CVE-2026-19999

A buffer overflow in Assimp's ParseBoneTrafoKeys3DGSMDL7 function allows a remote attacker to cause a denial of service or potentially access sensitive information by tricking a user into loading a maliciously crafted 3DGS MDL7 file. Mitigation To mitigate this issue, avoid processing untrusted...

CVE-2026-72470

A flaw was found in the Linux kernel's NTFS3 file system driver. This vulnerability occurs when a user attempts to mount a specially crafted or dirty NTFS volume where the log page size on disk is larger than the buffer initially allocated by the kernel. This mismatch leads to a buffer overflow, ...

CVE-2026-72309

A flaw was found in the Linux kernel's tracing/remotes component. This vulnerability occurs when a page allocation fails within the traceremoteallocbuffer function. Due to an unincremented CPU counter, a partially allocated buffer descriptor rbdesc is not properly freed, leading to a memory leak...

CVE-2026-72011

A flaw was found in the Linux kernel's s390/diag component. A local user could exploit a missing bounds check when handling a user-controlled 'level' variable, which is used to read from an array. This vulnerability could lead to information disclosure through speculative execution, potentially...

CVE-2026-72305

A flaw was found in VDUSE in the Linux kernel. This vulnerability allows a local user to disclose sensitive kernel information. By mapping non-page-aligned bounce pages to userspace, an attacker can access kernel memory that should not be exposed, leading to an information disclosure...

CVE-2026-72310

A flaw was found in the Linux kernel's Server Message Block SMB client. A malicious SMB server could exploit an integer overflow vulnerability in the smb2ioctlqueryinfo function's bounds check. By sending a specially crafted response with a large offset, the server can cause the client to read da...

CVE-2026-72025

A flaw was found in the Linux kernel's s390/monwriter component. This vulnerability allows a malicious local user with elevated privileges to cause memory corruption. By changing the data length during buffer reuse, the monwriter code fails to validate the new length, leading to an out-of-bounds...

CVE-2026-15218

A flaw was found in the maas-api and maas-controller ServiceAccounts within Red Hat OpenShift AI. These ServiceAccounts are granted cluster-wide permissions that exceed their operational requirements. An attacker who compromises the identity of these ServiceAccounts, either through a remote code...

CVE-2026-72454

A flaw was found in the Linux kernel's MIPI I3C Host Controller Interface HCI driver. A race condition in the i3chciaddrtodev function allows concurrent device addition or removal operations to modify a device list while it is being traversed without proper locking. This can lead to a...

CVE-2026-72292

A flaw was found in the kernel. A local user could exploit a vulnerability in the KVMS390GETCMMABITS ioctl, specifically within the kvms390getcmmabits function. This function allocates memory without properly initializing all pages, leading to uninitialized memory regions. These uninitialized...

CVE-2026-72220

A flaw was found in the Linux kernel's sunrpc component. When a worker thread processes a new request and encounters an early error, a stale release hook can be re-triggered against previously used data. This can lead to a double-free or use-after-free vulnerability, potentially allowing an...

CVE-2026-68457

A flaw was found in ksmbd in the Linux kernel. This vulnerability allows certain file system control FSCTL operations, specifically SETSPARSE, SETZERODATA, and SETCOMPRESSION, to use incorrect credentials. Consequently, these operations can bypass the security checks established when the file was...

CVE-2026-59650

A flaw was found in Bouncy Castle for Java. This vulnerability allows an attacker to manipulate the Diffie-Hellman DH key agreement process by providing an unvalidated value. This could lead to a compromised cryptographic key exchange, potentially enabling an attacker to decrypt sensitive...

CVE-2026-58062

A flaw was found in Bouncy Castle for Java. This vulnerability allows a remote attacker to bypass certificate validation by presenting a manipulated Online Certificate Status Protocol OCSP response. The system would accept this invalid response without properly verifying its binding to the checke...

CVE-2026-72190

A flaw was found in the Linux kernel's NTFS filesystem driver. An incorrect locking order ABBA deadlock during file rename operations can lead to a race condition. A local attacker could exploit this by performing specific file system operations, causing the system to deadlock. This results in a...

CVE-2026-74573

A flaw was found in the Linux kernel's ARM System Memory Management Unit version 3 SMMUv3 IOMMU driver. This vulnerability occurs because the driver incorrectly assumes that a virtual device vDEVICE has only one Stream ID. This can lead to a guest operating system's virtual Stream ID invalidation...

CVE-2026-8763

A flaw was found in Bouncy Castle for Java. This vulnerability allows an attacker to bypass Name Constraints by using a trailing dot in rfc822Name and URI fields. Name Constraints are security mechanisms used in X.509 certificates to restrict the set of names that a certificate can certify. A...

CVE-2026-72428

A flaw was found in the Berkeley Packet Filter BPF component of the Linux kernel. An incorrect calculation of the stack slot index during Spectre v4 sanitization checks could result in certain memory bytes not being properly sanitized. This vulnerability might allow an attacker to potentially...

CVE-2026-42215

A flaw was found in GitPython, a Python library used to interact with Git repositories. This vulnerability allows an attacker to achieve arbitrary command execution by providing specially crafted arguments kwargs to functions such as Repo.clonefrom, Remote.fetch, Remote.pull, or Remote.push. This...

CVE-2026-72042

A flaw was found in the Linux kernel's Intelligent Platform Management Interface IPMI subsystem. An issue in the event delivery mechanism, specifically a reference count underflow, can lead to a use-after-free vulnerability. This occurs when a user's reference count is prematurely decremented...

CVE-2026-44244

A flaw was found in GitPython, a Python library used to interact with Git repositories. The GitConfigParser.setvalue function does not properly validate input for newlines. This vulnerability allows an attacker to inject malicious configuration settings, specifically the core.hooksPath, into a Gi...

CVE-2026-63649

A flaw was found in the Windows interactive service of OpenVPN. A local authenticated user could exploit this vulnerability by crafting specific options to bypass whitelist checks. This bypass allows the user to load arbitrary configuration files, which could lead to privilege escalation or other...

CVE-2026-42284

A flaw was found in GitPython, a Python library for interacting with Git repositories. A remote attacker could exploit an input validation vulnerability in the clone function. By crafting a malicious string in the multioptions parameter, an attacker could bypass validation. This allows for the...

CVE-2026-65914

A flaw was found in DOMPurify. This vulnerability, a type of Cross-Site Scripting XSS, occurs when HTML that has been sanitized is reinserted into specific parsing contexts using innerHTML with certain HTML elements like script or iframe. An attacker can craft malicious input that, during...

CVE-2026-65913

A flaw was found in DOMPurify. This prototype pollution vulnerability, specifically when operating in USEPROFILES mode, allows a remote attacker to bypass attribute filtering. By manipulating Array.prototype properties, an attacker can cause DOMPurify to accept event handlers as allowed attribute...

CVE-2026-65912

A flaw was found in DOMPurify. An attacker can bypass URI validation by providing a specially crafted predicate function via EXTRAELEMENTHANDLING.attributeCheck. This allows unsafe protocols, such as javascript:, to persist after sanitization, potentially leading to DOM-based cross-site scripting...

CVE-2026-65911

A flaw was found in DOMPurify. This vulnerability allows a remote attacker to perform cross-site scripting XSS by exploiting a state leakage issue. Specifically, function predicates used for adding attributes or tags during sanitization can persist across multiple calls to the sanitize function...

CVE-2026-65904

A flaw was found in DOMPurify. When DOM elements originating from a different window or realm, such as an iframe's contentDocument, are processed in INPLACE mode, DOMPurify fails to properly sanitize them. This oversight allows an attacker to inject and execute Cross-Site Scripting XSS payloads,...

CVE-2026-65902

A flaw was found in DOMPurify. An attacker can exploit a vulnerability in how DOMPurify handles its sanitization hooks when default configurations are used. By manipulating the uponSanitizeElement or uponSanitizeAttribute hooks, an attacker can permanently alter the allowed HTML tags and...

CVE-2026-65901

A flaw was found in DOMPurify. This cross-site scripting XSS vulnerability exists in INPLACE mode, where the software trusts attacker-controlled nodeName on live non-form nodes. A remote attacker can supply hostile live Document Object Model DOM objects with script children. These scripts can...

CVE-2026-65899

A flaw was found in DOMPurify where the clearConfig function does not properly reset the retained Trusted Types policy. This can lead to a DOMPurify instance, when reused across different security contexts, remaining bound to a previously supplied and potentially unsafe policy. An attacker could...

CVE-2026-19967

A flaw was found in Open Asset Import Library Assimp. A remote attacker could exploit a heap-based buffer overflow vulnerability, which occurs when a program writes more data to a memory block than it was intended to hold. This specific flaw exists within the Assimp::Compression::decompressBlock...

CVE-2026-65898

A flaw was found in DOMPurify. When the setConfig function is used with an uponSanitizeAttribute hook, the ALLOWEDATTR allowlist is not properly cloned. This allows an attacker to register a hook that can permanently modify the shared allowlist, enabling the conditional allowance of dangerous...

CVE-2026-19970

A flaw was found in Open Asset Import Library Assimp. A heap-based buffer overflow vulnerability exists in the AddBonesToNodeGraph3DGSMDL7 function within the Node Parser component. This flaw can be triggered remotely by manipulating the bonesnum argument. Successful exploitation could lead to...

CVE-2026-19969

A flaw was found in Open Asset Import Library Assimp. A buffer overflow vulnerability exists in the GenerateOutputMeshes3DGSMDL7 function when processing 3DGS MDL7 models. A remote attacker could exploit this to cause a denial of service or potentially disclose sensitive information...

CVE-2026-73075

A flaw was found in Vim, an open-source text editor. This vulnerability involves an out-of-bounds memory access within the popup opacity handling feature. A local attacker could exploit this by using specially crafted Vim script, leading to an out-of-bounds read and a limited out-of-bounds write...

CVE-2026-73072

A heap buffer overflow in Vim allows a local attacker to cause a denial of service or potentially execute arbitrary code. The flaw is triggered by processing a specially crafted spell file, where the setsofo function fails to reset internal data between sections, leading to an out-of-bounds write...

CVE-2026-12795

A flaw was found in BerriAI litellm. This vulnerability allows a remote attacker to bypass authentication within the SSO Debug Flow component by manipulating the json.dumps function. The successful exploitation of this flaw could lead to unauthorized access and potential information disclosure...

CVE-2026-17350

A flaw was found in pgAdmin 4. In SERVER mode, an authenticated user who has been explicitly denied access to a specific tool by an administrator could still bypass this restriction. This is due to inconsistent enforcement of the per-tool permission system, where backend routes and Socket.IO...

CVE-2026-17349

A flaw was found in pgAdmin 4. An authenticated, low-privilege user could exploit a vulnerability in the adhoc server cloning feature to gain unauthorized access to another user's stored database credentials. By initiating an adhoc connection to a shared server owned by another user, the cloning...

CVE-2026-56389

A flaw was found in GNU Bison. During HTML report generation, the software improperly handles grammar-defined configuration variables. An attacker can provide a specially crafted grammar file that overrides the executable used for XML-to-HTML transformation. This allows for the execution of an...

CVE-2026-74247

A flaw was found in Red Hat Quay. A user with FEATUREBUILDSUPPORT enabled and repository write access can exploit a Server-Side Request Forgery SSRF vulnerability within the build API. This allows the user to provide a malicious URL, causing the Quay builder to make requests to internal network...

CVE-2026-74244

A flaw was found in Red Hat Quay's Stripe billing webhook handler. This vulnerability allows an unauthenticated attacker to forge billing events by sending crafted JSON requests to the /webhooks/stripe endpoint without validating the Stripe-Signature header. Successful exploitation can lead to th...

CVE-2026-74245

A flaw was found in Red Hat Quay's exported logs feature. An unauthenticated attacker with a valid file ID could download exported action logs without proper authorization. While file IDs are complex, they can be intercepted from plaintext email or webhook callbacks. This vulnerability leads to...

CVE-2026-74243

A flaw was found in Red Hat Quay. When the SECURITYSCANNERV4PSK pre-shared key is not set, a remote unauthenticated attacker can send POST requests to the security scanner notification endpoint. This allows the attacker to flood the notification queue and inject path traversal characters into Cla...

CVE-2026-74242

A flaw was found in Red Hat Quay. An administrator of any repository, by knowing or guessing a target notification's Universally Unique Identifier UUID, can read the notification configuration, including sensitive details like webhook URLs, Slack tokens, and email addresses. This vulnerability al...

CVE-2026-74241

A flaw was found in Red Hat Quay's external Lightweight Directory Access Protocol LDAP authentication handling. When an LDAP referral is returned during authentication, the system does not properly escape the username input. This allows an attacker to inject LDAP filter metacharacters, enabling...

CVE-2026-74240

A flaw was found in Red Hat Quay's JWT JSON Web Token validation for federated robot accounts and single sign-on SSO authentication. Multiple issues related to audience verification and the enforcement of azp and sub claims were identified. These flaws could allow an attacker with a validly-signe...

CVE-2026-48804

A flaw was found in python-socketio, a Python implementation of the Socket.IO realtime client and server. The server stores binary messages in memory while awaiting their attachments. A remote attacker can exploit this by sending a binary message and deliberately withholding some attachments. Thi...

CVE-2026-72552

A flaw was found in Dub. This server-side request forgery SSRF vulnerability allows an unauthenticated remote attacker to force the server to make HTTP requests to arbitrary internal or external hosts. This can be exploited via the metatags edge endpoint, which processes caller-supplied URLs...