CVE-2026-19585

A flaw was found in go-getter. A remote attacker can exploit a path traversal vulnerability to write files outside of the intended target directory during directory downloads from Amazon Simple Storage Service S3 or Google Cloud Storage GCS. By supplying specially crafted file paths within a remo...

CVE-2026-61801

A flaw was found in the moby/sys/user package. The package does not properly limit memory allocation when parsing Unix-style user and group database files, such as /etc/passwd or /etc/group. An attacker who can supply a specially crafted file can cause excessive memory consumption, leading to a...

CVE-2026-98287

A flaw was found in the Linux kernel's Point-to-Point Protocol over ATM PPPoATM subsystem. This vulnerability allows a local attacker to cause a Denial of Service DoS or memory corruption by transmitting network packets across bridged Point-to-Point Protocol PPP channels. The issue occurs because...

CVE-2026-98203

A flaw was found in the Linux kernel's SoC System on Chip button array driver. The driver fails to verify that the button descriptor package contains entries before accessing them during device initialization. This issue may allow an invalid device configuration to trigger an out-of-bounds memory...

CVE-2026-98272

A flaw was found in the Linux kernel's Marvell mvpp2 network driver. This vulnerability can lead to a Denial of Service DoS due to an out-of-bounds memory access. A local user with network configuration privileges can trigger this issue by altering the Maximum Transmission Unit MTU, which causes...

CVE-2026-98202

A flaw was found in the Linux kernel's Synaptics RMI4 input driver. When system power management operations such as suspend or resume occur while an RMI4 device remains unbound, the driver attempts to access uninitialized driver data without proper verification. This issue leads to a null pointer...

CVE-2026-98262

A flaw was found in the Linux kernel's libahci driver. This issue can lead to a Denial of Service DoS when initializing storage controllers configured to use 32-bit Direct Memory Access DMA. Because the driver fails to clear the upper 32-bit memory address registers on hardware that physically...

CVE-2026-98201

A flaw was found in the Linux kernel's input subsystem. When handling 32-bit compatibility requests for force feedback input effects, the kernel fails to properly initialize memory buffers before copying data from user space. A local user can exploit this vulnerability to read uninitialized kerne...

CVE-2026-98224

A flaw was found in the Linux kernel's memory management subsystem. A local user could cause a Denial of Service DoS by triggering a failure during a memory mapping preparation operation. Because the kernel fails to properly release accounted memory when this operation fails, repeated triggers ca...

CVE-2026-101028

A flaw was found in the Ash framework. An authorized user can infer sensitive information from restricted related records by submitting queries that use aggregate functions, such as counting or checking for record existence. Because read authorization policies on related resources are not enforce...

CVE-2026-98303

A flaw was found in the Linux kernel's IPv4 networking subsystem. When looking up routes to send Internet Control Message Protocol ICMP error messages, the kernel fails to properly reject unreachable input routes. A remote attacker can exploit this flaw by transmitting network packets that trigge...

CVE-2026-98289

A flaw was found in the Linux kernel's UNIX domain socket afunix subsystem. A logic error in the socket garbage collection algorithm can prevent cyclical socket references from being properly identified and reclaimed. A local user could exploit this flaw to cause a resource leak, potentially...

CVE-2026-106506

A flaw was found in plugin-scaffolder-backend. This vulnerability allows an authenticated user with permission to create and view tasks to access confidential task secrets, resulting in information disclosure. Due to improper input validation in task list ordering, an attacker can submit repeated...

CVE-2026-98239

A flaw was found in the Linux kernel's LAN743x network device driver. This vulnerability allows an attacker capable of transmitting network traffic to an affected system to cause a Denial of Service DoS or memory corruption. The issue occurs because the driver attempts to update checksum...

CVE-2026-57941

A flaw was found in the modhttp2 module of Apache HTTP Server. A remote, unauthenticated attacker could exploit a use-after-free condition—where memory is accessed after being released—through re-entrant processing of shared session buffers. This flaw can allow an attacker to potentially execute...

CVE-2026-98234

A flaw was found in the Linux kernel's Heavy-Hitter Filter HHF network packet scheduler. A local user with network administration privileges, such as within a container or user namespace, can set an excessively large flow limit due to missing upper-bound validation. When the system subsequently...

CVE-2026-98219

A flaw was found in the Linux kernel's schedext subsystem. A local attacker could exploit a race condition during scheduler initialization to cause a denial of service DoS or potentially escalate privileges. When an error is triggered during the enablement of an extensible scheduler, the kernel...

CVE-2026-107634

A flaw was found in dislocker. An attacker can exploit this issue by providing a specially crafted BitLocker volume image containing inflated metadata sizes. When the application opens or mounts the image, it fails to properly validate these boundaries, triggering an out-of-bounds memory read. Th...

CVE-2026-98227

A flaw was found in the Linux kernel's MemoryStick block driver. The driver fails to release its internal input/output work queue when a card is removed from the system. A local attacker with physical access could exploit this flaw by repeatedly inserting and removing storage cards, gradually...

CVE-2026-87121

A flaw was found in lwIP’s MQTT client. When parsing malformed MQTT fixed headers, the client can write beyond its receive buffer. A remote peer supplying crafted MQTT traffic could cause a client crash or potentially execute arbitrary code on the device. The reported affected versions are 2.0.1...

CVE-2026-92123

A flaw was found in the Jenkins Script Security Plugin. Attackers with permissions to define and run sandboxed scripts, including Pipelines, can exploit this vulnerability. The plugin does not properly intercept operations performed on a null receiver, such as method calls or property accesses...

CVE-2026-98326

A flaw was found in the Linux kernel's mac80211 wireless subsystem. When an attempt to start a wireless mesh network fails, the channel context is not properly released. A local user could exploit this flaw during network interface removal, leading to driver state inconsistency and a potential...

CVE-2026-101894

A flaw was found in the @xhmikosr/decompress and decompress packages for Node.js. The default decompressinput, output API relies on lexical containment checks that do not account for the kernel following a planted symlink chain. An attacker can supply a crafted archive containing chained symlink...

CVE-2026-94444

A flaw was found in the Go toolchain cmd/go. When a user works inside a malicious Go project that defines a bogus golang.org/fips140 module and connects to an untrusted Go module proxy GOMODPROXY, the proxy can serve an arbitrary replacement module that still passes local verification. This can...

CVE-2026-94447

A flaw was found in the Go toolchain cmd/go. When a user works inside a malicious Go project that forges a golang.org/toolchain go.sum entry and uses an untrusted Go module proxy, cmd/go can skip the canonical checksum database check for toolchain downloads. A tampered toolchain may then be...

CVE-2026-107889

A flaw was found in the login theme rendering component of Keycloak. The issue occurs because the security filter responsible for cleaning user input can be bypassed, allowing a realm administrator to store malicious scripts in display fields. This could result in unauthorized JavaScript executio...

CVE-2026-106193

An use after free flaw was found in the Parser component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/557729858...

CVE-2026-106332

An integer overflow flaw was found in the Compositing component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/553454734...

CVE-2026-98372

A flaw was found in the Linux kernel's IP Traffic Flow Security IP-TFS implementation within the XFRM subsystem. When processing incoming network traffic, a missing boundary check on packet fragment offsets allows an unbounded loop to read memory past the end of an on-stack array. A remote attack...

CVE-2026-98186

A flaw was found in the Linux kernel's mwifiex Wi-Fi driver. A nearby wireless attacker can exploit this vulnerability by broadcasting crafted Wi-Fi beacon or probe response frames containing an excessively large pairwise cipher count. Because the driver fails to validate this count against the...

CVE-2026-56857

A flaw was found in the Go standard library's file system operations on Windows. Scoped directory operations fail to properly restrict directory creation when processing Windows junction points links redirecting to other folder locations that point outside the designated root directory. An attack...

CVE-2026-107727

A flaw was found in strawberry-graphql, which could lead to a denial of service DoS on affected connections. When a limit on subscriptions per connection is configured, the legacy subscription handler fails to properly remove completed operations from internal tracking. A remote client can exhaus...

CVE-2026-105400

A flaw was found in ImageMagick. This vulnerability allows an attacker to cause a Denial of Service DoS by submitting a specially crafted magick script. When processing the malicious script, the application fails to properly close open file handles, leading to a resource leak. Repeated execution...

CVE-2026-107288

A flaw was found in pydantic-ai. The web fetching utilities fail to normalize domain names before checking them against the configured blocklist. A remote attacker capable of influencing the model output can supply alternate character encodings, case variations, or trailing labels that resolve to...

CVE-2026-98191

A flaw was found in the Linux kernel's wlcore Wi-Fi driver. When configuring a wireless regulatory domain fails, the driver does not release an acquired runtime Power Management PM reference. A local user could exploit this flaw during device configuration failures to cause a reference count leak...

CVE-2026-107676

A flaw was found in FFmpeg. This vulnerability allows an attacker to trigger an information disclosure by providing a specially crafted media file containing manipulated High Dynamic Range HDR metadata. When FFmpeg processes the media file during conversion or transcoding, uninitialized memory...

CVE-2026-107289

A flaw was found in pydantic-ai. This vulnerability can lead to information disclosure, potentially exposing sensitive cloud credentials such as Identity and Access Management IAM tokens. In configurations where local network access is permitted for untrusted requests, a remote attacker can bypas...

CVE-2026-94448

A flaw was found in the html/template package in Go. This vulnerability allows a remote attacker to conduct cross-site scripting XSS, an attack that executes malicious scripts in a user's browser through improper output escaping. When a JavaScript template literal contains consecutive expressions...

CVE-2026-56866

A flaw was found in Go's net/http package. When an HTTP CONNECT request with a request body is rejected by a server, the client transport can desynchronize the connection before returning it to the shared idle pool. In shared reverse proxy environments, a remote attacker can exploit this issue to...

CVE-2026-78663

A flaw was found in Go's HTTP/2 server implementation. A remote attacker can bypass connection-level flow control limits—mechanisms that regulate incoming network data—potentially causing excessive memory consumption and a Denial of Service DoS. This issue occurs because the server improperly...

CVE-2026-97032

A flaw was found in Go's net/http package. A remote attacker can cause a Denial of Service DoS by crashing the HTTP/2 server. Due to missing synchronization, the server concurrently modifies its HPACK HTTP/2 header compression encoder when encoding response headers while processing incoming table...

CVE-2026-105405

A flaw was found in ImageMagick. A remote attacker could exploit this vulnerability by supplying a specially crafted Magick Vector Graphics MVG image for processing. When parsed by the MVG decoder, the malformed input triggers an invalid memory free operation, crashing the application and causing...

CVE-2026-105827

A flaw was found in ImageMagick. A remote attacker can trigger a Denial of Service DoS by providing a specially crafted image file in the Continuous Acquisition and Life-cycle Support CALS format. Because the CALS decoder fails to properly limit recursion depth, processing the malicious image...

CVE-2026-94439

A flaw was found in Go's net/http package. When an HTTP server sends a successful response to an HTTP/1 CONNECT request without taking raw control of the connection, it improperly continues to process incoming data as standard HTTP requests instead of establishing a tunnel. A remote attacker can...

CVE-2026-107708

A flaw was found in krb5. This vulnerability allows a compromised or malicious cross-realm trusted Key Distribution Center KDC to cause a Denial of Service DoS. By sending an S4U2Proxy delegation request containing a malformed client name within a Privilege Attribute Certificate PAC, an attacker...

CVE-2026-107778

A flaw was found in krb5. An authenticated remote attacker can cause a Denial of Service DoS by sending specially crafted forwarded credentials containing mismatched credential entries. This improper handling triggers a null pointer dereference, causing the service to crash and become unavailable...

CVE-2026-107705

A flaw was found in Poppler. A stack-based buffer overflow vulnerability exists in the decryption routine when processing encrypted PDF documents. By providing an overly long password during document decryption, an attacker can overwrite memory buffers. This issue primarily leads to a Denial of...

CVE-2026-107715

A flaw was found in mechanize. The library fails to strip caller-supplied credential headers when following cross-origin Hypertext Transfer Protocol HTTP redirects. A remote attacker who controls the target server of a redirect can exploit this vulnerability to capture sensitive authentication...

CVE-2026-107714

A flaw was found in mechanize. The library treats redirects to the same host as same-origin requests without verifying whether the communication protocol scheme or port has changed. A malicious server can exploit this flaw to cause information disclosure by redirecting connections from secure HTT...

CVE-2026-107399

A flaw was found in mechanize. When automatic meta refresh following is enabled, the library fails to restrict request headers across different web domains during a redirect. A remote attacker who controls web content during a crawl can redirect requests to an untrusted destination, leading to...