221473 matches found
CVE-2026-106435
A flaw was found in pymongo. An attacker who can supply crafted BSON Binary JSON data to the application's decoding functions can trigger an out-of-bounds read when parsing a truncated regular expression missing a terminating null byte. This flaw can cause the application process to terminate...
CVE-2026-78669
A flaw was found in the Go net/http package. This flaw allows a remote attacker to cause a Denial of Service DoS by triggering excessive CPU consumption on an affected client or server. By opening a large number of HTTP/2 streams and repeatedly sending small configuration SETTINGS frames that...
CVE-2026-67693
A flaw was found in GnuTLS. The certificate verification process fails to properly reject end-entity digital certificates containing contradictory Key Usage KU and Extended Key Usage EKU extensions, which define the permitted cryptographic operations of a certificate. A remote attacker could...
CVE-2026-107698
A flaw was found in ffmpeg. When handling Real-Time Streaming Protocol RTSP streams, redirect responses are followed without validating the destination address. A malicious RTSP server can exploit this flaw to conduct Server-Side Request Forgery SSRF, bypassing protocol restrictions to probe...
CVE-2026-107697
A flaw was found in FFmpeg's HTTP Live Streaming HLS demuxer. A remote attacker can exploit this issue by supplying a specially crafted master playlist that references disallowed protocols or local files. This bypasses security restrictions and causes the application to open restricted resources,...
CVE-2026-107696
A flaw was found in FFmpeg. When processing media streams using the Real-Time Streaming Protocol RTSP, the client fails to enforce a limit on redirection responses. A malicious or compromised RTSP server can repeatedly redirect requests back to itself or another host, trapping the application in ...
CVE-2026-107675
A flaw was found in FFmpeg. The libssh-based SFTP SSH File Transfer Protocol handler fails to verify remote host keys when establishing connections. A remote network attacker capable of intercepting network traffic could exploit this flaw to impersonate legitimate SFTP servers, potentially exposi...
CVE-2026-107695
A flaw was found in FFmpeg. An infinite loop vulnerability in the HTTP Live Streaming HLS demuxer allows remote attackers to cause a Denial of Service DoS. By tricking a user into processing a specially crafted, self-referencing playlist file, an attacker can force the application into an endless...
CVE-2026-107678
A flaw was found in FFmpeg. This vulnerability allows an attacker to cause a Denial of Service DoS by providing a specially crafted MP4 media file containing an excessive number of encryption metadata structures. When the application recursively frees these structures, it exhausts available stack...
CVE-2026-105826
A flaw was found in ImageMagick. A remote attacker can cause a Denial of Service DoS by submitting a specially crafted MATLAB MAT image containing highly compressed data. The MAT decoder fails to enforce configured temporary file size limits during decompression, allowing oversized temporary file...
CVE-2026-105401
A flaw was found in ImageMagick. A connecting client can transmit crafted data to the distributed pixel cache server, triggering a heap buffer overflow that overwrites memory. This issue can crash the server, resulting in a denial of service DoS...
CVE-2026-107660
A flaw was found in ffmpeg. When establishing secure connections using the mbedTLS library, hostname verification is omitted for destinations specified directly by an IP address. A remote network attacker can exploit this flaw by presenting a certificate issued by any trusted Certificate Authorit...
CVE-2026-107294
A flaw was found in Pydantic AI. When fetching remote web content or media files, the framework buffers the entire response in memory before enforcing content-size limits. A remote attacker can exploit this issue by supplying a link that streams an excessively large response, exhausting memory an...
CVE-2026-107293
A flaw was found in pydantic-ai. An information disclosure vulnerability occurs when OpenTelemetry instrumentation is configured to omit message contents, as retry prompts generated during output validation are still exported to the telemetry backend. A user with read access to telemetry logs can...
CVE-2026-107291
A flaw was found in Pydantic AI. When OpenTelemetry instrumentation is configured to exclude content, sensitive agent data is still exported to the telemetry backend through exception details, error status descriptions, and model request parameters. An attacker or unauthorized user with read acce...
CVE-2026-107677
A flaw was found in FFmpeg. An attacker could cause a Denial of Service DoS by supplying a specially crafted media presentation description .mpd manifest containing an empty media segment URL. When processed by the Dynamic Adaptive Streaming over HTTP DASH demuxer, this input triggers an infinite...
CVE-2026-107292
A flaw was found in pydantic-ai. The web development chat server fails to validate incoming HTTP Host headers, allowing a remote attacker to achieve unauthorized tool execution and information disclosure. If a developer running the local development server visits a malicious website, an attacker...
CVE-2026-107290
A flaw was found in pydantic-ai. An inefficient content parsing mechanism in the web fetching component allows a remote attacker serving a crafted web page to trigger a Denial of Service DoS. By providing specially structured or deeply nested content, the attacker can block the application's even...
CVE-2026-107287
A flaw was found in pydantic-ai. When local web fetching processes attacker-controlled web content, converting HTML containing deeply nested block elements into Markdown causes excessive CPU and memory consumption. A remote attacker can exploit this vulnerability to trigger a Denial of Service Do...
CVE-2026-98196
A flaw was found in the Linux kernel's brcmsmac wireless driver. When a timer is released, the driver fails to wait for running background tasks associated with the timer to finish before freeing memory. A local attacker could exploit this race condition to trigger a use-after-free condition,...
CVE-2026-98190
A flaw was found in the Linux kernel's wilc1000 wireless driver. The driver fails to adequately validate the length of incoming Wi-Fi Direct P2P public action frames before reading the frame header, leading to an integer underflow and out-of-bounds memory read. A nearby unauthenticated attacker c...
CVE-2026-98195
A flaw was found in the Linux kernel's iwlegacy wireless driver. This flaw allows a local user to cause a Denial of Service DoS by toggling the radio frequency kill RFKILL switch during driver initialization. Improper state tracking in the error-handling path leads to the duplicate deallocation o...
CVE-2026-98187
A flaw was found in the Linux kernel's p54 Wi-Fi driver. The driver fails to verify that an entire interface record fits within the buffer boundaries when parsing EEPROM Electrically Erasable Programmable Read-Only Memory data. An attacker capable of attaching a crafted wireless device or supplyi...
CVE-2026-98189
A flaw was found in the Linux kernel's wilc1000 wireless driver. An attacker utilizing a malicious or compromised SDIO Secure Digital Input Output hardware device can cause a Denial of Service DoS or kernel memory corruption by triggering an out-of-bounds write. This issue occurs because the driv...
CVE-2026-93861
A flaw was found in OpenStack Mistral. An authenticated project that has been granted and accepted access to another project's private workflow can further delegate that access to a third, arbitrary project without the workflow owner's knowledge or consent. The unauthorized delegation succeeds...
CVE-2026-98198
A flaw was found in the Linux kernel's PWM fan driver. A local privileged user can cause a Denial of Service DoS or memory corruption by unbinding or detaching the driver. Due to an improper cleanup sequence, internal data structures are released while the sampling timer is still active, resultin...
CVE-2026-93860
A flaw was found in OpenStack Mistral. The maintenance API endpoint is missing an authorization check, allowing any authenticated user to activate global maintenance mode on the Mistral service. When an attacker triggers maintenance mode, all write operations workflow execution creation,...
CVE-2026-98193
A flaw was found in the Linux kernel's libipw wireless driver. When processing Temporal Key Integrity Protocol TKIP network frames, the driver assumes the frame contains a complete Message Integrity Check MIC without verifying that the packet meets the minimum expected length. An attacker within...
CVE-2026-98199
A flaw was found in the Linux kernel's Power Management Bus PMBus subsystem. This vulnerability allows an attacker capable of triggering the probing of affected power management devices to cause a Denial of Service DoS or memory corruption. The issue stems from certain hardware drivers supporting...
CVE-2026-98192
A flaw was found in the Linux kernel's wcn36xx Wi-Fi driver. This vulnerability can lead to a Denial of Service DoS or system instability due to a use-after-free condition. When deinitializing the transmission acknowledgement timer during device removal, the driver stops the timer without waiting...
CVE-2026-98200
A flaw was found in the Linux kernel's HP WMI Sensors hp-wmi-sensors driver. Due to a missing lock when reading sensor properties, a race condition can occur when sensor data is freed and replaced during an update while another operation is reading it. A local user could exploit this flaw by...
CVE-2026-98188
A flaw was found in the Linux kernel's p54 wireless driver. An attacker capable of connecting a malicious wireless device could cause a Denial of Service DoS by triggering a system crash. This issue occurs because the driver fails to validate data length parameters when reading calibration curve...
CVE-2026-98194
A flaw was found in the Linux kernel's Libertas TF wireless driver. During device cleanup, the driver releases command memory buffers before stopping the associated timer callback. This timing issue creates a use-after-free condition where an active timer callback accesses released memory, allowi...
CVE-2026-98197
A flaw was found in the Linux kernel's w83791d hardware monitoring driver. This vulnerability allows a local user to cause a Denial of Service DoS by triggering a kernel crash. During driver removal, the driver fails to unregister optional sysfs interface files, leaving them accessible after the...
CVE-2026-98185
A flaw was found in the mwifiex driver in the Linux kernel. When processing wireless scan responses, the driver fails to properly validate response extents before calculating internal buffer boundaries. A malicious or compromised wireless device sending malformed scan response data can trigger an...
CVE-2026-97031
A flaw was found in crypto/tls. A remote attacker can trigger this vulnerability by sending a specially crafted packet containing multiple Encrypted Client Hello ECH outer extension references to a server. Processing these unauthorized references leads to excessive memory consumption, causing a...
CVE-2026-78667
A flaw was found in the Go net/http package. A remote attacker can cause a Denial of Service DoS by sending an HTTP request containing a Range header with a large number of small byte ranges. When the server processes these ranges while serving content, it consumes an excessive amount of CPU...
CVE-2026-107230
A flaw was found in AsyncHttpClient. This flaw can lead to information disclosure and privilege escalation when handling authenticated connections. The library omits user identity details when partitioning its connection pool for authentication protocols such as Kerberos and NTLM. As a result, a...
CVE-2026-107231
A flaw was found in AsyncHttpClient where an HTTP Digest authentication challenge with a missing or empty nonce is incorrectly treated as Basic authentication. A malicious origin server or proxy can trigger the client to resend the request with an Authorization: Basic header, exposing the usernam...
CVE-2026-107728
A flaw was found in strawberry-graphql. When evaluating permissions on synchronous field resolvers, the library fails to properly await asynchronous permission check results and treats the resulting objects as inherently valid. A remote attacker can exploit this flaw to bypass authorization check...
CVE-2026-107232
A flaw was found in AsyncHttpClient. When an HTTP proxy rejects an HTTPS CONNECT request, the client can incorrectly treat the still-plaintext connection to the proxy as an established tunnel. A subsequent proxy authentication challenge or redirect can cause the client to resend the origin reques...
CVE-2026-107279
A flaw was found in AsyncHttpClient. A remote attacker can bypass mutual authentication by offering HTTP Digest authentication configured with integrity protection auth-int. Because the client fails to validate the response authentication value under this configuration and treats the unverified...
CVE-2026-106411
An use after free flaw was found in the Parser component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/566136674...
CVE-2026-107227
A flaw was found in AsyncHttpClient's WebSocket permessage-deflate handling. When WebSocket compression is enabled it is disabled by default, the client does not limit the size of a message after decompression; the configured frame and buffer limits apply to the compressed data. A malicious or...
CVE-2026-106346
An improper state validation flaw was found in the DevTools component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/566404364...
CVE-2026-106396
An improper input validation flaw was found in the Omnibox component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/552423127...
CVE-2026-106273
An uninitialized resource flaw was found in the Video component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/553118338...
CVE-2026-106393
An use after free flaw was found in the Storage component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/559793873...