CVE-2026-98533

A flaw was found in the Linux kernel's Integrity Policy Enforcement IPE subsystem. When dm-verity updates a root hash, the old hash can be freed while concurrent policy evaluation operations are still accessing it. A local attacker could exploit this use-after-free condition to trigger a Denial o...

CVE-2026-98534

A flaw was found in the Linux kernel's Integrity Policy Enforcement IPE subsystem. A local attacker can cause a denial of service DoS or potentially execute arbitrary code by triggering a race condition during policy management. This issue occurs when a newly loaded policy is audited after intern...

CVE-2026-8168

A flaw was found in the Qt SVG module. A remote attacker could trigger this issue by providing a specially crafted SVG Scalable Vector Graphics file containing deeply nested elements. When parsed, this leads to uncontrolled recursion and stack exhaustion, resulting in an application crash and a...

CVE-2026-96238

Origin validation error in .NET allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-96956

Stack-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network...

CVE-2026-106587

A flaw was found in OpenSSH. When certain configuration options are set to "none" within a conditional block to disable a feature, the OpenSSH server daemon sshd incorrectly interprets the value as a literal file path rather than disabling the setting. A local attacker could exploit this issue by...

CVE-2026-111063

A flaw was found in aiohttp. The application fails to properly enforce the Secure attribute for shared cookies. A remote attacker could exploit this vulnerability to cause cookies intended solely for encrypted connections to be transmitted in plaintext, resulting in sensitive information...

CVE-2026-106588

A flaw was found in OpenSSH. When built using certain macOS software development kits SDKs, the SSH server daemon sshd disables process sandboxing due to the removal of underlying system interfaces. Consequently, the daemon runs without sandbox isolation, potentially allowing an attacker who...

CVE-2026-106584

A flaw was found in OpenSSH. During certificate generation with the ssh-keygen utility, Daylight Saving Time DST is mishandled when converting dates. This flaw can cause certificates to be issued with incorrect expiration times, potentially allowing them to remain valid longer than intended or...

CVE-2026-112046

A flaw was found in OW2 ASM. An attacker can cause a Denial of Service DoS by supplying a specially crafted Java class file with methods that grow beyond 64 kilobytes during transformation. When processing this file, an offset truncation error triggers an infinite loop within the method resolutio...

CVE-2026-61700

A flaw was found in MariaDB Connector/J. This flaw allows a rogue or man-in-the-middle server to bypass the allowLocalInfile=false setting during server-initiated LOCAL INFILE requests. When an application sends a LOAD DATA LOCAL INFILE COMQUERY, a malicious server can echo the filename, causing...

CVE-2026-112275

A flaw was found in netpbm. An attacker could exploit this vulnerability by enticing a user to process a specially crafted Sun raster image file using the rasttopnm conversion utility. A heap-based buffer overflow in the run-length decoder allows out-of-bounds data to be written into memory...

CVE-2026-107313

A flaw was found in the PostgreSQL JDBC Driver pgjdbc. When Generic Security Services GSS encryption is enabled, transmitting large data values can cause the driver to send stale buffer contents instead of the intended payload. Consequently, sensitive data from earlier queries on the same...

CVE-2026-107325

A flaw was found in the MongoDB Go Driver due to improper validation of Binary JSON BSON array lengths. An unauthenticated remote attacker can exploit this vulnerability by supplying specially crafted BSON array data to an affected application. When the application validates this malformed input,...

CVE-2026-75466

A flaw was found in libjpeg-turbo. This vulnerability, located in the PNG image loader, allows a remote attacker to trigger a denial of service DoS. By processing a specially crafted indexed-color PNG image, an integer division-by-zero error can occur, leading to application instability and crash...

CVE-2026-70405

A flaw was found in Erlang/OTP snmp. A remote attacker can degrade availability by sending a crafted Simple Network Management Protocol SNMP message. This message contains a Basic Encoding Rules BER INTEGER with an arbitrarily large length field, causing the system to consume excessive resources...

CVE-2026-70165

A flaw was found in .NET. An authorized local attacker could exploit this vulnerability to achieve privilege escalation on the host system. The issue is caused by improper link resolution before file access, where the application fails to properly validate file links. By manipulating these links,...

CVE-2026-69304

A flaw was found in ASP.NET Core. This vulnerability arises from the improper handling of highly compressed data, a technique referred to as data amplification. An unauthorized attacker can exploit this weakness remotely over a network. Successful exploitation leads to a denial of service,...

CVE-2026-53493

A flaw was found in containerd. During an image pull operation, containerd fails to enforce recursion and deduplication limits when traversing descriptor graphs in Open Container Initiative OCI image indexes. A remote attacker can exploit this flaw by serving a crafted image index, triggering...

CVE-2026-48932

A flaw was found in the Node.js HTTP client. This vulnerability can cause a request desynchronization in Node.js-based forwarding proxies. A remote attacker could exploit this by sending crafted HTTP requests where the Node.js client omits certain headers from being visible to the proxy, while...

CVE-2026-112366

A flaw was found in picomatch. A remote attacker can trigger this vulnerability by supplying crafted pattern-matching inputs containing single-branch repeated extglob expressions. Processing these inputs causes exponential regular expression backtracking, which blocks the event loop and leads to ...

CVE-2026-112307

A flaw was found in sqlparse. The PHP output formatting filter does not properly sanitize dollar-sign sequences when formatting SQL statements into PHP code. An attacker can exploit this vulnerability by supplying crafted SQL input containing embedded expressions, leading to arbitrary code...

CVE-2026-106547

A flaw was found in HDF5. An attacker could exploit this heap-based buffer overflow by providing a specially crafted HDF5 file to an application. Due to improper metadata validation when reading unallocated dataset chunks, the library writes data past the boundary of an allocated memory buffer...

CVE-2026-111064

A flaw was found in aiohttp. The server does not enforce a timeout during the initial phase of a request before any data is received. A remote attacker can exploit this vulnerability by keeping idle connections open indefinitely, exhausting available connection capacity and resulting in a Denial ...

CVE-2026-79984

A flaw was found in Apache Camel's Mina SFTP Secure File Transfer Protocol component. When polling a remote server, the component fails to validate or sanitize file paths returned in directory listings before performing file operations. A malicious remote server or a network attacker manipulating...

CVE-2026-85251

A flaw was found in the Apache Camel HTTP component. This flaw leads to information disclosure when the component is configured to automatically follow HTTP redirects. The client improperly forwards sensitive authentication credentials, such as OAuth bearer tokens and basic authentication...

CVE-2026-79983

A flaw was found in the Apache Camel FTP component. Remote-file consumers fail to validate directory listing entries received from remote servers, which allows path traversal outside the configured target directory. A compromised server or network attacker modifying server responses can supply...

CVE-2026-78165

A flaw was found in Apache Camel's camel-spring-redis component. By default, the component relies on an unfiltered Java deserializer to process messages received from Redis channels or stored keys. An attacker with permission to publish messages or write data to the Redis instance can exploit thi...

CVE-2026-69805

A flaw was found in .NET. An unauthorized attacker can exploit this vulnerability by gaining external control of a file name or path, which allows them to elevate privileges over a network...

CVE-2026-66859

A flaw was found in Apache Thrift. A remote attacker can cause a Denial of Service DoS by triggering an application crash due to improper memory handling in the C GLib bindings. This vulnerability stems from an uninitialized variable and a null pointer dereference during data processing...

CVE-2026-66055

A flaw was found in Apache Thrift. This vulnerability allows a remote attacker to cause a Denial of Service DoS by sending specially crafted requests. Because the affected bindings fail to properly restrict resource allocation during request handling, an attacker can exhaust system resources and...

CVE-2026-98467

A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine subsystem for ARM64 architecture. A race condition during the teardown of nested virtual machine memory mappings can cause the kernel to dereference a null pointer. A local user or nested guest can trigger concurrent memory...

CVE-2026-96230

Improper neutralization of input during web page generation 'cross-site scripting' in ASP.NET Core allows an unauthorized attacker to execute code over a network...

CVE-2026-98532

A flaw was found in the Linux kernel. A remote attacker could cause a Denial of Service DoS or memory corruption by sending specially crafted IPv6 network packets. The IPv6 extension header parsing mechanism fails to verify that the declared length of a header fits within the received packet data...

CVE-2026-96225

Improper link resolution before file access 'link following' in .NET allows an authorized attacker to elevate privileges locally...

CVE-2026-96233

Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network...

CVE-2026-96231

Improper link resolution before file access 'link following' in .NET allows an authorized attacker to elevate privileges locally...

CVE-2026-96237

Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network...

CVE-2026-96236

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network...

CVE-2026-98531

A flaw was found in the Linux kernel's IPv6 Segment Routing SRv6 component. This flaw allows a local user to cause an information disclosure. By sending a crafted Generic Netlink message with an attribute shorter than expected, the system performs an out-of-bounds read into uninitialized kernel...

CVE-2026-61702

A flaw was found in CUPS. An information disclosure vulnerability allows an attacker to read files on the system by submitting a specially crafted print job containing directory traversal characters in the language attribute. Because the scheduler fails to validate path separators when processing...

CVE-2026-55480

A flaw was found in CUPS. Insecure temporary file handling allows a local attacker with print administrative privileges to overwrite arbitrary system files. When configuring a printer, the print service creates a temporary file with a predictable name in a shared directory without verifying wheth...

CVE-2026-112259

A flaw was found in GIMP. Importing a crafted SBZ palette without a color-model attribute can cause a NULL pointer dereference during string comparison, resulting in denial of service of the GIMP application. Mitigation Avoid importing untrusted SBZ palette files. If GIMP is unused, remove the gi...

CVE-2026-92707

MessagePack for C is a MessagePack serializer for C. Prior to 2.5.303 and 3.1.9, deserializing attacker-controlled MessagePack data as System.Object through PrimitiveObjectFormatter can cause excessive memory allocation. The formatter allocates an object from each declared array length before the...

CVE-2026-109597

A flaw was found in Hugo. An attacker with permissions to author Markdown content can exploit this stored cross-site scripting XSS vulnerability by supplying crafted heading identifiers. When Hugo generates a table of contents or heading fragments, the unescaped attributes allow arbitrary HTML an...

CVE-2026-88901

A flaw was found in the Apache Camel Smooks component camel-smooks. This vulnerability allows an unauthenticated remote attacker to cause information disclosure by submitting a crafted XML message containing external entity references. Because the component processes incoming XML data without...

CVE-2026-67410

A flaw was found in rabbitmq-server. When OAuth2 authentication is enabled for the management interface, the server inadvertently exposes the configured client secret within an unauthenticated JavaScript file. A remote, unauthenticated attacker with access to the management interface can retrieve...

CVE-2026-109574

A flaw was found in Hugo. A path traversal vulnerability in the Sass stylesheet processing component allows malicious themes or modules to access files outside the intended project directory. By supplying crafted stylesheet import directives, an attacker can read sensitive local files and include...

CVE-2026-107324

A flaw was found in the MongoDB Go Driver. An unauthenticated attacker can cause a Denial of Service DoS by supplying a malformed Binary JSON BSON document to an affected application. Due to an integer overflow during BSON value-length processing, validating or accessing the malformed input...

CVE-2026-19029

A flaw was found in HDF5. When decompressing data using the scale-offset filter, the library fails to verify whether a compressed data chunk is large enough before reading from it. An attacker could exploit this vulnerability by enticing a user or service to process a specially crafted HDF5 file,...