CVE-2026-92048

Sandbox escape due to incorrect boundary conditions in the Widget: Win...

CVE-2026-92065

Sandbox escape due to incorrect boundary conditions in the Widget: Win...

CVE-2026-91991

Tornado before 6.5.8 contains an incomplete fix for cookie attribute i...

CVE-2026-91986

gitoxide gix-transport before 0.59.2 fails to filter control character...

CVE-2026-92015

Privilege escalation in the WebExtensions component. This vulnerabilit...

CVE-2026-92017

Privilege escalation in the DOM: Service Workers component. This vulne...

CVE-2026-92032

Sandbox escape due to invalid pointer in the Graphics component. This...

CVE-2026-92049

Use-after-free in the Widget: Win32 component. This vulnerability was...

CVE-2026-91960

GHSA-vccg-35r5-8jrf: StreamEnsureCapacity still overflows...

CVE-2026-92044

Information disclosure in the Networking: HTTP component. This vulnera...

CVE-2026-92043

Privilege escalation due to incorrect boundary conditions in the Audio...

CVE-2026-92060

Use-after-free in the Internationalization component. This vulnerabili...

CVE-2026-91953

GHSA-r9pv-ffph-6gg6: Heap buffer overflow in negosendnegotiationrequest via oversized LBLOADBALANCEINFO routing token...

CVE-2026-92033

Privilege escalation in Firefox for Android. This vulnerability was fi...

CVE-2026-92053

Privilege escalation in the Graphics: CanvasWebGL component. This vuln...

CVE-2026-91955

GHSA-4464-r7qj-pgrx: FreeRDP: server stores client Core Data DesktopWidth/Height unvalidated in GCC negotiation...

CVE-2026-92050

Sandbox escape due to race condition in the XPConnect component. This...

CVE-2026-91962

GHSA-f5p6-88mh-59vg: audin Apple backends perform overflow-prone buffer size arithmetic from server-controlled values...

CVE-2026-92062

Privilege escalation in the Session Restore component. This vulnerabil...

CVE-2026-91990

Tornado before 6.5.8 contains a memory amplification vulnerability in...

CVE-2026-92031

Information disclosure in the Graphics: ImageLib component. This vulne...

CVE-2026-92041

Mitigation bypass in the DOM: Networking component. This vulnerability...

CVE-2026-92079

Mitigation bypass in the Widget: Win32 component. This vulnerability w...

CVE-2026-91956

GHSA-hg4r-vv53-vwf8: URBDRC out-of-bounds read in funcgetepdesc via InterfaceNumber/array-position index mismatch...

CVE-2026-92040

Use-after-free in the JavaScript: WebAssembly component. This vulnerab...

CVE-2026-92029

Use-after-free in the SVG component. This vulnerability was fixed in F...

CVE-2026-92056

Use-after-free in the Graphics: Text component. This vulnerability was...

CVE-2026-92073

Privilege escalation in the Enterprise Policies component. This vulner...

CVE-2026-91945

GHSA-q65v-4w7q-hx3r: Smartcard response lengths are not bounded to their inline ATR arrays...

CVE-2026-92037

Incorrect boundary conditions in the DOM: Animation component. This vu...

CVE-2026-91992

Tornado before 6.5.7 contains a credential leak vulnerability in CurlA...

CVE-2026-53660

Open Access Management OpenAM is an access management solution. Prio...

CVE-2026-39919

Ghostscript before 10.08.0 contains a heap-based buffer overflow vulnerability in the JPEG 2000 output adapter base/sjpxopenjpeg.c that allows attackers to cause memory corruption by supplying a crafted PDF containing a JPEG 2000 image with mismatched component subsampling factors. When image...

CVE-2025-11395

A flaw was found in Podman. If an attacker can pass a crafted tar archive to the podman load command, they can create files on the host machine with the privileges of the user running Podman...

CVE-2026-19774

BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in...

CVE-2026-19773

libwebsockets HTTP/2 HPACK Path Header Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to exploit this vulnerability. The specific flaw...

CVE-2024-14029

Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to perform HTTP request smuggling, enabling...

CVE-2024-58384

Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers. Attackers can inject CRLF sequences into header values to inject arbitrary headers or construct entirely new HTTP requests...

CVE-2023-54397

Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain...

CVE-2026-41573

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, IdentityResourceV1.queryCollection passes the queryId parameter from /json/realm/users to CrestQuery with escapeQueryId disabled, bypassing protection added for CVE-2021-29156. The unescaped value reaches...

CVE-2026-45052

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the Liberty Web Services SOAP receiver permits unauthenticated remote requests to write persistent entries through SOAPReceiver and DiscoveryService into a user's Liberty Discovery store and the shared root-realm...

CVE-2026-45794

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the anonymous Push Notification SNS callback handled by SnsMessageResource falls back to a CTS predicate blob after a messageId expires from the in-memory dispatcher, treats top-level blob keys as Java class names fo...

CVE-2026-44202

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the /sessionservice addSessionListener operation allows an authenticated user to register an arbitrary notification URL without requiring an administrative or application client token. SessionRequestHandler passes th...

CVE-2026-45048

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, SessionRequestHandler in the session management endpoint does not enforce ownership or privilege checks when a low-privileged authenticated user queries session information in deployments using stateful session...

CVE-2026-44793

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, certain federation endpoints in a non-default clustered configuration inconsistently encode user-supplied parameters rendered into HTML in the SAML2 cluster cookie-hash redirect path. An unauthenticated attacker can...

CVE-2026-44203

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the OAuth 2.0 and OpenID Connect authorization endpoint does not sufficiently encode user-supplied parameters before FormPostResponse.ftl and checkSession.ftl render them into HTML for the formpost response mode. An...

CVE-2026-91826

Stack-based buffer overflow vulnerability in Samsung Opensource rLottie allows attackers to overflow buffers, leading to memory corruption when rendering crafted vector animations. This issue affects rLottie: 480a2ad0c5d2e45458c545b8213279e9e8b71e39...

CVE-2026-91781

A security vulnerability has been detected in GNU Binutils 2.47. Affected is the function elfx8664commonsectionindex of the file bfd/elf64-x86-64.c of the component ELF Section Handler. The manipulation leads to null pointer dereference. The attack needs to be performed locally. The exploit has...

CVE-2026-91780

A weakness has been identified in GNU Binutils 2.47. This impacts the function elflinkaddobjectsymbols of the file bfd/elflink.c. Executing a manipulation can lead to null pointer dereference. The attack needs to be launched locally. The exploit has been made available to the public and could be...

CVE-2026-91782

A vulnerability was detected in GNU Binutils 2.47. Affected by this vulnerability is the function elfx86allocatedynrelocs of the file bfd/elfxx-x86.c of the component Dynamic Relocation Allocation. The manipulation results in null pointer dereference. The attack requires a local approach. The...