploit this vulnerability by providing a specially crafted ZIP-compressed TIFF image file. When processed with TIFF multithreading enabled, the software can prematurely release memory while background...