CVE-2026-71884

A flaw was found in Bouncy Castle. The native one-shot Counter CTR mode cipher fails to verify that the input data length fits within the counter space defined by the initialization vector. When processing overly long inputs, the counter wraps around and causes the keystream to repeat. This flaw...

CVE-2026-87744

A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explicitly re-declaring security roles, the code generator silent...

CVE-2026-109274

A flaw was found in ImageMagick. This vulnerability allows information disclosure by enabling a local attacker to bypass path security policies during the execution of a magick script. By exploiting a Time-of-Check to Time-of-Use TOCTOU race condition, an attacker can replace a validated file pat...

CVE-2026-109273

A flaw was found in ImageMagick. An attacker could exploit this vulnerability by providing a specially crafted PostScript file for processing. Because the PostScript decoder allocates more memory than necessary, this issue can result in information disclosure by exposing uninitialized memory...

CVE-2026-109267

A flaw was found in ImageMagick. An attacker could cause a Denial of Service DoS by supplying specially crafted Magick Scripting Language MSL files. An incorrect depth check in the MSL decoder fails to limit recursion during processing, leading to stack exhaustion and causing the application to...

CVE-2026-109271

A flaw was found in ImageMagick. An attacker can exploit this vulnerability by submitting a specially crafted image for processing. If a memory allocation failure occurs within the WBINFO decoder during image decoding, the application improperly accesses previously freed memory. This issue causes...

CVE-2026-109258

A flaw was found in ImageMagick. An invalid memory free vulnerability occurs during the handling of fx operations when initialization of a runtime entry fails. An attacker can exploit this vulnerability by providing input that triggers the initialization failure, leading to memory corruption and ...

CVE-2026-109351

A flaw was found in the gix-pack component of Gitoxide. A malicious remote repository can cause a Denial of Service DoS by providing a crafted pack header with an excessively large object count during clone or fetch operations. This forces the client to attempt an uncontrolled memory allocation,...

CVE-2026-109345

A flaw was found in DOMPurify. This vulnerability allows a remote attacker to conduct cross-site scripting XSS attacks by bypassing HTML sanitization when the library operates in in-place mode. When processing raw text elements containing embedded markup, the library removes the element but fails...

CVE-2026-109344

A flaw was found in DOMPurify. When performing in-place sanitization directly on active webpage elements, the library fails to neutralize content detached by post-processing hooks. A remote attacker can exploit this issue by supplying crafted markup containing malicious event handlers inside...

CVE-2026-109269

A flaw was found in ImageMagick. An information disclosure vulnerability exists in the JPEG decoder when handling crafted input. A remote attacker could exploit this flaw by submitting a specially crafted JPEG file for processing, causing the application to read uninitialized memory and disclose...

CVE-2026-109265

A flaw was found in ImageMagick. A remote attacker can exploit this vulnerability to trigger an application crash, resulting in a Denial of Service DoS. The issue is caused by improper string termination in Extensible Metadata Platform XMP profiles, which leads to a heap buffer over-read when...

CVE-2026-109259

A flaw was found in ImageMagick. An uninitialized memory read in the Truevision TGA TGA image decoder allows an attacker to cause information disclosure. By supplying a specially crafted TGA image for processing, an attacker can access uninitialized memory contents from the ImageMagick process...

CVE-2026-93879

A flaw was found in Hibernate Validator starting with version 5.4.1. This vulnerability allows an unauthenticated remote attacker to cause a Denial of Service DoS by submitting specially crafted input containing unescaped message parameters. Improper escaping allows user-supplied data to be...

CVE-2026-75888

A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery SSRF vulnerability by providing a specially crafted Helm chart URL without proper validation. This allows the user to make the console pod fetch arbitrary URLs, potentially leading t...

CVE-2026-96618

A flaw was found in hex. An untrusted package mirror can trigger a Denial of Service DoS by serving excessively large or highly compressed responses when fetching packages, documentation, or registry metadata. Because the client processes and decompresses incoming network data without enforcing...

CVE-2026-81856

A flaw was found in hex. A remote attacker can inject unescaped terminal control sequences into the output of package manager commands by publishing a package with crafted metadata or serving hostile repository responses. When a user inspects package details, searches for packages, or views error...

CVE-2026-96612

A flaw was found in hex. This path traversal vulnerability allows a malicious package publisher to achieve arbitrary code execution and data loss. By specifying directory traversal sequences in a dependency application name, an attacker can manipulate the target directory outside the intended...

CVE-2026-94451

Quarkus REST Data Panache provides a way to automatically generate REST endpoints for data entities. A flaw was found where certain endpoints do not properly check the sort parameter provided by users. This could allow an attacker to learn information they should not have access to or slow down t...

CVE-2026-105668

A flaw was found in hex. This vulnerability allows an attacker with package owner privileges to bypass release-age cooldown security controls when publishing a new package release. By retiring an existing package release, the attacker triggers an automatic cooldown bypass, causing downstream...

CVE-2026-105280

A flaw was found in hex. This vulnerability allows a malicious package mirror to bypass integrity checks and substitute package files, which can lead to arbitrary code execution in downstream build pipelines. When downloading packages directly to standard output, hex fails to verify the archive's...

CVE-2026-103503

A flaw was found in hex. When a custom Certificate Authority CA store is configured to restrict trusted authorities, hex inadvertently continues to validate certificate chains against its bundled CA certificates. An attacker capable of intercepting network traffic and holding a certificate issued...

CVE-2026-109194

A flaw was found in Red Hat Quay. The build trigger management application programming interface API fails to verify whether a requested trigger belongs to the specified repository. An authenticated user with administrative access to any repository can view, modify, or permanently delete build...

CVE-2026-107378

A flaw was found in CairoSVG. A remote attacker can cause a Denial of Service DoS by providing a specially crafted Scalable Vector Graphics SVG file containing paths with numerous segments. Inefficient path processing leads to excessive CPU resource consumption during rendering, causing the...

CVE-2026-109195

A flaw was found in Quay. An authenticated attacker can access repository auto-prune configurations from other namespaces, leading to unauthorized information disclosure. This issue occurs because the application does not properly enforce namespace scoping when retrieving policy details by...

CVE-2026-15340

A flaw was found in lwIP. The Simple Mail Transfer Protocol SMTP client does not properly validate the size of inputs, leading to a buffer overflow. A malicious SMTP server could use this flaw to crash or possibly execute arbitrary code with the privileges of the SMTP client by sending an...

CVE-2026-52131

A flaw was found in llama.cpp. This vulnerability, triggered by a reachable assertion, could allow an attacker to cause a denial of service DoS. A successful exploit would make the affected system or application unavailable to legitimate users. Mitigation Restrict model loading permissions to...

CVE-2026-102268

A flaw was found in PyJWT. When an application allows both symmetric and asymmetric signing algorithms, minor formatting variations in a public key can prevent the library from properly identifying it as an asymmetric key. Consequently, the library improperly treats the public key as a shared...

CVE-2026-52132

A flaw was found in llama.cpp. A remote attacker can exploit this vulnerability when the application is started with the --reranking flag. By sending a POST request to the /rerank endpoint with a negative topn value, the attacker can cause a std::badalloc error and an HTTP 500 response, leading t...

CVE-2026-105081

A flaw was found in ImageMagick. The application does not properly validate symbolic links shortcuts pointing to other files during security policy authorization checks. A local attacker can exploit this vulnerability by creating a symbolic link that points to a restricted file path, allowing the...

CVE-2026-108094

A use-after-free flaw was found in mutter in the Wayland color-management ICC image-description path. A local attacker who can run a malicious Wayland client can destroy a wpimagedescriptionv1 resource while an asynchronous ICC file read is still in progress. When the read completes, the composit...

CVE-2026-93516

A flaw was found in xorg-x11-server. A local user can exploit a use-after-free condition—where the software attempts to access memory after it has been freed—by establishing a passive input grab and removing an input device. When subsequent input events are processed, the server dereferences the...

CVE-2026-98385

A flaw was found in the Linux kernel. A race condition when switching memory management contexts allows the process scheduler to access memory that has already been freed, leading to a use-after-free condition. A local attacker could exploit this vulnerability to cause a Denial of Service DoS by...

CVE-2026-109082

A flaw was found in the Client-Initiated Backchannel Authentication CIBA implementation within the keycloak-services component of Keycloak. This component handles advanced authentication flows where a client initiates a login on behalf of a user. The issue occurs because Keycloak fails to verify...

CVE-2026-107203

An incorrect authorization flaw has been found in network interface handling in the Foreman package. The domain and subnet interface API checks only that the caller holds a host permission. It does not apply the search limit on that permission, so the request is answered from every interface on t...

CVE-2026-107193

A flaw has been found in permission filters in the foreman package. The API loads a filter by its identifier and does not apply the search limit on the caller's permission. A low-privileged network attacker or user must already be allowed to delete filters for one role only. They can delete filte...

CVE-2026-108104

A flaw was found in snappy-java. A remote attacker can cause information disclosure or data corruption by supplying framed data with an excessively large chunk length. This input triggers an out-of-memory condition during buffer reallocation in SnappyFramedInputStream, causing pooled memory buffe...

CVE-2026-108859

A flaw was found in mcp-go. The HTTP server implementation does not restrict the size of incoming HTTP POST request bodies before buffering them into memory. A remote, unauthenticated attacker can exploit this vulnerability by sending excessively large or multiple concurrent requests, causing...

CVE-2026-95702

A flaw was found in Google gVisor's Virtual File System VFS. A local attacker with standard container privileges can exploit this vulnerability to achieve arbitrary code execution within the host sentry process. By improperly releasing a backing memory file multiple times from an in-sandbox overl...

CVE-2026-108858

A flaw was found in lorax. The service writes caller-supplied API Application Programming Interface tokens from request bodies directly into router logs and tracing data. An attacker with access to system logs or telemetry backends can exploit this flaw to view other users' private authentication...

CVE-2026-108731

A flaw was found in raven. A missing authorization check allows an authenticated remote attacker to bypass the invite-only workspace restriction. By directly calling the workspace joining function, an attacker can gain unauthorized membership to invite-only workspaces, enabling them to read and...

CVE-2026-108730

A flaw was found in Raven. Legacy application programming interface API endpoints fail to verify workspace membership when retrieving messages and shared files. An authenticated remote attacker who is not a member of a workspace can exploit this flaw using predictable channel identifiers, resulti...

CVE-2026-108749

A flaw was found in docling-serve. An unauthenticated remote attacker can access sensitive process memory metrics and trigger internal garbage collection routines by querying memory monitoring endpoints that fail to enforce authentication controls. Successful exploitation allows an attacker to...

CVE-2026-108575

A flaw was found in LiteLLM. A remote attacker can exploit improper authorization within the secret resolution mechanism by manipulating the apikey parameter. This vulnerability allows an attacker to bypass authorization controls and potentially access protected secrets or resources. Mitigation...

CVE-2026-92871

A flaw was found in pgpool-II. A remote, unauthenticated attacker could cause a Denial of Service DoS due to a NULL pointer dereference in the watchdog component. Exploiting this vulnerability leads to abnormal termination of the watchdog process. Mitigation Restrict network access to the pgpool-...

CVE-2026-98249

A flaw was found in the Linux kernel. This vulnerability may allow a local privileged user to cause a Denial of Service DoS on ARM64 systems. When resuming from hibernation, the kernel fails to supply the required parameters when resetting hypervisor exception vectors, leaving the hypervisor...

CVE-2026-98248

A flaw was found in the Linux kernel's arm64 per-CPU memory operations. When performing atomic operations on 8-bit and 16-bit variables using Large System Extensions LSE, the assembly instructions fail to specify the proper size suffix, erroneously reading and writing 32 bits of memory. A local...

CVE-2026-98247

A flaw was found in the Linux kernel's Bluetooth subsystem. When processing responses for supported codecs, the parser fails to verify that adequate buffer space remains before reading the vendor codec count. A malicious or malfunctioning Bluetooth controller can supply a truncated response packe...

CVE-2026-98246

A flaw was found in the Linux kernel's Bluetooth subsystem. A race condition during Bluetooth device closure allows codec list cleanup to proceed without appropriate locking while a concurrent socket option query is reading codec entries. A local user can exploit this vulnerability to trigger a...

CVE-2026-98245

A flaw was found in the Linux kernel's Btrfs file system. A local user could exploit this vulnerability to cause a Denial of Service DoS or potentially escalate privileges. The issue occurs due to missing synchronization during device replacement operations, where a concurrent transaction commit...