CVE-2026-112405

A flaw was found in Pillow. A remote attacker can cause a Denial of Service DoS by supplying a specially crafted image file to an application that processes images with the library. This issue occurs because the Image.merge function fails to properly validate the first input band, allowing...

CVE-2026-98538

A flaw was found in the Linux kernel's writeback subsystem. This flaw allows a local user to cause a Denial of Service DoS by triggering prolonged processor stalls. When the kernel cleans up offline control group writeback structures with a large number of cached files, it repeatedly rescans...

CVE-2026-112895

A flaw was found in Pillow. This vulnerability allows a remote attacker to cause a Denial of Service DoS by supplying a specially crafted PDF document to an application performing PDF append operations. Because the PDF parser fails to properly track cyclic or deeply nested object references,...

CVE-2026-112894

A flaw was found in Pillow. When converting multi-frame images into a multi-page PDF document, the library repeatedly scans previously assigned object identifiers, resulting in quadratic processing time. A remote attacker could exploit this vulnerability by supplying a crafted image with a large...

CVE-2026-112893

A flaw was found in Pillow. When rendering text using FreeType with an active stroke width, a failure during glyph loading can cause the library to free an uninitialized or stale memory pointer. A remote attacker could exploit this vulnerability by supplying a malformed font to an application tha...

CVE-2026-112404

A flaw was found in Pillow. When processing Tagged Image File Format TIFF images, the library fails to properly validate buffer boundaries during tile and color decoding routines. A remote attacker could exploit this vulnerability by supplying a specially crafted TIFF file with conflicting metada...

CVE-2026-112397

A flaw was found in Pillow. A remote attacker can cause a Denial of Service DoS by supplying a specially crafted image with a width of zero to an application performing morphology operations. Because Pillow fails to validate zero-width image geometry during these operations, it attempts an...

CVE-2026-98535

A flaw was found in the Linux kernel's Freescale Frame Manager fman network driver. During device initialization, the driver retrieves a system clock resource to check its frequency but fails to release the reference count after reading the value. This omission results in a resource leak,...

CVE-2026-111766

A flaw was found in markdown-it. When HTML parsing is enabled, a remote attacker can cause a Denial of Service DoS by supplying specially crafted Markdown input containing repeated unterminated inline HTML constructs. The parser repeatedly scans overlapping input while searching for closing tags,...

CVE-2026-112274

A flaw was found in libtins. An out-of-bounds read vulnerability in DNS::soarecord::init allows remote attackers to read past buffer bounds by supplying SOA data lacking NUL terminators. Attackers can feed raw SOA RDATA without a zero byte to applications using the buffer constructor, causing...

CVE-2026-110687

A flaw was found in perl-Cpanel-JSON-XS. When any key in a hash is UTF-8 flagged, every key is decoded as UTF-8 for the comparison, including byte-string keys that the encoder writes out as Latin-1 characters. A byte-string key whose bytes are valid UTF-8 is sorted out of order, and two keys that...

CVE-2026-106583

A flaw was found in OpenSSH. The OpenSSH client insufficiently sanitizes command-line usernames containing special characters, such as dollar signs and backslashes. When untrusted input is passed to the client command line, an attacker can exploit this issue to perform command injection through...

CVE-2026-106582

A flaw was found in OpenSSH. When session compression is enabled, an attacker with access to a shared Secure Shell SSH connection can exploit the compression state shared across multiplexed channels. By analyzing changes in transmitted packet lengths caused by repeated data patterns, the attacker...

CVE-2026-106553

A flaw was found in OpenSSH. When Generic Security Services Application Programming Interface GSSAPI authentication is enabled, the SSH daemon fails to properly discard credentials after a failed authentication attempt. If a user subsequently authenticates through another method, the leftover...

CVE-2026-98537

A flaw was found in the Linux kernel's workqueue subsystem. A local attacker can cause a Denial of Service DoS by inducing memory pressure that triggers an out-of-memory notification. During subsequent dependency checks, a worker thread not actively running a task dereferences a null pointer,...

CVE-2026-98536

A flaw was found in the Linux kernel's writeback subsystem. This vulnerability can lead to a Denial of Service DoS when the routine responsible for cleaning up offline control group writeback structures fails to report a quiescent state during extended cleanup passes under certain preemption...

CVE-2026-112396

A flaw was found in Pillow. This vulnerability allows a remote attacker to potentially execute arbitrary code or cause a Denial of Service DoS. The issue occurs when an application encodes Tagged Image File Format TIFF data with untrusted tags into an in-memory buffer. When an invalid tag is...

CVE-2026-112401

A flaw was found in Pillow. When parsing GIF images with numerous comment blocks, the library repeatedly copies data in an inefficient manner. A remote attacker can exploit this vulnerability by submitting a specially crafted GIF image to an application that processes images using Pillow, causing...

CVE-2026-112395

A flaw was found in Pillow. Its tiled-TIFF image decoder does not properly restrict buffer boundaries when copying pixel data, leading to an out-of-bounds read. A remote attacker could exploit this vulnerability by providing a specially crafted tiled TIFF image to an application using the library...

CVE-2026-112394

A flaw was found in pillow. A remote attacker could trigger an out-of-bounds read by supplying specially crafted image dimensions and input buffers to the raw image decoders. Because the decoder calculates an image row size smaller than the unpacker's actual memory footprint, the library reads pa...

CVE-2026-112300

A flaw was found in configobj. A remote attacker can trigger a Denial of Service DoS by supplying specially crafted configuration input to be parsed by the application. Due to inefficient regular expression evaluation in the sectionmarker function, processing this input causes excessive CPU...

CVE-2026-112273

A flaw was found in libtins. A heap out-of-bounds read vulnerability in DNS::composename in src/dns.cpp allows remote attackers to read past the packet buffer by sending a label ending exactly at the packet end. Attackers can deliver crafted DNS packets whose additional, answer or authority recor...

CVE-2026-111757

A flaw was found in Hono's serveStatic middleware. This vulnerability allows a remote attacker to cause unauthorized information disclosure by bypassing path-based access controls. Because serveStatic decodes request paths a second time before performing filesystem lookups, a specially crafted...

CVE-2026-111748

A flaw was found in aiohttp. A remote attacker can bypass security controls by sending an absolute-form HTTP request that spoofs the connection protocol scheme. This issue occurs because the framework evaluates attacker-controlled request-target data rather than verifying the underlying connectio...

CVE-2026-111065

A flaw was found in aiohttp. An integer overflow in the processing of HTTP Max-Age directives can prevent connections from closing as intended. A remote attacker could exploit this vulnerability to exhaust the connection pool, leading to a temporary Denial of Service DoS...

CVE-2026-111061

A flaw was found in russh. When processing key addition requests containing lifetime constraints, the Secure Shell SSH agent server spawns a separate long-lived task for repeated constraint records and fails to roll back tasks if subsequent parsing fails. An attacker capable of communicating with...

CVE-2026-110686

A flaw was found in perl-Cpanel-JSON-XS. During decoding, the parser copies the filterjsonobject and filterjsonsinglekeyobject callbacks without taking references to them. If a filter callback removes the last single-key filter, it frees the callback table while the ongoing decode process is stil...

CVE-2026-110688

A flaw was found in perl-Cpanel-JSON-XS. At the first non-ASCII byte in a string, the decoder validates UTF-8 from that point to the end of its input. The incrparse function decodes each buffered value with a fresh decoder, meaning every value revalidates the rest of the buffer. Because of this,...

CVE-2026-110681

A flaw was found in perl-Cpanel-JSON-XS. A parser object holds its callbacks and its incremental parse buffer as raw scalar pointers. When a new thread is created, these pointers are copied into the new interpreter unchanged. As a result, the child's parser uses, and later frees, scalars that...

CVE-2026-110682

A flaw was found in perl-Cpanel-JSON-XS. The allownonref configuration is enabled by default, and the incrparse function inherits it. Because a top-level number, boolean true or false, or null has no closing delimiter, the incremental parser simply decodes whatever data has arrived at the time of...

CVE-2026-110684

A flaw was found in perl-Cpanel-JSON-XS. When encoding certain overloaded objects into string representations, under allowstringify, convertblessed or allowbignum, the encodestringify function retains unreleased references and fails to free allocated memory. An attacker capable of submitting...

CVE-2026-110675

A flaw was found in perl-Cpanel-JSON-XS. When the utf8 and allowbarekey configurations which are enabled by the relaxed setting are active, a quoted key is correctly validated as UTF-8, but a bare key's bytes are stored as a UTF-8 flagged string without any validation. Consequently, malformed...

CVE-2026-110680

A flaw was found in perl-Cpanel-JSON-XS. When the canonical configuration is enabled, the keys of a tied or threads::shared hash are counted in a first pass before a second pass collects them for sorting. The encoder allocates a fixed 64-entry stack array or, for larger counts, a heap array sized...

CVE-2026-110685

A flaw was found in perl-Cpanel-JSON-XS. When the allowtags configuration is enabled, a tagged value's class name and argument array are decoded and passed to the class's THAW method. Both are released only after the THAW method returns. Therefore, if a THAW method dies throws an exception, the...

CVE-2026-110676

A flaw was found in perl-Cpanel-JSON-XS. When the allowbignum configuration is enabled, a JSON number with a fraction or exponent decodes to a Math::BigFloat object, which stores the exponent separately and decodes efficiently. However, encoding this object untyped or as JSONTYPEFLOAT writes the...

CVE-2026-110677

A flaw was found in perl-Cpanel-JSON-XS. When the dupkeysasarrayref configuration is enabled, the values of a duplicate object key are collected into a new array. However, an extra reference is never released, causing the array and every value within it to outlive the decoded structure. The array...

CVE-2026-110674

A flaw was found in perl-Cpanel-JSON-XS. When the allowbarekey configuration enabled by the relaxed setting is active, a bare key containing a non-ASCII byte is stored as UTF-8 but looked up as raw bytes. This allows a repeated key to bypass the duplicate-key check and replace the earlier value...

CVE-2026-106585

A flaw was found in OpenSSH. A remote attacker can trigger a denial of service DoS or abnormal packet processing by transmitting crafted, highly compressed data to a vulnerable client or server. The application fails to verify that decompressed payloads remain within the maximum permitted packet...

CVE-2026-106552

A flaw was found in OpenSSH. A malicious or compromised server can write files to unintended locations on a client system during a recursive copy operation using the SFTP Secure File Transfer Protocol client. By returning crafted file paths, the remote server can trigger a directory traversal and...

CVE-2026-55797

A flaw was found in Argo CD's repository server component. An authenticated user with permissions to create or update repository configurations can supply a crafted proxy address containing special characters for an SSH Secure Shell repository. Because the server processes this proxy address...

CVE-2026-53995

A flaw was found in MLflow. An unauthenticated remote attacker can achieve arbitrary file write by submitting a crafted trace identifier containing path traversal sequences to the FileStore tracking backend. This vulnerability allows the attacker to write metadata files outside the intended...

CVE-2026-112400

A flaw was found in Pillow. When parsing a crafted GIF image, the library fails to discard rejected frame dimensions after encountering an excessively large image exception. If an application catches this exception and continues processing the image, subsequent operations attempt to allocate memo...

CVE-2026-112402

A flaw was found in Pillow. A remote attacker who can submit large image transformation operations under memory pressure can trigger improper error handling, leading to a double-free vulnerability releasing the same memory block twice. This issue can result in an application crash, causing a Deni...

CVE-2026-112399

A flaw was found in Pillow. A remote attacker can trigger a Denial of Service DoS by providing a specially crafted Animated Portable Network Graphics APNG image. Pillow allocates memory for the full canvas dimensions before validating safety size limits during initial file opening. Processing suc...

CVE-2026-112392

A flaw was found in Pillow. An attacker can cause a Denial of Service DoS by submitting a zero-size image to an application that applies rank-based filters, such as median, minimum, or maximum filters. When attempting to expand the image borders, Pillow reads from unallocated image storage,...

CVE-2026-112391

A flaw was found in Pillow. The PDF parser fails to limit recursion depth when reading nested PDF data structures such as arrays and dictionaries. A remote attacker could exploit this vulnerability by supplying a specially crafted, deeply nested PDF file to an application processing PDFs in appen...

CVE-2026-112390

A flaw was found in Pillow. This vulnerability allows a remote attacker to cause a Denial of Service DoS by supplying a specially crafted Microsoft Image Composer MIC file. When an application attempts to count or extract frames from the malicious image, an improper state reset triggers an infini...

CVE-2026-112261

A flaw was found in GIMP. Opening a crafted XCF that selects a path and then fails to load that path can cause a use-after-free in the main process, leading to a crash and potentially arbitrary code execution. Mitigation Avoid opening untrusted XCF files in GIMP. If GIMP is unused, remove the gim...

CVE-2026-112258

A flaw was found in GIMP. The XCF loader can leave a dangling pointer in the linked-channels list when a linked channel is later destroyed via a selection property. Opening a crafted XCF file can cause a use-after-free in the main GIMP process, leading to a crash and potentially arbitrary code...

CVE-2026-112257

A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash...