CVE-2026-67313

axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply FormData with field names containing thousands of nested brackets to exhaust the JavaScript call stack and trigger...

CVE-2026-67355

guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the request host in the Domain field instead of marking cookies as host-only. Attackers controlling child hosts can receive host-only cookies intended only for parent hosts, potentially disclosing session...

CVE-2026-67354

guzzlehttp/guzzle versions before 7.15.1 contain an information disclosure vulnerability in RedirectMiddleware. When the optional allowredirects.referer setting is enabled, the middleware copies the URI fragment the portion after '' from the referring request into the generated Referer header whe...

CVE-2026-67325

GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by using abbreviated option names like uploadp instead of uploadpack, which git resolves to dangerous...

CVE-2026-67319

axios before 0.33.0 and 1.x before 1.18.0 can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has already been polluted by another component. While the top-level merged config uses a null prototype, nested plain objects such as auth a...

CVE-2026-67353

guzzlehttp/guzzle versions before 7.15.1 contain a denial of service vulnerability in the CookieJar that accepts unlimited Set-Cookie header fields with no size restrictions. Attackers can return many large cookies from a malicious server, causing Guzzle to store excessive data in memory and...

CVE-2026-67338

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...

CVE-2026-67324

GitPython 3.1.50 fails to recognize joined short-option forms such as -u the short form of --upload-pack= when enforcing its default unsafe-option gate. When an application passes attacker-influenced clone options into Repo.clonefrom..., multioptions=..., allowunsafeoptions=False, an attacker can...

CVE-2026-67314

axios versions =1.15.2 and 1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling lib/adapters/http.js and lib/helpers/resolveConfig.js. When an application is already affected by a separate prototype-pollution primitive and makes an axios request with an own auth...

CVE-2026-67321

axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in ''. Attackers who control object keys and nested values passed to axios form or parameter serialization can trigger a...

CVE-2026-67312

axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON exposed as axios.formToJSON and used internally when serializing FormData with Content-Type: application/json. When an application passes attacker-controlled FormData field names...

CVE-2026-67302

FreeRDP before 3.29.0 affected versions = 3.28.0 contains a divide-by-zero vulnerability in the rdpecam camera redirection client. ecamdevprocessstartstreamsrequest parses a server-controlled CAMMEDIATYPEDESCRIPTION from a StartStreamsRequest PDU but validates only Format and Flags, not...

CVE-2026-67297

FreeRDP before 3.29.0 fails to enforce the RESPONSESIZELIMIT when processing Transfer-Encoding: chunked HTTP responses in httpresponserecvbody. Attackers controlling a malicious RD Gateway endpoint can send oversized chunked response bodies to exhaust client memory resources without triggering th...

CVE-2026-67300

FreeRDP before 3.29.0 contains client-side heap use-after-free vulnerabilities in the async update message proxy for RAIL WINDOWSTATEORDER and NOTIFYICONSTATEORDER when AsyncUpdate is enabled. When a malicious or compromised RDP server sends crafted update orders, the message proxy shallow-copies...

CVE-2026-67298

FreeRDP versions 3.28.0 and earlier contain a heap buffer overflow in the server-side RAIL channel handler railserverhandlemessages in channels/rail/server/railmain.c. When processing a RAIL PDU header, the code subtracts RAILPDUHEADERLENGTH from the peer-controlled orderLength field without firs...

CVE-2026-67294

FreeRDP before 3.29.0 improperly validates the Extended Key Usage EKU purpose of the peer certificate during client-side server TLS authentication. In x509utilsverify, when server-purpose X509PURPOSESSLSERVER verification fails, the code falls back to client-purpose and any-purpose verification, ...

CVE-2026-66402

FreeRDP before 3.29.0 affected versions = 3.28.0 contains multiple TLS certificate identity validation weaknesses in tlsverifycertificate, tlsmatchhostname, and x509utilsgetdnsnames. Because FreeRDP performs custom Common Name and DNS SAN string matching instead of using OpenSSL's length-aware...

CVE-2026-67295

FreeRDP before 3.29.0 fails to properly validate server-supplied RDPDR paths in drive redirection, allowing attackers to access prefix-sibling paths outside the configured shared root. A malicious RDP server can read, write, delete, and enumerate files in sibling directories by sending non-rooted...

CVE-2026-67289

FreeRDP before 3.29.0 affected versions = 3.28.0 does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. This value is copied into the client's ServerHostname and, when the client connects through an HTTP proxy, is written directly into the...

CVE-2026-67301

FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC and PolygonCB primary drawing orders. When AsyncUpdate is enabled e.g., xfreerdp /async-update, updatemessagePolygonSC and updatemessagePolygonCB allocate a fresh points array but...

CVE-2026-67299

FreeRDP before 3.29.0 contains a client-side heap use-after-free in the async update message proxy for WINDOWICONORDER when AsyncUpdate is enabled e.g. xfreerdp /async-update. In updatemessageWindowIcon a shallow CopyMemory overwrites a freshly allocated lParam-iconInfo with the parser-owned...

CVE-2026-67304

FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard device control request cleanup when reader-state decoding fails. Attackers can send malformed smartcard IRP requests with non-zero cReaders and truncated reader-state data to crash the process via null pointer...

CVE-2026-67296

FreeRDP before 3.29.0 contains a denial of service vulnerability in the RDPEI server channel handler that fails to validate maximum PDU body length before stream allocation. A malicious RDP client can send a header-only RDPEI message with a large declared body length to force excessive memory...

CVE-2026-67291

FreeRDP before 3.29.0 affected versions = 3.28.0 contains a heap out-of-bounds read in updateprocessglyphfragments/glyphcachefragmentput in libfreerdp/cache/glyph.c. When handling a GLYPHFRAGMENTADD update, the code reads a one-byte server-controlled declared fragment size but does not verify it...

CVE-2026-67290

FreeRDP before 3.29.0 contains a heap out-of-bounds read vulnerability in the TSMF FFmpeg decoder when parsing AVC1 MPEG2VIDEOINFO media types with insufficient ExtraData. Attackers can send malformed media format data from a server to trigger a crash by reading fixed offsets without validating...

CVE-2026-67288

FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard cache request decoders that accept NULL NDR pointers for LookupName in SCARDIOCTLREADCACHEA and SCARDIOCTLWRITECACHEA operations. When smartcard emulation is enabled, attackers can send crafted smartcard cache...

CVE-2026-67292

FreeRDP before 3.29.0 contains a buffer over-disclosure vulnerability in the gateway WebSocket transport libfreerdp/core/gateway/websocket.c. The client's Pong reply reuses a fixed 1024-byte response stream whose length is not sealed to the actual received Ping payload, so a malicious...

CVE-2026-67293

FreeRDP before 3.29.0 affected versions = 3.28.0 contains an improper certificate hostname validation vulnerability. The TLS hostname matcher tlsmatchhostname in libfreerdp/crypto/tls.c treats a wildcard pattern such as .example.com as matching any hostname ending in .example.com, so it incorrect...

CVE-2026-67303

FreeRDP before 3.29.0 contains a reachable assertion WINPRASSERTOutputBufferLength == BytesReturned in serialprocessirpdevicecontrol in channels/serial/client/serialmain.c. When serial device redirection is enabled and a server-controlled IRPMJDEVICECONTROL request specifies an unsupported IOCTL...

CVE-2026-66401

FreeRDP before 3.29.0 contains an out-of-bounds heap read vulnerability in the UVC H.264 extension-unit parser that fails to validate descriptor length before accessing the GUID field. A local attacker with a malicious USB video camera can trigger a heap read beyond allocated bounds during camera...

CVE-2026-18536

Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP. The Data::Entropy::RawSource::RandomOrg and Data::Entropy::RawSource::RandomnumbersInfo remote sources are accessed over plain HTTP. The Data::Entropy::RawSource::RandomOrg integrity check trivially matches...

CVE-2026-54909

pion/stun is a Go implementation of STUN. Prior to 3.1.3, XORMappedAddress.GetFromAs can panic while parsing a malformed short XOR-MAPPED-ADDRESS attribute in STUN or ICE Binding-response parsing paths, allowing remote denial of service. This issue is fixed in version 3.1.3...

CVE-2026-54787

sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired...

CVE-2026-65981

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, a server using --mobility authenticates a resumed REFRESH request with the resuming user's credentials but does not verify that identity against the original allocation owner, allowing an authenticated attacker...

CVE-2026-62959

Coturn is a free open source implementation of TURN and STUN Server. From 4.5.2 through 4.14.0, when Coturn is started with --acme-redirect and exposes a plaintext-TCP listener, an unauthenticated remote client can send a single ordinary HTTP GET request and receive a 301 response whose Location...

CVE-2026-53503

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:convolution, , filter passes the user-controlled value to a C extension thumbor/ext/filters/convolution.c where it is used as a divisor for % and / without validating columns 0. When columns=0, the C...

CVE-2026-53501

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor’s HMAC validation can be bypassed due to the use of Python’s .replace when removing the signature from the URL before validation. Since .replace removes all occurrences of the substring, an attacker can insert...

CVE-2026-53505

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:proportion filter does not enforce an upper bound on and runs in the post-transform phase. An attacker can trigger extremely large resizes CPU/memory exhaustion and cause denial of service. This issu...

CVE-2026-53504

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the convolution filter regular expression performs exponential backtracking on crafted repeated numeric input, allowing a URL request to exhaust processing time. This issue is fixed in 7.8.0...

CVE-2026-53502

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, fileloader decodes percent-encoded path segments after its root-boundary validation, allowing traversal outside FILELOADERROOTPATH through watermark or frame filter input. This issue is fixed in 7.8.0...

CVE-2026-18321

Buffer overflow in NTPsec's Zyfer refclock allows local attacker to crash ntpd...

CVE-2026-53500

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the ALLOWEDSOURCES configuration passes plain strings to re.match without escaping dots, so a hostname differing at dot positions can match the allowlist. This issue is fixed in 7.8.0...

CVE-2026-54706

OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. Prior to 2.6.4, OnionShare CLI/Desktop follows symbolic links in cli/onionsharecli/web/sendbasemode.py through SendBaseModeWeb.setfileinfo and...

CVE-2026-54707

OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. Prior to 2.6.4, OnionShare CLI/Desktop does not enforce the Receive mode disablefiles setting in cli/onionsharecli/web/receivemode.py, where...

CVE-2026-67350

Serendipity before 2.6.1 contains an open redirect vulnerability in exit.php that allows unauthenticated attackers to redirect users to arbitrary external sites by supplying a malicious Base64-encoded url parameter when the Track Exits plugin is configured with commentredirection set to s9y...

CVE-2026-18446

fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it backslash backslash, forward slash backslash, or backslash forward slash is parsed with no authority and folds into th...

CVE-2026-15227

Missing authorization in Checkmk 2.5.0p10, 2.4.0p35, 2.3.0p49, and 2.2.0 EOL allows an authenticated user lacking the "Edit foreign Reports" permission to modify reports owned by other users...

CVE-2026-18358

A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daemon is running in system mode with RDP enabled, the incoming connection handler bypasses the connection throttler, allowing an unauthenticated remote attacker to open many parallel pre-authentication...

CVE-2026-64607

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o...

CVE-2026-15722

A stack buffer overflow flaw was found in 389 Directory Server 389-ds-base. The getruvelementfromberval function in repl5ruv.c copies digit characters from a network-supplied RUV berval into a fixed 16-byte stack buffer without bounds checking. A remote unauthenticated attacker can crash the LDAP...