CVE-2026-77310

A flaw was found in jackson-databind. A remote attacker can exploit this vulnerability by providing specially crafted input during data deserialization, specifically when java.net.InetAddress objects are processed. This causes the application to perform eager DNS resolution on attacker-controlled...

CVE-2026-46603

A flaw was found in golang.org/x/image/vp8l. A remote attacker can cause a denial of service by providing a specially crafted VP8L image. This image, containing many unused Huffman tree groups, leads to excessive memory allocation during VP8L decoding, resulting in memory exhaustion. Mitigation...

CVE-2026-83589

No description is available for this CVE...

CVE-2026-49329

A flaw was found in openshift/oauth-server. The OAuth login and error page endpoints pass the unauthenticated Accept-Language header to golang.org/x/text/language.ParseAcceptLanguage without input validation. A bypass of the CVE-2022-32149 mitigation exists: the upstream guard counts only '-'...

CVE-2026-49855

A flaw was found in Tornado, a Python web framework and asynchronous networking library. Its gzip decompression routines process data in limited-size chunks but do not enforce an overall limit on the total accumulated decompressed data. This vulnerability allows a malicious server to consume...

CVE-2026-84127

A flaw was found in the WebExtensions component of Firefox for Android. This vulnerability allows for information disclosure, potentially enabling an attacker to gain access to sensitive data...

CVE-2026-84218

A flaw was found in Jolokia's JSR-160 proxy functionality where insufficient validation of client-controlled JMX service URLs allows a bypass of the denylist introduced to mitigate CVE-2018-1000130. The proxy accepts a target.url value from a Jolokia POST request and passes it to JMXServiceURL an...

CVE-2026-84131

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation due to invalid pointer in the Graphics component...

CVE-2026-84125

A flaw was found in Firefox. A use-after-free vulnerability in the DOM: Core & HTML component could allow a remote attacker to execute arbitrary code...

CVE-2026-84120

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Audio/Video component...

CVE-2026-82265

A flaw was found in Zipkin. Unauthenticated attackers can exploit exposed Spring Boot Actuator endpoints on the tracing API port to access sensitive information. This allows them to read environment variables, bean configurations, and storage credentials. Additionally, attackers can modify log...

CVE-2026-80685

A flaw was found in the Linux kernel's memory management subsystem. The snapshotpage function attempts to read memory that may not exist when handling certain memory structures order-1 folios during specific memory operations, such as dynamic logical partitioning DLPAR memory removal. This...

CVE-2026-80606

A flaw was found in the Linux kernel's drm/xe/userptr component. When a specific test configuration is enabled, the system attempts to perform a write operation while holding a read-only lock. This incorrect lock handling leads to an assertion failure, which can cause system instability or a deni...

CVE-2026-80721

A flaw was found in the Linux kernel's Bluetooth ISO Isochronous Stream implementation. This vulnerability occurs because the system does not properly clear references to connection handles hcon after a connection is deleted. This oversight can lead to unpredictable system behavior or instability...

CVE-2026-80646

A flaw was found in the Linux kernel's IPv6 component. This vulnerability arises when the devgetbyindexrcu function returns a null value if the original physical device is unregistered, leading to a NULL pointer dereference in in6devstatsget. A local attacker could exploit this flaw to trigger a...

CVE-2026-80630

A flaw was found in the Linux kernel's fqcodel Fair Queueing Controlled Delay network scheduler. When fqcodel drops packets during a peek operation, it incorrectly calls qdisctreereducebacklog before restoring the queue length. This can lead to the parent's class being mistakenly deactivated,...

CVE-2026-80705

A flaw was found in the Linux kernel's drm/amd/display component. This vulnerability arises from an insufficient check during the allocation of a 'phantom plane' within the display driver. If the allocation fails and this failure is not properly handled, it can lead to a system crash, resulting i...

CVE-2026-80616

A flaw was found in the Linux kernel's ieee802154 component. An unnecessary warning message WARNON can be triggered when memory allocation fails in the cfg802154switchnetns function. This can lead to diagnostic messages being logged due to deliberate fault injections, but does not pose a direct...

CVE-2026-53682

An unauthenticated client can query the Security Domain hosts inventory via GET /ca/rest/securityDomain/hosts and receive a structured response enumerating internal PKI/CA hosts and roles security domain topology and participating subsystems, without requiring a principal, client certificate, or...

CVE-2026-11873

An Apache-proxied Dogtag CA REST endpoint exposed by IdM POST /ca/rest/certrequests returns HTTP 500 with internal Java stack traces for unauthenticated malformed requests. The same unauthenticated error path emits large multi-line stack traces into the CA debug log, creating a log-amplification...

CVE-2026-80719

A flaw was found in the Linux kernel's Multi-Generational Least Recently Used MGLRU page table walker. When memory cgroup memcg reparenting occurs concurrently with page table walks, stale batch updates can lead to an underestimation of the number of pages. This can prevent the kernel from...

CVE-2026-80658

A flaw was found in the drm/rockchip: dwdp component of the Linux kernel. This vulnerability occurs when the platform driver's remove callback attempts to access driver data before it has been properly initialized by the bind callback. This can lead to a null pointer dereference, potentially...

CVE-2026-80649

A flaw was found in the Linux kernel's System Control and Management Interface SCMI power management. The scmipowernameget function fails to validate the domain number provided by an external caller. This oversight can lead to an out-of-bounds access, potentially allowing an attacker to read or...

CVE-2026-80644

A flaw was found in ocfs2, a component of the Linux kernel. A local attacker could exploit this vulnerability by providing a specially crafted OCFS2 image. When this fuzzed image is mounted, it can corrupt the journal dinode. This corruption leads to a kernel crash, resulting in a Denial of Servi...

CVE-2026-80613

A flaw was found in the Linux kernel's veth component. An error in the rollback mechanism during XDP eXpress Data Path enablement can lead to a Networked Asynchronous Packet Interface NAPI structure not being properly deallocated. This results in a Use-After-Free UAF vulnerability, where freed...

CVE-2026-71554

A flaw was found in h2, a Python library for HTTP/2. This vulnerability allows a remote attacker to perform request smuggling. The library incorrectly processes HTTP/2 requests that contain more than one Host header. When these requests are downgraded to HTTP/1.1 by a consuming application, the...

CVE-2026-59879

A flaw was found in Immutable.js, a library providing persistent immutable data structures. This vulnerability occurs when specific List operations, such as Listset or ListsetSize, are provided with an index or size value within a particular large range. An attacker could exploit this by providin...

CVE-2026-73653

A flaw was found in Vitest. A remote attacker, by sending specially crafted commands to the Browser Mode API, could bypass file access restrictions. This allows the attacker to read, create, overwrite, or delete arbitrary files on the system where Vitest is running, even when file write permissio...

CVE-2026-80624

A flaw was found in the Linux kernel's mfd: cs42l43 component. This vulnerability occurs because the system does not properly verify that the received firmware's size is larger than its header. An attacker could exploit this by providing a malformed firmware, leading to an out-of-bounds memory...

CVE-2026-80617

A flaw was found in the Linux kernel's net: airoha driver. An incorrect memory allocation size for the foechecktime array can lead to a heap buffer overflow. When the airohappefoeverifyentry function is called with a specific hash value, it writes beyond the intended buffer. This out-of-bounds...

CVE-2026-80687

A flaw was found in the Linux kernel's iommufd/viommu component. An error in the iommufdvdeviceallocioctl function's error handling path can lead to a lock being held indefinitely. This can cause a deadlock, preventing further virtual device vDEVICE operations and resulting in a Denial of Service...

CVE-2026-80611

A flaw was found in the Linux kernel's Advanced Configuration and Power Interface ACPI processor idle functionality. When kernel tracing features, such as function tracing or Kprobes, are enabled, entering a Low Power Idle LPI state can trigger a Read-Copy Update RCU warning. This occurs because...

CVE-2026-80607

A flaw was found in the Linux kernel's tracing/probes component. A local user could trigger a kernel warning WARNONONCE by adding a kprobe event based on a raw address with a BTF BPF Type Format parameter. This could lead to minor information disclosure through kernel log messages...

CVE-2026-80605

A flaw was found in the Linux kernel. An integer overflow in the picolcdsendandwait function within the Human Interface Device HID picolcd driver can occur when a signed loop counter overflows. This can lead to an incorrect condition evaluation, resulting in a NULL pointer dereference. This...

CVE-2026-80714

A flaw was found in the Linux kernel's IP Virtual Server IPVS component. When a synced connection is established, it can incorrectly inherit a "one-packet" flag from its destination. This misconfiguration causes the connection's expiry process to mishandle its cleanup, leaving behind stale memory...

CVE-2026-80702

A flaw was found in the Linux kernel's drm/vmwgfx component. Incorrect assignments of boolean values to the guestmemorysize field instead of the guestmemorydirty bitfield can lead to the field holding an incorrect size. This can cause subsequent operations to read or write past the intended memor...

CVE-2026-80683

A flaw was found in the Linux kernel's Bluetooth SCO Synchronous Connection-Oriented protocol implementation. A local attacker or a nearby malicious Bluetooth device could trigger a race condition during the disconnection process, specifically when the scoconndel function attempts to release a...

CVE-2026-80690

A flaw was found in the Linux kernel's SCSI Universal Flash Storage UFS core. When the ufshcdallochost function fails to initialize the hba-rpmbs list, it can lead to a null pointer dereference during device teardown. This vulnerability could allow a local attacker to cause a system crash,...

CVE-2026-80675

A flaw was found in libbpf, a library for working with eBPF extended Berkeley Packet Filter programs in the Linux kernel. This vulnerability occurs when the signed loader fails to ensure that metadata maps are exclusive during verification. A hostile host could exploit this by omitting exclusivit...

CVE-2026-80668

A flaw was found in the Netfilter subsystem of the Linux kernel, specifically within nfconntrackexpect. A race condition exists between the removal of an expectation and an expiring timer, which can allow the system to access a stale pointer. This vulnerability could lead to system instability or...

CVE-2026-80666

A flaw was found in the Linux kernel's Bluetooth Synchronous Connection-Oriented SCO component. A race condition exists in the scosocktimeout function. When a Bluetooth SCO socket is closing while its timer is active, the system attempts to acquire the same lock twice, leading to a deadlock. This...

CVE-2026-80634

A flaw was found in the Linux kernel's netfilter flowtable component. An integer underflow can occur during bridge Virtual Local Area Network VLAN untagging operations. If the numencaps value is zero, a decrement operation can cause it to wrap to 255. This can lead to an out-of-bounds stack read...

CVE-2026-80608

A flaw was found in the Linux kernel. This vulnerability, located in the accel/amdxdna component, is a use-after-free issue. It occurs due to a race condition during device removal when forceiova mode is enabled, where a freed memory region can still be accessed. A local attacker could potentiall...

CVE-2026-80625

A flaw was found in the Linux kernel's RDMA/hns component. During concurrent driver removal and reset operations, bonding resources are incorrectly released and then re-allocated, leading to a memory leak. This memory leak can potentially cause a kernel panic, resulting in a Denial of Service DoS...

CVE-2026-80213

A flaw was found in the resolv gem. This vulnerability arises from the incorrect handling of DNS label lengths during message encoding. A remote attacker could exploit this by providing a specially crafted hostname to an application utilizing the resolv gem. This could lead to the bypass of...

CVE-2026-77341

A flaw was found in cpp-httplib, a C++ HTTP/HTTPS library. This vulnerability allows a remote attacker to inject arbitrary HTTP headers or split HTTP responses by sending specially crafted data within chunked response trailer headers. The library fails to properly validate these headers, enabling...

CVE-2026-82853

A flaw was found in Nodemailer. This vulnerability allows a remote attacker to inject arbitrary Simple Mail Transfer Protocol SMTP commands due to improper sanitization of carriage return and line feed characters in the transport name option. This can lead to email spoofing and phishing attacks...

CVE-2026-82662

A flaw was found in Nodemailer where it disables Transport Layer Security TLS certificate verification. A remote attacker, positioned between the user and the server a machine-in-the-middle attack, could exploit this by intercepting OAuth2 token requests. This allows the attacker to capture...

CVE-2026-82661

A flaw was found in Nodemailer, an email sending library. This vulnerability allows a remote attacker with control over specific list comment parameters to inject arbitrary message headers into generated email messages. By failing to sanitize carriage return and line feed CRLF characters, an...

CVE-2026-81723

A flaw was found in NLTK. This vulnerability, specifically in the XMLCorpusView.readxmlfragment function, allows a remote attacker to cause severe CPU consumption and a denial of service DoS by providing specially crafted, malformed XML corpus files. The flaw occurs because the system repeatedly...