CVE-2026-109869

undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch implementation crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before...

CVE-2026-109932

undici is an HTTP client library for Node.js. In versions 5.15.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its WebSocket client, including the bundled WebSocket exposed by Node.js, can be driven to exhaust process memory by a malicious or compromised WebSocket server. For...

CVE-2026-87018

undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does no...

CVE-2026-109829

undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, the cache builds its key from the original request URL before the redirect handle...

CVE-2026-109841

undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI specification defines the token by its...

CVE-2026-87029

undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its decompress interceptor forwards decompressed response data to the downstream handler from zlib stream event callbacks without catching exceptions those callbacks may throw, and while...

CVE-2026-18662

In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combined properly per Jakarta Servlet Spec. Resulting in later http-method-omission sets overriding previous...

CVE-2026-62322

Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backend exchanges an authorization code without validating the returned OAuth state. An attacker can begin authorization for an attacker-controlled LINE account and induce a victim to visit the resultin...

CVE-2026-110876

AdPlug through 2.4 contains an out-of-bounds read vulnerability in src/xsm.cpp that allows attackers to read before notetable by supplying a negative note index. Attackers can craft an XSM file with the ofTAZ! signature and a song byte of 0x80 or higher, causing a global-buffer-overflow read duri...

CVE-2026-111379

FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistentcachereadentryv3 that allows local attackers to corrupt memory by supplying a crafted v3 persistent cache file. Attackers can set large width and height values that wrap the size calculation in persistcachegetdata,...

CVE-2026-104266

tinytag is a Python library for reading audio file metadata. From 2.0.0 until 2.3.0, an M4A file containing a sub-atom with a size of zero inside a ---- atom can cause the metadata parser to stop advancing through the input. The custom-field atom traversal repeatedly processes the malformed...

CVE-2026-109383

undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool, and because JSON cannot represent...

CVE-2026-109924

undici is an HTTP client library for Node.js. In versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its EventSource client can be driven to exhaust process memory by a malicious or compromised Server-Sent Events peer. By sending millions of tiny completed data fields...

CVE-2026-102631

In authd before 0.7.1, the user identity matching in UpdateUser internal/users/manager.go resolves an incoming login by the broker-scoped provider ID, but falls back to matching the username when the provider ID does not belong to any known user, and does not reject a conflicting non-empty provid...

CVE-2026-93483

In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions by manipulating a specific HTTP request header. Because the application incorrectly trusts this header, an attacker can impersonate any user, including...

CVE-2026-93484

Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQL statement. This lack of proper sanitization or the use of parameterized queries allows an attacker to inject arbitrary SQL commands, leading to data theft, modification, or...

CVE-2026-79610

XSA-501 was about issues with v1 - v2 and v2 - v1 changes racing certain other grant table operations. Sadly a v2 - v1 - v2 change has yet another effect which wasn't accounted for: During the first change, status pages would be freed. During the second change they would be allocated again. Hence...

CVE-2026-76184

In Eclipse Jetty, HttpClient may receive a redirect of the form: /secure/../evil If an attacker is able to control the redirects, then HttpClient matches authentication credentials against /secure rather than normalizing the path to /evil, and will therefore follow the redirect sending the...

CVE-2026-76182

In Eclipse Jetty, TryPathsHandler and TryFilesFilter can be configured to forward requests to template URIs such as index?p=$path, where $path is the request path in context. However, URI paths may contain characters that are reserved in URI queries so that a path of /s&a=1 when applied to the...

CVE-2026-88829

A flaw was found in BusyBox httpd's reverse proxy feature. When the proxy is configured to forward requests matching a URL prefix to a backend server, only the first HTTP request on a TCP connection has its path rewritten. An attacker can send a pipelined second request that is relayed verbatim t...

CVE-2026-86856

A flaw was found in the DPDK nfp vDPA driver. Stack and heap buffers sized for a single queue pair can be overflowed when more virtqueues are configured, leading to a host crash or memory corruption...

CVE-2026-86563

A flaw was found in DPDK lib/vhost. A double-offset bug in vhost log mapping calculation can lead to incorrect memory access...

CVE-2026-86566

A flaw was found in DPDK lib/vhost. A guest with runt RX descriptors can underflow the copy length in vhost enqueue, causing a denial of service in a shared vhost backend such as OVS-DPDK...

CVE-2026-110923

A flaw was found in OpenSSH. During an sftp copy, a malicious server can supply an empty name, a slash-only path, or a ".." basename that sftp uses as the local destination, writing outside the directory the user selected...

CVE-2026-67418

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, the MQTT 5 parser in deps/rabbitmqmqtt/src/rabbitmqttpacket.erl accepts Request-Problem-Information on PUBLISH packets even though the property is valid only for CONNECT. An authenticated...

CVE-2026-102944

cpp-httplib is a C++ header-only HTTP/HTTPS library. Prior to 0.51.0, createredirectclient removes Host, Proxy-Authorization, and Authorization headers when following a cross-origin 301, 302, 307, or 308 redirect but leaves Cookie headers attached. detail::redirect copies the request for those...

CVE-2026-86562

A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue handler...

CVE-2026-86565

A flaw was found in DPDK lib/vhost. A guest can desynchronize virtqueue size from inflight descriptor table size, causing an out-of-bounds write in the host vhost process...

CVE-2026-88834

A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limite...

CVE-2026-110834

FreeRDP from 2.0.0 before 3.32.0 contains a null pointer dereference vulnerability that allows malicious RDP servers to crash clients by sending out-of-lifecycle serial IRPs. Attackers can send IRPMJREAD or IRPMJWRITE before create or after close, causing CommReadFile or CommWriteFile to...

CVE-2026-110661

CGNS through 4.5.2 contains a stack out-of-bounds read vulnerability in ADFIreadnodeheader that allows attackers to crash applications by supplying crafted ADF node headers. Attackers can craft .cgns or .adf files whose non-NUL-terminated end tag causes ADFIstridxc to scan past disknodedata,...

CVE-2026-110839

FreeRDP 3.3.0 before 3.32.0, when built with WINPRUTILSIMAGEJPEG=ON, has a heap-based out-of-bounds write in winprconvertfromjpeg because grayscale JPEG buffers are sized from one input component rather than three BGR output components. A malicious RDP server can offer a grayscale JPEG via...

CVE-2026-110838

FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated attackers to inject keyboard input. Attackers can negotiate TLS-only RDP and send an input PDU without Confirm Active to inject synthetic keystrokes...

CVE-2026-109704

Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-109740

Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-110260

OW2 ASM 3.0 before 9.11 contains a quadratic memory allocation vulnerability in MethodWriter.computeMaxStackAndLocal and computeAllFrames when using COMPUTEMAXS or COMPUTEFRAMES. Attackers can supply a crafted class file with thousands of overlapping exception handlers, causing excessive Edge...

CVE-2026-109117

Unknown description...

CVE-2026-19585

HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which may allow files to be written outside the requested destination. This vulnerability CVE-2026-19585 is fixed in go-getter 1.8.10 and...

CVE-2026-110257

OW2 ASM 5.0 before 9.11 contains an excessive memory allocation vulnerability in ClassReader.readBootstrapMethodsAttribute that sizes an int array from numbootstrapmethods without validating attributelength. Attackers can supply a crafted class file of about 100 bytes that forces roughly 2 GB...

CVE-2026-110598

Libyal libpff through 20260926 contains an integer underflow in libpffrecordentrygetmultivalue that allows attackers to trigger heap out-of-bounds reads via non-monotonic multi-value offsets. Attackers can craft PST, OST or PAB files with decreasing PTMVSTRING8, PTMVUNICODE or PTMVBINARY offsets ...

CVE-2026-110258

OW2 ASM 3.0 before 9.11 contains an excessive memory allocation vulnerability in Label.addSubroutineRetSuccessors that fails to enforce the single-RET-per-JSR rule. Attackers can supply a crafted invalid class file with multiple RET instructions for one JSR, triggering a roughly 2 GB allocation...

CVE-2026-101019

Description NGINX JavaScript njs has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and QuickJS backends during the canonicalization process, the $attr$Name getter may return undefined for an...

CVE-2026-109772

Same-origin policy bypass in the DevTools component. This vulnerability was fixed in Firefox 158 and Thunderbird 158...

CVE-2026-110263

OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in SignatureReader.parseType that allows attackers to exhaust the stack via deeply nested generic type signatures. Attackers can supply a crafted class file with a long Signature attribute containing many nested type argumen...

CVE-2026-95114

libwebsockets contains an out-of-bounds read vulnerability in the LEJP incremental parser in lib/misc/lejp.c. This allows a remote attacker to cause a denial of service...

CVE-2026-86848

A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot double-fetches a guest descriptor next index, allowing a malicious guest to cause an out-of-bounds access in the host backend...

CVE-2026-110602

libmspack through 0.11alpha contains an uninitialized pointer free vulnerability in kwajdopen in mspack/kwajd.c that frees unzeroed filename and extra pointers on header read errors. Attackers can supply a truncated, empty, or wrong-signature KWAJ file to crash the process or obtain an...

CVE-2026-88842

A flaw was found in BusyBox dpkg. The writestatusfile function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited...

CVE-2026-109750

Site isolation issue in the DOM: Web Authentication component. This vulnerability was fixed in Firefox 158 and Thunderbird 158...

CVE-2026-67414

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.24, 4.1.15, 4.2.10, and 4.3.4, deps/amqp10common/src/amqp10binaryparser.erl materializes each element of AMQP 1.0 arrays whose shared constructor has zero width, while limiting only the number of elements in each array and not the...