Vulnerabilities

A flaw was found in the Samba printing subsystem.

A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configured with the "print command" setting via the "%J" substitution character without escaping shell meta characters. A remote attacker could exploit this vulnerability by sending a specially crafted print job description that contains unescaped shell characters. This could

No products recorded, so this cannot be matched against anything.

CVE-2026-4480 Full triage →

Incorrect authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to exe

Incorrect authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

No products recorded, so this cannot be matched against anything.

CVE-2026-84354 Full triage →

Improper input validation in DataTransfer in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to

Improper input validation in DataTransfer in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a co-installed app. (Chromium security severity: High)

No products recorded, so this cannot be matched against anything.

CVE-2026-84325 Full triage →

Use after free in Proxy in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via

Use after free in Proxy in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: High)

No products recorded, so this cannot be matched against anything.

CVE-2026-84324 Full triage →

Internally found bugs present in Thunderbird 154, Thunderbird ESR 153.1 and Thunderbird ESR 140.14.

Internally found bugs present in Thunderbird 154, Thunderbird ESR 153.1 and Thunderbird ESR 140.14. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thu

No products recorded, so this cannot be matched against anything.

CVE-2026-84143 Full triage →

Internally found bugs present in Thunderbird 154.

Internally found bugs present in Thunderbird 154. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155 and Thunderbird 155.

No products recorded, so this cannot be matched against anything.

CVE-2026-84142 Full triage →

Integer overflow in the Graphics: ImageLib component.

Integer overflow in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.

No products recorded, so this cannot be matched against anything.

CVE-2026-84141 Full triage →

Site isolation issue in the DOM: Navigation component.

Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.

No products recorded, so this cannot be matched against anything.

CVE-2026-84140 Full triage →

Other issue in the Profile Backup component.

Other issue in the Profile Backup component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.

No products recorded, so this cannot be matched against anything.

CVE-2026-84134 Full triage →

Site isolation issue in the DOM: Push Subscriptions component.

Site isolation issue in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.

No products recorded, so this cannot be matched against anything.

CVE-2026-84133 Full triage →

Site isolation issue in the DOM: Navigation component.

Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.

No products recorded, so this cannot be matched against anything.

CVE-2026-84129 Full triage →

Sandbox escape due to use-after-free in the DOM: Security component.

Sandbox escape due to use-after-free in the DOM: Security component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.

No products recorded, so this cannot be matched against anything.

CVE-2026-84121 Full triage →

Sandbox escape due to use-after-free in the DOM: Navigation component.

Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.

No products recorded, so this cannot be matched against anything.

CVE-2026-84119 Full triage →

Sandbox escape in the Remote Settings Client component.

Sandbox escape in the Remote Settings Client component. This vulnerability was fixed in Firefox 154, Thunderbird 154, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 140.15, and Thunderbird 153.2.

No products recorded, so this cannot be matched against anything.

CVE-2026-75874 Full triage →

Internally found bugs present in Thunderbird ESR 140.13, Thunderbird ESR 153.0 and Thunderbird 153.

Internally found bugs present in Thunderbird ESR 140.13, Thunderbird ESR 153.0 and Thunderbird 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunder

No products recorded, so this cannot be matched against anything.

CVE-2026-74990 Full triage →

Internally found bugs present in Thunderbird 153.

Internally found bugs present in Thunderbird 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154 and Thunderbird 154.

No products recorded, so this cannot be matched against anything.

CVE-2026-74989 Full triage →

Internally found bugs present in Thunderbird ESR 153.0 and Thunderbird 153.

Internally found bugs present in Thunderbird ESR 153.0 and Thunderbird 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

No products recorded, so this cannot be matched against anything.

CVE-2026-74988 Full triage →

Internally found bugs present in Thunderbird ESR 140.13, Thunderbird ESR 153.0 and Thunderbird 153.

Internally found bugs present in Thunderbird ESR 140.13, Thunderbird ESR 153.0 and Thunderbird 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thu

No products recorded, so this cannot be matched against anything.

CVE-2026-74987 Full triage →

Use after free in Windows Deployment Services allows an unauthorized attacker to execute code over a network.

Use after free in Windows Deployment Services allows an unauthorized attacker to execute code over a network.

No products recorded, so this cannot be matched against anything.

CVE-2026-62893 Full triage →

Stack-based buffer overflow in Windows DNS allows an unauthorized attacker to execute code over a network.

Stack-based buffer overflow in Windows DNS allows an unauthorized attacker to execute code over a network.

No products recorded, so this cannot be matched against anything.

CVE-2026-62878 Full triage →

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible UAF in icmpv6_rcv() Caching saddr and daddr before

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible UAF in icmpv6_rcv() Caching saddr and daddr before pskb_pull() is problematic since skb->head can change. Remove these temporary variables: - We only access &ipv6_hdr(skb)->saddr and &ipv6_hdr(skb)->daddr when net_dbg_ratelimited() is called in the slow path. - Avoid potential future misuse after pskb_pul

No products recorded, so this cannot be matched against anything.

CVE-2026-53006 Full triage →

A flaw was found in Samba.

A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the "check password script" feature. If this script is configured with the %u substitution character, the client-controlled username is passed without proper escaping of shell meta-characters. This vulnerability allows an attacker to achieve remote command execu

No products recorded, so this cannot be matched against anything.

CVE-2026-4408 Full triage →

A flaw was found in gnutls.

A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username, leading to an authentication bypass. This vulnerability allows an attacker to gain unauthorized access by circumventing the authentication

No products recorded, so this cannot be matched against anything.

CVE-2026-42010 Full triage →

Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server.

Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled bytes after the end of a heap based buffer. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67,

No products recorded, so this cannot be matched against anything.

CVE-2026-28780 Full triage →

A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to an integer underflow dur

A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to an integer underflow during reassembly and resulting in an out-of-bounds read. This issue is remotely exploitable and may cause information disclosure or denial of service.

No products recorded, so this cannot be matched against anything.

CVE-2026-33845 Full triage →

Buffer overflow in GPU in Google Chrome on on Windows prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer proc

Buffer overflow in GPU in Google Chrome on on Windows prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

No products recorded, so this cannot be matched against anything.

CVE-2026-84351 Full triage →

Use after free in TabStrip in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to execute arbitr

Use after free in TabStrip in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via UI Interaction. (Chromium security severity: Low)

No products recorded, so this cannot be matched against anything.

CVE-2026-84350 Full triage →

Use after free in Browser in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to exec

Use after free in Browser in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

No products recorded, so this cannot be matched against anything.

CVE-2026-84349 Full triage →

Use after free in WebRTC in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code inside the sandbox via

Use after free in WebRTC in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

No products recorded, so this cannot be matched against anything.

CVE-2026-84347 Full triage →

Incorrect authorization in TabStrip in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer proce

Incorrect authorization in TabStrip in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

No products recorded, so this cannot be matched against anything.

CVE-2026-84335 Full triage →

Incorrect authorization in Chromoting in Google Chrome on on Windows prior to 152.0.7977.75 allowed a local attacker to execute arbitrary co

Incorrect authorization in Chromoting in Google Chrome on on Windows prior to 152.0.7977.75 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: Medium)

No products recorded, so this cannot be matched against anything.

CVE-2026-84334 Full triage →

Uninitialized resource in V8 in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code inside the sandbox

Uninitialized resource in V8 in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

No products recorded, so this cannot be matched against anything.

CVE-2026-84326 Full triage →

Internally found bugs present in Thunderbird 154, Thunderbird ESR 153.1 and Thunderbird ESR 140.14.

Internally found bugs present in Thunderbird 154, Thunderbird ESR 153.1 and Thunderbird ESR 140.14. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunder

No products recorded, so this cannot be matched against anything.

CVE-2026-84145 Full triage →

Internally found bugs present in Thunderbird 154 and Thunderbird ESR 153.1.

Internally found bugs present in Thunderbird 154 and Thunderbird ESR 153.1. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.

No products recorded, so this cannot be matched against anything.

CVE-2026-84144 Full triage →

Information disclosure in the Networking: HTTP component.

Information disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.

No products recorded, so this cannot be matched against anything.

CVE-2026-84132 Full triage →

Privilege escalation due to invalid pointer in the Graphics component.

Privilege escalation due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.

No products recorded, so this cannot be matched against anything.

CVE-2026-84131 Full triage →

Information disclosure in the Graphics: WebGPU component.

Information disclosure in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.

No products recorded, so this cannot be matched against anything.

CVE-2026-84130 Full triage →

Privilege escalation in the WebDriver BiDi component.

Privilege escalation in the WebDriver BiDi component. This vulnerability was fixed in Firefox 155 and Thunderbird 155.

No products recorded, so this cannot be matched against anything.

CVE-2026-84128 Full triage →

Privilege escalation due to use-after-free in the Graphics: WebGPU component.

Privilege escalation due to use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.

No products recorded, so this cannot be matched against anything.

CVE-2026-84123 Full triage →

Privilege escalation in the Application Update component.

Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 154, Thunderbird 154, Firefox ESR 153.2, and Thunderbird 153.2.

No products recorded, so this cannot be matched against anything.

CVE-2026-74952 Full triage →

Privilege escalation due to use-after-free in the Graphics: Canvas2D component.

Privilege escalation due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

No products recorded, so this cannot be matched against anything.

CVE-2026-74949 Full triage →

Use after free in Windows DNS allows an unauthorized attacker to execute code over a network.

Use after free in Windows DNS allows an unauthorized attacker to execute code over a network.

No products recorded, so this cannot be matched against anything.

CVE-2026-65789 Full triage →

Authentication bypass by capture-replay in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

Authentication bypass by capture-replay in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

No products recorded, so this cannot be matched against anything.

CVE-2026-62911 Full triage →

Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over an adjacent network.

Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over an adjacent network.

No products recorded, so this cannot be matched against anything.

CVE-2026-62823 Full triage →

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DNS allows an unauthorized attacker t

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DNS allows an unauthorized attacker to execute code over a network.

No products recorded, so this cannot be matched against anything.

CVE-2026-62820 Full triage →

Out-of-bounds write in Windows DNS allows an unauthorized attacker to execute code over an adjacent network.

Out-of-bounds write in Windows DNS allows an unauthorized attacker to execute code over an adjacent network.

No products recorded, so this cannot be matched against anything.

CVE-2026-62817 Full triage →

Improper link resolution before file access ('link following') in Windows DHCP Server allows an authorized attacker to elevate privileges lo

Improper link resolution before file access ('link following') in Windows DHCP Server allows an authorized attacker to elevate privileges locally.

No products recorded, so this cannot be matched against anything.

CVE-2026-62812 Full triage →

Improper link resolution before file access ('link following') in Windows DHCP Server allows an authorized attacker to elevate privileges lo

Improper link resolution before file access ('link following') in Windows DHCP Server allows an authorized attacker to elevate privileges locally.

No products recorded, so this cannot be matched against anything.

CVE-2026-62807 Full triage →

Improper link resolution before file access ('link following') in Windows DHCP Server allows an authorized attacker to elevate privileges lo

Improper link resolution before file access ('link following') in Windows DHCP Server allows an authorized attacker to elevate privileges locally.

No products recorded, so this cannot be matched against anything.

CVE-2026-62803 Full triage →

Use after free in Windows DNS allows an authorized attacker to execute code over a network.

Use after free in Windows DNS allows an authorized attacker to execute code over a network.

No products recorded, so this cannot be matched against anything.

CVE-2026-62787 Full triage →

Improper link resolution before file access ('link following') in Windows DHCP Server allows an authorized attacker to elevate privileges lo

Improper link resolution before file access ('link following') in Windows DHCP Server allows an authorized attacker to elevate privileges locally.

No products recorded, so this cannot be matched against anything.

CVE-2026-62776 Full triage →

Improper link resolution before file access ('link following') in Windows DHCP Server allows an authorized attacker to elevate privileges lo

Improper link resolution before file access ('link following') in Windows DHCP Server allows an authorized attacker to elevate privileges locally.

No products recorded, so this cannot be matched against anything.

CVE-2026-62761 Full triage →

A heap-based buffer overflow vulnerability exists in the GIMP DDS (DirectDraw Surface) file parser.

A heap-based buffer overflow vulnerability exists in the GIMP DDS (DirectDraw Surface) file parser. When a crafted DDS file declares a D3D9 pixel format but sets a lower bits-per-pixel (bpp) value in the header, the loader allocates an undersized heap buffer. Subsequent pixel data consumption at the real format's stride causes a write past the heap buffer boundary, leading to heap metadata corrupt

No products recorded, so this cannot be matched against anything.

CVE-2026-42170 Full triage →

Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted IOCBs are drai

Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted IOCBs are drained, allowing later kernel writes into caller-owned output buffers.

No products recorded, so this cannot be matched against anything.

CVE-2026-71226 Full triage →

A flaw was found in the file-fits plugin in GIMP.

A flaw was found in the file-fits plugin in GIMP. When processing a FITS image file, the plugin calculates memory allocation sizes using signed 32-bit integers for width and height. If a crafted file sets both values to large values, their product exceeds 2^31 and overflows, resulting in an undersized heap-based buffer allocation. This integer overflow issue results in a heap-based buffer overflow

No products recorded, so this cannot be matched against anything.

CVE-2026-66758 Full triage →

A flaw was found in libssh.

A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has already been freed, leading to crashes or possible use-after-free conditions.

No products recorded, so this cannot be matched against anything.

CVE-2026-59850 Full triage →

A flaw was found in libssh.

A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection.

No products recorded, so this cannot be matched against anything.

CVE-2026-59847 Full triage →

Privilege escalation in the DOM: Navigation component.

Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, Thunderbird 140.13, Firefox ESR 140.15, and Thunderbird 140.15.

No products recorded, so this cannot be matched against anything.

CVE-2026-16371 Full triage →

Privilege escalation in the DOM: Workers component.

Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 153, Thunderbird 153, Firefox ESR 140.15, and Thunderbird 140.15.

No products recorded, so this cannot be matched against anything.

CVE-2026-16365 Full triage →

A flaw was found in GIMP's PNM file format parser.

A flaw was found in GIMP's PNM file format parser. When parsing a specially crafted PNM file, the pnmscanner_gettoken() function writes a null terminator one byte past the end of a stack-allocated buffer due to an off-by-one error in the loop boundary check. This could lead to memory corruption, potentially resulting in denial of service or arbitrary code execution.

No products recorded, so this cannot be matched against anything.

CVE-2026-58380 Full triage →

In the Linux kernel, the following vulnerability has been resolved: mm/list_lru: drain before clearing xarray entry on reparent memcg_repa

In the Linux kernel, the following vulnerability has been resolved: mm/list_lru: drain before clearing xarray entry on reparent memcg_reparent_list_lrus() clears the dying memcg's xarray entry with xas_store(&xas, NULL) before reparenting its per-node lists into the parent. This opens a window where a concurrent list_lru_del() arriving for the dying memcg sees xa_load() == NULL, walks to the pa

No products recorded, so this cannot be matched against anything.

CVE-2026-53153 Full triage →

Issue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification.

Issue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification. Impact summary: A use-after-free may result in process crashes, heap corruption, or potentially remote code execution. When processing a PKCS#7 or S/MIME signed message, if the SignedData digestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may incor

No products recorded, so this cannot be matched against anything.

CVE-2026-45447 Full triage →

Buffer Over-read vulnerability in Apache HTTP Server via outbound OCSP requests to an attacker controlled OCSP server This issue affects Ap

Buffer Over-read vulnerability in Apache HTTP Server via outbound OCSP requests to an attacker controlled OCSP server This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

No products recorded, so this cannot be matched against anything.

CVE-2026-44185 Full triage →

Heap-based Buffer Overflow vulnerability in Apache HTTP Server with mod_xml2enc, xml2StartParse, and untrusted content This issue affects A

Heap-based Buffer Overflow vulnerability in Apache HTTP Server with mod_xml2enc, xml2StartParse, and untrusted content This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

No products recorded, so this cannot be matched against anything.

CVE-2026-42536 Full triage →

A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier allows an attack by an untrusted backend.

A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier allows an attack by an untrusted backend. Users are recommended to upgrade to version 2.4.68, which fixes this issue.

No products recorded, so this cannot be matched against anything.

CVE-2026-34355 Full triage →

A flaw was found in libsolv.

A flaw was found in libsolv. This heap buffer overflow occurs during the decompression of attacker-controlled compressed data within `.solv` files due to insufficient input validation. An attacker can provide a specially crafted `.solv` file, which, when processed by a vulnerable application, can lead to out-of-bounds memory access. This could result in information disclosure, alteration of progra

No products recorded, so this cannot be matched against anything.

CVE-2026-48864 Full triage →

A flaw was found in gnutls.

A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic. The comparator function, responsible for ordering DTLS packets by sequence numbers, did not correctly handle packets with duplicate sequence numbers. This could lead to unstable packet ordering or undefined behavior, resulting in a denial of service.

No products recorded, so this cannot be matched against anything.

CVE-2026-42009 Full triage →

A flaw was found in gnutls.

A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of `nameConstraints` labels, specifically for `dNSName` (DNS) or `rfc822Name` (email) constraints within `excludedSubtrees` or `permittedSubtrees`. A remote attacker can exploit this by crafting a leaf certificate with casing differences in the Subject Alternative Name (SAN), leading to a polic

No products recorded, so this cannot be matched against anything.

CVE-2026-3833 Full triage →

A flaw was found in binutils.

A flaw was found in binutils. A heap-buffer-overflow vulnerability exists when processing a specially crafted XCOFF (Extended Common Object File Format) object file during linking. A local attacker could trick a user into processing this malicious file, which could lead to arbitrary code execution, allowing the attacker to run unauthorized commands, or cause a denial of service, making the system

No products recorded, so this cannot be matched against anything.

CVE-2026-6846 Full triage →

A flaw was found in libcap.

A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the `cap_set_file()` function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so, capabilities can be injected into or stripped from unintended executables, leading to privilege esca

No products recorded, so this cannot be matched against anything.

CVE-2026-4878 Full triage →

A flaw was found in libssh.

A flaw was found in libssh. The API function `ssh_get_hexa()` is vulnerable to a denial of service when processing zero-length input. This can be exploited remotely by an attacker during GSSAPI (Generic Security Service Application Program Interface) authentication if the server's logging verbosity is set to `SSH_LOG_PACKET (3)` or higher. Successful exploitation could lead to a self-Denial of Ser

No products recorded, so this cannot be matched against anything.

CVE-2026-0966 Full triage →

A flaw was found in GNU Binutils.

A flaw was found in GNU Binutils. This vulnerability, a heap-based buffer overflow, specifically an out-of-bounds read, exists in the bfd linker component. An attacker could exploit this by convincing a user to process a specially crafted malicious XCOFF object file. Successful exploitation may lead to the disclosure of sensitive information or cause the application to crash, resulting in an appli

No products recorded, so this cannot be matched against anything.

CVE-2026-3442 Full triage →

A flaw was found in GNU Binutils.

A flaw was found in GNU Binutils. This heap-based buffer overflow vulnerability, specifically an out-of-bounds read in the bfd linker, allows an attacker to gain access to sensitive information. By convincing a user to process a specially crafted XCOFF object file, an attacker can trigger this flaw, potentially leading to information disclosure or an application level denial of service.

No products recorded, so this cannot be matched against anything.

CVE-2026-3441 Full triage →

A flaw was found in the libxslt library.

A flaw was found in the libxslt library. The same memory field, psvi, is used for both stylesheet and input data, which can lead to type confusion during XML transformations. This vulnerability allows an attacker to crash the application or corrupt memory. In some cases, it may lead to denial of service or unexpected behavior.

No products recorded, so this cannot be matched against anything.

CVE-2025-7424 Full triage →

A heap-buffer-overflow (off-by-one) flaw was found in the GnuTLS software in the template parsing logic within the certtool utility.

A heap-buffer-overflow (off-by-one) flaw was found in the GnuTLS software in the template parsing logic within the certtool utility. When it reads certain settings from a template file, it allows an attacker to cause an out-of-bounds (OOB) NULL pointer write, resulting in memory corruption and a denial-of-service (DoS) that could potentially crash the system.

No products recorded, so this cannot be matched against anything.

CVE-2025-32990 Full triage →

A flaw was found in GnuTLS.

A flaw was found in GnuTLS. A double-free vulnerability exists in GnuTLS due to incorrect ownership handling in the export logic of Subject Alternative Name (SAN) entries containing an otherName. If the type-id OID is invalid or malformed, GnuTLS will call asn1_delete_structure() on an ASN.1 node it does not own, leading to a double-free condition when the parent function or caller later attempts

No products recorded, so this cannot be matched against anything.

CVE-2025-32988 Full triage →

A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the ssh_kdf() function responsible for key d

A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the ssh_kdf() function responsible for key derivation. Due to inconsistent interpretation of return values where OpenSSL uses 0 to indicate failure and libssh uses 0 for success—the function may mistakenly return a success status even when key derivation fails. This results in uninitialized cryptographi

No products recorded, so this cannot be matched against anything.

CVE-2025-5372 Full triage →

A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer o

A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of service when processing crafted input.

No products recorded, so this cannot be matched against anything.

CVE-2025-6021 Full triage →

A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function.

A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption, enabling an attacker to execute arbitrary code or cause a denial-of-service condition.

No products recorded, so this cannot be matched against anything.

CVE-2025-5914 Full triage →

A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd).

A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.

No products recorded, so this cannot be matched against anything.

CVE-2024-6387 Full triage →

A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and net/ipv6/esp6.c.

A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and net/ipv6/esp6.c. This flaw allows a local attacker with a normal user privilege to overwrite kernel heap objects and may cause a local privilege escalation threat.

No products recorded, so this cannot be matched against anything.

CVE-2022-27666 Full triage →

Information leak in Skia in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to leak

Information leak in Skia in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

No products recorded, so this cannot be matched against anything.

CVE-2026-84359 Full triage →

Improper privilege management in Downloads in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the rendere

Improper privilege management in Downloads in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)

No products recorded, so this cannot be matched against anything.

CVE-2026-84358 Full triage →

Improper input validation in Omnibox in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to bypa

Improper input validation in Omnibox in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. (Chromium security severity: High)

No products recorded, so this cannot be matched against anything.

CVE-2026-84357 Full triage →

UI misrepresentation in FullScreen in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to spoof address bar via a crafted HTML

UI misrepresentation in FullScreen in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Low)

No products recorded, so this cannot be matched against anything.

CVE-2026-84356 Full triage →

Incorrect authorization in Navigation in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer pro

Incorrect authorization in Navigation in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

No products recorded, so this cannot be matched against anything.

CVE-2026-84355 Full triage →

Information leak in MediaCapture in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to potentially leak sensitive information

Information leak in MediaCapture in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to potentially leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)

No products recorded, so this cannot be matched against anything.

CVE-2026-84348 Full triage →

Incorrect authorization in SiteSettings in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to bypass system access restrictio

Incorrect authorization in SiteSettings in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

No products recorded, so this cannot be matched against anything.

CVE-2026-84332 Full triage →

Incorrect authorization in Actor in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process

Incorrect authorization in Actor in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

No products recorded, so this cannot be matched against anything.

CVE-2026-84331 Full triage →

Confused deputy in CredentialProvider in Google Chrome on on Windows prior to 152.0.7977.75 allowed a remote attacker who had compromised th

Confused deputy in CredentialProvider in Google Chrome on on Windows prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to leak sensitive information via a crafted HTML page. (Chromium security severity: Low)

No products recorded, so this cannot be matched against anything.

CVE-2026-84329 Full triage →

Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer proce

Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

No products recorded, so this cannot be matched against anything.

CVE-2026-84328 Full triage →

Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer proce

Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

No products recorded, so this cannot be matched against anything.

CVE-2026-84323 Full triage →

Clickjacking issue in the DOM: Events component.

Clickjacking issue in the DOM: Events component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.

No products recorded, so this cannot be matched against anything.

CVE-2026-84139 Full triage →

Denial-of-service in the PDF Viewer component.

Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 155 and Thunderbird 155.

No products recorded, so this cannot be matched against anything.

CVE-2026-84138 Full triage →

Spoofing issue in the DOM: Core & HTML component.

Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.

No products recorded, so this cannot be matched against anything.

CVE-2026-84137 Full triage →

Other issue in the DOM: Navigation component.

Other issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.

No products recorded, so this cannot be matched against anything.

CVE-2026-84136 Full triage →

Incorrect boundary conditions in the Layout: Grid component.

Incorrect boundary conditions in the Layout: Grid component. This vulnerability was fixed in Firefox 155 and Thunderbird 155.

No products recorded, so this cannot be matched against anything.

CVE-2026-84126 Full triage →

Use-after-free in the DOM: Core & HTML component.

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.

No products recorded, so this cannot be matched against anything.

CVE-2026-84125 Full triage →

Use-after-free in the DOM: Core & HTML component.

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.

No products recorded, so this cannot be matched against anything.

CVE-2026-84124 Full triage →

Use-after-free in the Audio/Video component.

Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.

No products recorded, so this cannot be matched against anything.

CVE-2026-84122 Full triage →

Use-after-free in the Audio/Video component.

Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.

No products recorded, so this cannot be matched against anything.

CVE-2026-84120 Full triage →

Use-after-free in the JavaScript: GC component.

Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.

No products recorded, so this cannot be matched against anything.

CVE-2026-84118 Full triage →

A flaw was found in the file-psd plugin in GIMP.

A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image file, the plugin does not properly validate the channel-count parameter. This incorrect validation leads to improper memory bounds checking, resulting in both a heap out-of-bounds read and a stack out-of-bounds access. This issue can result in an application crash, leading to a denial of service or a lim

No products recorded, so this cannot be matched against anything.

CVE-2026-82343 Full triage →

A flaw was found in the file-xwd plugin in GIMP.

A flaw was found in the file-xwd plugin in GIMP. When processing a specially crafted XWD image file, the plugin validates the image width and bytes-per-line parameters independently rather than ensuring their combined values are consistent with the allocated buffer size. This incorrect validation leads to improper bounds checking, causing a heap out-of-bounds read. This issue can result in an appl

No products recorded, so this cannot be matched against anything.

CVE-2026-80101 Full triage →

Information leak in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a local attacker to obtain sensitive information via a

Information leak in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a local attacker to obtain sensitive information via a crafted file. (Chromium security severity: Low)

No products recorded, so this cannot be matched against anything.

CVE-2026-78957 Full triage →

A flaw was found in the file-pix (ESM) plugin in GIMP.

A flaw was found in the file-pix (ESM) plugin in GIMP. When processing a specially crafted PIX image file, the plugin allocates a Variable-Length Array (VLA) on the stack without proper bounds checking, causing an unbounded stack allocation followed by a 21-byte stack over-read. This can result in a denial of service due to stack exhaustion and a limited information disclosure of stack memory cont

No products recorded, so this cannot be matched against anything.

CVE-2026-78475 Full triage →

A flaw was found in libdm.

A flaw was found in libdm. A local attacker could craft a malicious Logical Volume Manager (LVM) metadata configuration with deeply nested structures. This could lead to uncontrolled recursion in the libdm configuration file parser, exhausting the stack and causing any LVM command reading the metadata to crash. This vulnerability results in a Denial of Service (DoS) for affected systems.

No products recorded, so this cannot be matched against anything.

CVE-2026-19617 Full triage →

Multiple Use-After-Free vulnerabilities were found in the add_archive_element function in ld/ldmain.c of the GNU linker (ld), a component of

Multiple Use-After-Free vulnerabilities were found in the add_archive_element function in ld/ldmain.c of the GNU linker (ld), a component of binutils. The root cause is that plugin_maybe_claim() in ld/plugin.c frees the original BFD object via bfd_close/_bfd_delete_bfd when entry->the_bfd->my_archive == NULL, but the caller retains both the original abfd parameter and a shallow copy (orig_input.th

No products recorded, so this cannot be matched against anything.

CVE-2026-19548 Full triage →

Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent netwo

Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network.

No products recorded, so this cannot be matched against anything.

CVE-2026-62814 Full triage →

Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent netwo

Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network.

No products recorded, so this cannot be matched against anything.

CVE-2026-62745 Full triage →

Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent netwo

Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network.

No products recorded, so this cannot be matched against anything.

CVE-2026-62742 Full triage →

Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent netwo

Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network.

No products recorded, so this cannot be matched against anything.

CVE-2026-62720 Full triage →

Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent netwo

Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network.

No products recorded, so this cannot be matched against anything.

CVE-2026-62718 Full triage →

Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent netwo

Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network.

No products recorded, so this cannot be matched against anything.

CVE-2026-62716 Full triage →

Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent netwo

Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network.

No products recorded, so this cannot be matched against anything.

CVE-2026-62715 Full triage →

Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent netwo

Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network.

No products recorded, so this cannot be matched against anything.

CVE-2026-62714 Full triage →

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DNS allows an authorized attacker to

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DNS allows an authorized attacker to execute code over a network.

No products recorded, so this cannot be matched against anything.

CVE-2026-61920 Full triage →

A flaw was found in libkcapi.

A flaw was found in libkcapi. A local attacker can influence an application that uses the Asynchronous Input/Output (AIO) interface. By reusing an AIO-enabled handle after a prior completion error, the _kcapi_aio_read_all() function can enter a non-terminating wait loop. This can lead to a persistent denial of service, making the affected application or thread unresponsive.

No products recorded, so this cannot be matched against anything.

CVE-2026-71227 Full triage →

A flaw was found in libkcapi.

A flaw was found in libkcapi. When performing one-shot symmetric cipher operations on large inputs (over 64 KiB) in stateful modes such as Counter (CTR) or Cipher Block Chaining (CBC), the library improperly reuses the Initialization Vector (IV) for each internal data chunk. A remote attacker could potentially exploit this by making an application that uses libkcapi process specially crafted large

No products recorded, so this cannot be matched against anything.

CVE-2026-71225 Full triage →

A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write a

A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During restoration, files or directories may be created, renamed or overwritten outside the intended extraction

No products recorded, so this cannot be matched against anything.

CVE-2026-18477 Full triage →

A flaw was found in GNU tar.

A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outsi

No products recorded, so this cannot be matched against anything.

CVE-2026-18508 Full triage →

A flaw was found in libssh.

A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory growth and client-side denial of service.

No products recorded, so this cannot be matched against anything.

CVE-2026-59848 Full triage →

A flaw was found in libssh.

A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior.

No products recorded, so this cannot be matched against anything.

CVE-2026-59846 Full triage →

A flaw was found in libssh.

A flaw was found in libssh. When ProxyCommand is used, an unchecked fork() failure can be stored as process ID -1; during cleanup, signals may then be sent across the caller's accessible process tree, leading to local denial of service.

No products recorded, so this cannot be matched against anything.

CVE-2026-59845 Full triage →

A flaw was found in libssh.

A flaw was found in libssh. A remote authenticated client can issue SSH_FXP_READ requests with an arbitrarily large length, causing a libssh SFTP server to allocate excessive memory and potentially exhaust it through repeated requests.

No products recorded, so this cannot be matched against anything.

CVE-2026-59844 Full triage →

A flaw was found in libssh.

A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSH_MSG_CHANNEL_OPEN, causing later channel writes to loop indefinitely and consume CPU, leading to denial of service.

No products recorded, so this cannot be matched against anything.

CVE-2026-59843 Full triage →

A flaw was found in p11-kit.

A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain sock

No products recorded, so this cannot be matched against anything.

CVE-2026-13757 Full triage →

A flaw was found in OpenSSH.

A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie-Hellman Group Exchange (DH-GEX) client path. This occurs during FIPS (Federal Information Processing Standards) mode known-group validation when the client processes attacker-controlled DH-GEX group parameters. Successful exploitation leads to client-side process termination, resulting in a De

No products recorded, so this cannot be matched against anything.

CVE-2026-55653 Full triage →

A flaw was found in Samba’s vfs_worm module.

A flaw was found in Samba’s vfs_worm module. The module is intended to provide write-once, read-many (WORM) protections by preventing modification of files after a configurable grace period. Due to insufficient validation during rename operations, an authenticated user with write access to a share could overwrite a protected file by renaming a newly created file over the existing WORM-protected fi

No products recorded, so this cannot be matched against anything.

CVE-2026-2340 Full triage →

A flaw was found in Samba’s handling of NTFS-style reparse points on shares configured with read only = yes.

A flaw was found in Samba’s handling of NTFS-style reparse points on shares configured with read only = yes. Due to missing SMB-layer access checks, authenticated users with underlying filesystem write permissions may create or delete reparse point metadata through SMB operations even on read-only exports. This could allow modification of SMB-visible file behavior, including converting files into

No products recorded, so this cannot be matched against anything.

CVE-2026-1933 Full triage →

A flaw was found in Samba’s certificate auto-enrollment Group Policy handling.

A flaw was found in Samba’s certificate auto-enrollment Group Policy handling. When certificate auto-enrollment is enabled, Samba may retrieve a CA certificate over an unencrypted HTTP connection and install it into the local trust store without proper verification. An attacker with the ability to intercept or redirect network traffic could exploit this behavior to supply a malicious certificate a

No products recorded, so this cannot be matched against anything.

CVE-2026-3012 Full triage →

A flaw was found in libsolv.

A flaw was found in libsolv. This heap buffer overflow vulnerability occurs when a victim processes a specially crafted `.solv` file containing negative size values in the `repo_add_solv` function. This leads to an undersized memory allocation and a subsequent out-of-bounds write. An attacker could exploit this to cause a denial of service (DoS).

No products recorded, so this cannot be matched against anything.

CVE-2026-9149 Full triage →

A flaw was found in libsolv.

A flaw was found in libsolv. This stack-based buffer overflow vulnerability occurs in libsolv's Debian metadata parser when processing specially crafted Debian repository metadata. An attacker could exploit this by providing malicious SHA384 or SHA512 checksum tags, leading to memory corruption and a denial of service (DoS) in the affected system.

No products recorded, so this cannot be matched against anything.

CVE-2026-9150 Full triage →

A flaw was found in gnutls.

A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted Online Certificate Status Protocol (OCSP) response during a TLS handshake. Due to a logic error in how gnutls processes multi-record OCSP responses, a client with OCSP verification enabled may incorrectly accept a revoked server certificate, potentially leading to a compromise of trust.

No products recorded, so this cannot be matched against anything.

CVE-2026-3832 Full triage →

A flaw was found in binutils, specifically within the `readelf` utility.

A flaw was found in binutils, specifically within the `readelf` utility. This vulnerability allows a local attacker to cause a Denial of Service (DoS) by tricking a user into processing a specially crafted Executable and Linkable Format (ELF) file. The exploitation of this flaw can lead to the system becoming unresponsive due to excessive resource consumption or a program crash.

No products recorded, so this cannot be matched against anything.

CVE-2026-6845 Full triage →

A flaw was found in the `readelf` utility of the binutils package.

A flaw was found in the `readelf` utility of the binutils package. A local attacker could exploit two Denial of Service (DoS) vulnerabilities by providing a specially crafted Executable and Linkable Format (ELF) file. One vulnerability, a resource exhaustion (CWE-400), can lead to an out-of-memory condition. The other, a null pointer dereference (CWE-476), can cause a segmentation fault. Both issu

No products recorded, so this cannot be matched against anything.

CVE-2026-6844 Full triage →

A flaw was found in nano.

A flaw was found in nano. A local user could exploit a format string vulnerability in the `statusline()` function. By creating a directory with a name containing `printf` specifiers, the application attempts to display this name, leading to a segmentation fault (SEGV). This results in a Denial of Service (DoS) for the `nano` application.

No products recorded, so this cannot be matched against anything.

CVE-2026-6843 Full triage →

A flaw was found in the System Security Services Daemon (SSSD).

A flaw was found in the System Security Services Daemon (SSSD). The pam_passkey_child_read_data() function within the PAM passkey responder fails to properly handle raw bytes received from a pipe. Because the data is treated as a NUL-terminated C string without explicit termination, it results in an out-of-bounds read when processed by functions like snprintf(). A local attacker could potentially

No products recorded, so this cannot be matched against anything.

CVE-2026-6245 Full triage →

A flaw was found in libarchive.

A flaw was found in libarchive. A NULL pointer dereference vulnerability exists in the ACL parsing logic, specifically within the archive_acl_from_text_nl() function. When processing a malformed ACL string (such as a bare "d" or "default" tag without subsequent fields), the function fails to perform adequate validation before advancing the pointer. An attacker can exploit this by providing a malic

No products recorded, so this cannot be matched against anything.

CVE-2026-5745 Full triage →

A flaw was found in tar.

A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.

No products recorded, so this cannot be matched against anything.

CVE-2026-5704 Full triage →

A flaw was found in firewalld.

A flaw was found in firewalld. A local unprivileged user can exploit this vulnerability by mis-authorizing two runtime D-Bus (Desktop Bus) setters, setZoneSettings2 and setPolicySettings. This mis-authorization allows the user to modify the runtime firewall state without proper authentication, leading to unauthorized changes in network security configurations.

No products recorded, so this cannot be matched against anything.

CVE-2026-4948 Full triage →

A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a malformed 'longname'

A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a malformed 'longname' field within an `SSH_FXP_NAME` message during a file listing operation. This missing null check can lead to reading beyond allocated memory on the heap. This can cause unexpected behavior or lead to a denial of service (DoS) due to application crashes.

No products recorded, so this cannot be matched against anything.

CVE-2026-0968 Full triage →

A flaw was found in libssh.

A flaw was found in libssh. A remote attacker, by controlling client configuration files or known_hosts files, could craft specific hostnames that when processed by the `match_pattern()` function can lead to inefficient regular expression backtracking. This can cause timeouts and resource exhaustion, resulting in a Denial of Service (DoS) for the client.

No products recorded, so this cannot be matched against anything.

CVE-2026-0967 Full triage →

A flaw was found in libssh where it can attempt to open arbitrary files during configuration parsing.

A flaw was found in libssh where it can attempt to open arbitrary files during configuration parsing. A local attacker can exploit this by providing a malicious configuration file or when the system is misconfigured. This vulnerability could lead to a Denial of Service (DoS) by causing the system to try and access dangerous files, such as block devices or large system files, which can disrupt norm

No products recorded, so this cannot be matched against anything.

CVE-2026-0965 Full triage →

A malicious SCP server can send unexpected paths that could make the client application override local files outside of working directory.

A malicious SCP server can send unexpected paths that could make the client application override local files outside of working directory. This could be misused to create malicious executable or configuration files and make the user execute them under specific consequences. This is the same issue as in OpenSSH, tracked as CVE-2019-6111.

No products recorded, so this cannot be matched against anything.

CVE-2026-0964 Full triage →

A flaw was found in polkit.

A flaw was found in polkit. A local user can exploit this by providing a specially crafted, excessively long input to the `polkit-agent-helper-1` setuid binary via standard input (stdin). This unbounded input can lead to an out-of-memory (OOM) condition, resulting in a Denial of Service (DoS) for the system.

No products recorded, so this cannot be matched against anything.

CVE-2026-4897 Full triage →

A flaw was found in the GNU Binutils BFD library, a widely used component for handling binary files such as object files and executables.

A flaw was found in the GNU Binutils BFD library, a widely used component for handling binary files such as object files and executables. The issue occurs when processing specially crafted XCOFF object files, where a relocation type value is not properly validated before being used. This can cause the program to read memory outside of intended bounds. As a result, affected tools may crash or expos

No products recorded, so this cannot be matched against anything.

CVE-2026-4647 Full triage →

A flaw was found in libarchive.

A flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression logic, caused by improper validation of a field (`pz_log2_bs`) read from ISO9660 Rock Ridge extensions. A remote attacker can exploit this by supplying a specially crafted ISO file. This can lead to incorrect memory allocation and potential application crashes, resulting in a denial-of-service (D

No products recorded, so this cannot be matched against anything.

CVE-2026-4426 Full triage →

A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package for Linux, that allows a NFSv3 client to escalate

A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package for Linux, that allows a NFSv3 client to escalate the privileges assigned to it in the /etc/exports file at mount time. In particular, it allows the client to access any subdirectory or subtree of an exported directory, regardless of the set file permissions, and regardless of any 'root_squash' or 'all_squash

No products recorded, so this cannot be matched against anything.

CVE-2025-12801 Full triage →

A flaw was found in the libxml2 library.

A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated <nextCatalog> elements pointing to the same downstream catalog. A remote attacker can exploit this by supplying crafted catalogs, causing the parser to redundantly traverse catalog chains. This leads to excessive CPU consumption and degrades applic

No products recorded, so this cannot be matched against anything.

CVE-2026-0992 Full triage →

A flaw was found in libxml2, an XML parsing library.

A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occurs in the xmlCatalogXMLResolveURI function when an XML catalog contains a delegate URI entry that references itself. A remote attacker could exploit this configuration-dependent issue by providing a specially crafted XML catalog, leading to infinite recursion and call stack exhaustion. This ultimatel

No products recorded, so this cannot be matched against anything.

CVE-2026-0990 Full triage →

A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled.

A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested <include> directives. Specially crafted or overly complex schemas can cause excessive recursion during parsing. This may lead to stack exhaustion and application crashes, creating a denial-of-service risk.

No products recorded, so this cannot be matched against anything.

CVE-2026-0989 Full triage →

A flaw was found in glib.

A flaw was found in glib. This vulnerability allows a heap buffer overflow and denial-of-service (DoS) via an integer overflow in GLib's GIO (GLib Input/Output) escape_byte_string() function when processing malicious file or remote filesystem attribute values.

No products recorded, so this cannot be matched against anything.

CVE-2025-14512 Full triage →

A vulnerability was found in the netavark package, a network stack for containers used with Podman.

A vulnerability was found in the netavark package, a network stack for containers used with Podman. Due to dns.podman search domain being removed, netavark may return external servers if a valid A/AAAA record is sent as a response. When creating a container with a given name, this name will be used as the hostname for the container itself, as the podman's search domain is not added anymore the con

No products recorded, so this cannot be matched against anything.

CVE-2025-8283 Full triage →

A flaw was found in polkit.

A flaw was found in polkit. When processing an XML policy with 32 or more nested elements in depth, an out-of-bounds write can be triggered. This issue can lead to a crash or other unexpected behavior, and arbitrary code execution is not discarded. To exploit this flaw, a high-privilege account is needed as it's required to place the malicious policy file properly.

No products recorded, so this cannot be matched against anything.

CVE-2025-7519 Full triage →

A heap-buffer-overread vulnerability was found in GnuTLS in how it handles the Certificate Transparency (CT) Signed Certificate Timestamp (S

A heap-buffer-overread vulnerability was found in GnuTLS in how it handles the Certificate Transparency (CT) Signed Certificate Timestamp (SCT) extension during X.509 certificate parsing. This flaw allows a malicious user to create a certificate containing a malformed SCT extension (OID 1.3.6.1.4.1.11129.2.4.2) that contains sensitive data. This issue leads to the exposure of confidential informat

No products recorded, so this cannot be matched against anything.

CVE-2025-32989 Full triage →

A flaw was found in the key export functionality of libssh.

A flaw was found in the key export functionality of libssh. The issue occurs in the internal function responsible for converting cryptographic keys into serialized formats. During error handling, a memory structure is freed but not cleared, leading to a potential double free issue if an additional failure occurs later in the function. This condition may result in heap corruption or application ins

No products recorded, so this cannot be matched against anything.

CVE-2025-5351 Full triage →

A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files.

A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files. When a user inputs an overly long command, the program does not check the input size properly, which can cause it to crash. This issue might allow attackers to run harmful code in rare configurations without modern protections.

No products recorded, so this cannot be matched against anything.

CVE-2025-6170 Full triage →

A vulnerability has been identified in the libarchive library.

A vulnerability has been identified in the libarchive library. This flaw can be triggered when file streams are piped into bsdtar, potentially allowing for reading past the end of the file. This out-of-bounds read can lead to unintended consequences, including unpredictable program behavior, memory corruption, or a denial-of-service condition.

No products recorded, so this cannot be matched against anything.

CVE-2025-5918 Full triage →

A vulnerability has been identified in the libarchive library.

A vulnerability has been identified in the libarchive library. This flaw involves an 'off-by-one' miscalculation when handling prefixes and suffixes for file names. This can lead to a 1-byte write overflow. While seemingly small, such an overflow can corrupt adjacent memory, leading to unpredictable program behavior, crashes, or in specific circumstances, could be leveraged as a building block for

No products recorded, so this cannot be matched against anything.

CVE-2025-5917 Full triage →

A vulnerability has been identified in the libarchive library.

A vulnerability has been identified in the libarchive library. This flaw involves an integer overflow that can be triggered when processing a Web Archive (WARC) file that claims to have more than INT64_MAX - 4 content bytes. An attacker could craft a malicious WARC archive to induce this overflow, potentially leading to unpredictable program behavior, memory corruption, or a denial-of-service cond

No products recorded, so this cannot be matched against anything.

CVE-2025-5916 Full triage →

A vulnerability has been identified in the libarchive library.

A vulnerability has been identified in the libarchive library. This flaw can lead to a heap buffer over-read due to the size of a filter block potentially exceeding the Lempel-Ziv-Storer-Schieber (LZSS) window. This means the library may attempt to read beyond the allocated memory buffer, which can result in unpredictable program behavior, crashes (denial of service), or the disclosure of sensitiv

No products recorded, so this cannot be matched against anything.

CVE-2025-5915 Full triage →

A vulnerability was found in systemd-coredump.

A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process. A SUID binary or process has a special type of permission, which allows the process to run

No products recorded, so this cannot be matched against anything.

CVE-2025-4598 Full triage →

A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled.

A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory re

No products recorded, so this cannot be matched against anything.

CVE-2025-26465 Full triage →

In ISC BIND9 versions BIND 9.11.14 -> 9.11.19, BIND 9.14.9 -> 9.14.12, BIND 9.16.0 -> 9.16.3, BIND Supported Preview Edition 9.11.14-S1 -> 9

In ISC BIND9 versions BIND 9.11.14 -> 9.11.19, BIND 9.14.9 -> 9.14.12, BIND 9.16.0 -> 9.16.3, BIND Supported Preview Edition 9.11.14-S1 -> 9.11.19-S1: Unless a nameserver is providing authoritative service for one or more zones and at least one zone contains an empty non-terminal entry containing an asterisk ("*") character, this defect cannot be encountered. A would-be attacker who is allowed to

No products recorded, so this cannot be matched against anything.

CVE-2020-8619 Full triage →