| Bug | Description | Note |
|---|
| CVE-2014-125135 | A security vulnerability has been detected in OctoPrint 1.0.0/1.1.0. A ... | check |
| CVE-2016-1584 | In all versions of Unity8 a running but not active application on a la ... | check proper tracking update |
| CVE-2018-25305 | librsvg2-bin 2.40.13 contains a buffer overflow vulnerability that all ... | check |
| CVE-2018-25306 | PDFunite 0.41.0 contains a buffer overflow vulnerability that allows l ... | check |
| CVE-2019-25485 | R 3.4.4 on Windows x64 contains a buffer overflow vulnerability in the ... | check |
| CVE-2019-25683 | FileZilla 3.40.0 contains a denial of service vulnerability in the loc ... | check |
| CVE-2022-4996 | A flaw has been found in mruby 3.1.0. Affected is the function udiv of ... | check |
| CVE-2022-23538 | github.com/sylabs/scs-library-client is the Go client for the Singular ... | check details, might as well affect golang-github-apptainer-container-library-client |
| CVE-2022-50942 | Incinga Web 2.8.2 contains a client-side cross-site scripting vulnerab ... | check status upstream |
| CVE-2023-26044 | react/http is an event-driven, streaming HTTP client and server implem ... | check, is embedded inicinga-php-thirdparty, icingaweb2-module-reactbundle possibly affected |
| CVE-2023-47268 | In libslic3r/GCode/PostProcessor.cpp in Prusa PrusaSlicer through 2.6. ... | check |
| CVE-2023-49316 | In Math/BinaryField.php in phpseclib 3 before 3.0.34, excessively larg ... | check if affecting ldap-account-manager or unused path |
| CVE-2023-50251 | php-svg-lib is an SVG file parsing / rendering library. Prior to versi ... | check, other packages are embedding the library: civicrm, icinga-php-thirdparty and icingaweb2 to be checked |
| CVE-2023-50252 | php-svg-lib is an SVG file parsing / rendering library. Prior to versi ... | check, other packages are embedding the library: civicrm, icinga-php-thirdparty and icingaweb2 to be checked |
| CVE-2023-50262 | Dompdf is an HTML to PDF converter for PHP. When parsing SVG images Do ... | check sources embedding php-dompdf if affected |
| CVE-2024-22420 | JupyterLab is an extensible environment for interactive and reproducib ... | check completeness, src:jupyter-notebook? |
| CVE-2024-22421 | JupyterLab is an extensible environment for interactive and reproducib ... | check completeness, src:jupyter-notebook? |
| CVE-2024-54192 | An issue inTcpreplay v4.5.1 allows a local attacker to cause a denial ... | check |
| CVE-2024-58399 | llama.cpp before b2731 contains an out-of-bounds read vulnerability in ... | check |
| CVE-2024-58400 | llama.cpp before b3701 contains an out-of-bounds read vulnerability in ... | check |
| CVE-2025-4382 | A flaw was found in systems utilizing LUKS-encrypted disks with GRUB c ... | double check if vulnerability only considered present after grub_is_cli_disabled is introduced |
| CVE-2025-6499 | A vulnerability classified as problematic was found in vstakhov libucl ... | check if impacts security wise rspamd, which embeds libucl and uses it a compile time |
| CVE-2025-8671 | A mismatch caused by client-triggered server-sent stream resets betwee ... | check, some projects will assign own CVEs and should then be covered under that specific CVE instead |
| CVE-2025-8941 | A flaw was found in linux-pam. The pam_namespace module may improperly ... | check likely RedHat specific incomplete fix for CVE-2025-6020, but asked to pinpoint incomplete fixes |
| CVE-2025-11010 | A vulnerability has been found in vstakhov libucl up to 0.9.2. Affecte ... | check if impacts security wise rspamd, which embeds libucl and uses it a compile time |
| CVE-2025-11147 | Reflected cross-site scripting (XSS) in Apt-Cacher-NG v3.2.1. The vuln ... | clarifying with reporter and Eduard Bloch on the issue. |
| CVE-2025-14575 | An Uncontrolled Search Path Element vulnerability in the OpenSSL TLS b ... | check |
| CVE-2025-15569 | A flaw has been found in Artifex MuPDF up to 1.26.1 on Windows. The im ... | check |
| CVE-2025-33221 | NVIDIA Display Driver for Windows and Linux contains a vulnerability i ... | check |
| CVE-2025-58064 | CKEditor 5 is a modern JavaScript rich-text editor with an MVC archite ... | check |
| CVE-2025-61261 | A reflected cross-site scripting (XSS) vulnerability in CKeditor v46.1 ... | check |
| CVE-2025-61982 | An arbitrary code execution vulnerability exists in the Code Stream di ... | check upstream status |
| CVE-2025-64394 | A vulnerability allowing a low-privileged local user to write arbitrar ... | check |
| CVE-2025-66578 | xmlseclibs is a library written in PHP for working with XML Encryption ... | check |
| CVE-2025-67108 | eProsima Fast-DDS v3.3 was discovered to contain improper validation f ... | check https://gist.github.com/lkloliver/81b5d5a8328d712dbfd497bf11dbe913, unclear if reported upstream |
| CVE-2025-69534 | Python-Markdown version 3.8 contain a vulnerability where malformed HT ... | Asking whether it really needs a backport: https://bugs.debian.org/1131896 |
| CVE-2025-69720 | The infocmp command-line tool in ncurses before 6.5-20251213 has a sta ... | check upstream status |
| CVE-2025-69969 | A lack of authentication and authorization mechanisms in the Bluetooth ... | check |
| CVE-2025-70887 | An issue in ralphje Signify before v.0.9.2 allows a remote attacker to ... | check |
| CVE-2025-71439 | llama.cpp before b5649 contains a heap out-of-bounds read vulnerabilit ... | check |
| CVE-2026-0708 | A flaw was found in libucl. A remote attacker could exploit this by pr ... | check if impacts security wise rspamd, which embeds libucl and uses it a compile time |
| CVE-2026-1703 | When pip is installing and extracting a maliciously crafted wheel arch ... | check as well pipenv |
| CVE-2026-4833 | A weakness has been identified in Orc discount up to 3.0.1.2. This iss ... | check libtext-markdown-discount-perl, ruby-rdiscount, cantor, embedding discount; check if security impact present |
| CVE-2026-5422 | A path traversal vulnerability exists in jupyter-server version 2.17.0 ... | CNA contacted responsible for this CVE entry as this seems to be a duplicate of CVE-2026-35397 |
| CVE-2026-6657 | A vulnerability in jupyter-server versions 1.12.0 through 2.17.0 allow ... | CNA contacted responsible for this CVE entry as this seems to be a duplicate of CVE-2026-40110 |
| CVE-2026-7701 | A security vulnerability has been detected in Telegram Desktop up to 6 ... | check upstream reports |
| CVE-2026-7790 | Uncontrolled Resource Consumption vulnerability in ninenines cowlib (c ... | check if embedded copy in rabbitmq-server is problematic |
| CVE-2026-8851 | SOGo versions 5.12.7 and prior contains a SQL injection vulnerability ... | check correctness |
| CVE-2026-8863 | Multiple Microsoft-sigend UEFI SHIM bootloaders are vulnerable to Secu ... | check |
| CVE-2026-10051 | In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the se ... | check, jetty9 might not be affected as not explicitly mentioned in the GhSA and still supported |
| CVE-2026-10528 | A security flaw has been discovered in Orthanc DICOM Server up to 1.12 ... | check, uderlying issue in src:dcmtk and should the CVE be associated with it? Cf. #1138713 |
| CVE-2026-10537 | A misconfiguration issue in the affected service in Control-M/Enterpri ... | check |
| CVE-2026-15713 | A vulnerability was found in libsoup's HTTP/2 protocol implementation. ... | While the above issue references this CVE, it doesn't match the CVE description at all, check with CNA (Red Hat) |
| CVE-2026-15779 | A flaw was found in samba's pam_winbind. When mkhomedir is enabled, pa ... | check if Red Hat specific |
| CVE-2026-19201 | An uncontrolled recursion vulnerability in the Windows SIPA event log ... | check, GHSA not yet public, maybe Windows specific |
| CVE-2026-22739 | Vulnerability in Spring Cloud when substituting the profile parameter ... | check |
| CVE-2026-24182 | NVIDIA Display Driver for Windows and Linux contains a vulnerability w ... | check |
| CVE-2026-24187 | NVIDIA Display Driver for Linux contains a vulnerability where an atta ... | check |
| CVE-2026-24190 | NVIDIA Display Driver for Windows and Linux contains a vulnerability i ... | check |
| CVE-2026-24192 | NVIDIA Display Driver for Linux contains a vulnerability where an atta ... | check |
| CVE-2026-24193 | NVIDIA Display Driver for Windows and Linux contains a vulnerability w ... | check |
| CVE-2026-24194 | NVIDIA Display Driver for Linux contains a vulnerability in a kernel m ... | check |
| CVE-2026-24195 | NVIDIA Display Driver for Linux contains a vulnerability in UVM, where ... | check |
| CVE-2026-24196 | NVIDIA Display Driver for Linux contains a vulnerability where a user ... | check |
| CVE-2026-24197 | NVIDIA Display Driver for Linux contains a vulnerability in the Multi- ... | check |
| CVE-2026-24198 | NVIDIA GPU Display Driver for Linux contains a vulnerability where an ... | check |
| CVE-2026-24199 | NVIDIA Display Driver for Linux contains a vulnerability in a kernel m ... | check |
| CVE-2026-27970 | Angular is a development platform for building mobile and desktop web ... | check status for older versions |
| CVE-2026-28343 | CKEditor 5 is a modern JavaScript rich-text editor with an MVC archite ... | check |
| CVE-2026-29022 | dr_libs dr_wav.h version 0.14.4 and earlier (fixed in commit 8a7258c) ... | qtads, dosbox-x, roc-toolkit, octave-ltfat, faudio bundle a copy, check security impact |
| CVE-2026-29036 | cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved na ... | check, report upstream status |
| CVE-2026-30478 | A Dynamic-link Library Injection vulnerability in GatewayGeo MapServer ... | check |
| CVE-2026-30479 | A Dynamic-link Library Injection vulnerability in OSGeo Project MapSer ... | check |
| CVE-2026-31053 | A double free vulnerability exists in librz/bin/format/le/le.c in the ... | check |
| CVE-2026-32313 | xmlseclibs is a library written in PHP for working with XML Encryption ... | check |
| CVE-2026-32600 | xml-security is a library that implements XML signatures and encryptio ... | check |
| CVE-2026-32635 | Angular is a development platform for building mobile and desktop web ... | check status for older versions |
| CVE-2026-34240 | JOSE is a Javascript Object Signing and Encryption (JOSE) library. Pri ... | check |
| CVE-2026-36499 | A missing upper-bound check in the udpif_set_threads() function of Ope ... | check, unclear status/validity |
| CVE-2026-39178 | A SQL injection vulnerability in SOGo before 5.12.7 allows authenticat ... | CVE-2026-39178 and CVE-2026-39179 are duplicates of CVE-2026-46445 and CVE-2026-46446, CNA contacted |
| CVE-2026-39179 | A SQL injection vulnerability in SOGo before 5.12.7 allows authenticat ... | CVE-2026-39178 and CVE-2026-39179 are duplicates of CVE-2026-46445 and CVE-2026-46446, CNA contacted |
| CVE-2026-39860 | Nix is a package manager for Linux and other Unix systems. A bug in th ... | check, potentially affecting guix if same issue in backporting fix for CVE-2024-2729 |
| CVE-2026-40033 | FreeRDP before 3.26.0 contains a heap-buffer-overflow vulnerability in ... | unclear fixing commit references, incorrect reference in CVE entry? |
| CVE-2026-41889 | pgx is a PostgreSQL driver and toolkit for Go. Prior to version 5.9.2, ... | check the other golang-github-jackc-pgx* sources |
| CVE-2026-42199 | Grid is a data structure grid for rust. From version 0.17.0 to before ... | check |
| CVE-2026-42308 | Pillow is a Python imaging library. Prior to version 12.2.0, if a font ... | research fixing commit(s), maybe https://github.com/python-pillow/Pillow/pull/9518/changes |
| CVE-2026-42503 | gopls by default communicates via pipe. However, -port and -listen fla ... | check impact on golang-golang-x-tools |
| CVE-2026-43627 | llama.cpp builds b1283 through b9058 contain an integer overflow vulne ... | check |
| CVE-2026-43628 | llama.cpp builds b3978 through b9058 contain an integer underflow and ... | check |
| CVE-2026-43629 | llama.cpp builds b4882 through b9058 contain a heap buffer overflow vu ... | check |
| CVE-2026-43631 | llama.cpp builds b7492 through the latest b9060 contains a use-after-f ... | check |
| CVE-2026-43632 | llama.cpp builds b7492 through the latest b9060 contains a use-after-f ... | check |
| CVE-2026-44933 | `PluginScript` attempts to `chroot` the plugin to the `repoManagerRoot ... | check |
| CVE-2026-46727 | An issue was discovered in Ruby 4 before 4.0.5. A race condition leadi ... | check |
| CVE-2026-47875 | Applications that deserialize execution contexts with Jackson2Executio ... | check |
| CVE-2026-47878 | DefaultExecutionContextSerializer, used by default in Spring Batch's J ... | check |
| CVE-2026-47881 | Spring Batch's FlatFileItemReader supports files where a single logica ... | check |
| CVE-2026-55223 | c3p0 is a JDBC Connection pooling library. In versions prior to 0.14.0 ... | check if that is an issue with the packaged version |
| CVE-2026-55663 | mediasoup is a WebRTC video conferencing system. From version 3.20.0 u ... | check |
| CVE-2026-56816 | Netty is a network application framework for development of protocol s ... | check, potentially only in 4.2.y series |
| CVE-2026-56818 | Netty is an asynchronous, event-driven network application framework. ... | check missing upstream GHSA |
| CVE-2026-57862 | Kanboard 1.2.52 and prior contains a server-side request forgery vulne ... | check upstream report |
| CVE-2026-61711 | BuildKit is a toolkit for converting source code to build artifacts in ... | check security impact on docker.io |
| CVE-2026-61712 | BuildKit is a toolkit for converting source code to build artifacts in ... | check potential security impact on docker.io |
| CVE-2026-62846 | SQUID-2026:9 | check SQUID-2026:9 information not yet public |
| CVE-2026-64611 | A flaw was found in libcupsfilters. The cfIEEE1284NormalizeMakeModel() ... | check use in embedded cups, cups-filters |
| CVE-2026-71054 | Vulnerability in Oracle Java SE (component: 2D). Supported versions t ... | check |
| CVE-2026-71266 | tinyobjloader-c's tinyobj_parse_and_index_mtl_file (tinyobj_loader_c.h ... | check, embedded in src:goxel and src:raylib |
| CVE-2026-71437 | Mermaid is a JavaScript tool that uses Markdown-inspired text to creat ... | check introducing commit for further assessment |
| CVE-2026-71439 | Mermaid is a JavaScript tool that uses Markdown-inspired text to creat ... | check introducing commit, might then be only 11.6.0 and above. |
| CVE-2026-71891 | In Bouncy Castle for Java before 1.86, BLS12_381BasicScheme.keyValidat ... | check, maybe only introduced in 1.85? |
| CVE-2026-75593 | BuildKit is a toolkit for converting source code to build artifacts in ... | check security impact on docker.io |
| CVE-2026-76182 | In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be config ... | check if tracking correct, issue in multiple jetty components |
| CVE-2026-78178 | A vulnerability was determined in jQWidgets up to 24.0.1. This affects ... | check |
| CVE-2026-79680 | Authentication bypass vulnerability in the password authentication mec ... | check |
| CVE-2026-83550 | A flaw was found in postgres-exporter. Due to the blank import of `net ... | check, Red Hat bugzilla entry is unhelpful at time of check in 2026-10-06 (only contains a hash reference) |
| CVE-2026-84233 | A flaw was found in rpm. A local attacker could supply a specially cra ... | check upstream details |
| CVE-2026-86344 | A flaw was found in 389-ds-base. An unauthenticated remote attacker ca ... | check, not details provided on 2026-10-02 in Red Hat bugzilla |
| CVE-2026-86476 | A flaw was found in gst-plugins-base. A heap buffer overflow can be tr ... | check details when upstream issue public? |
| CVE-2026-87020 | An integer overflow in a specified pitch and buffer-size computation l ... | check, might be a dupe of the existing issues addressed in 1.13, needs clarification |
| CVE-2026-88350 | An integer overflow vulnerability exists in MPack 1.1.1 in mpack_node_ ... | check, embedded in balboa, bpfilter, pocketpy |
| CVE-2026-88351 | An integer overflow vulnerability exists in the MPack Node API in MPac ... | check, embedded in balboa, bpfilter, pocketpy |
| CVE-2026-89091 | A flaw was found in ansible-core. When installing a collection with `a ... | check, details from Red Hat bugzilla not accessible on 2026-10-09 |
| CVE-2026-92284 | Caddy is an extensible server platform that uses TLS by default. In ve ... | check references, refers to GHSA-j8px-rmrx-76h9 which is for CVE-2026-77281 |
| CVE-2026-92382 | An out-of-bounds write flaw was found in usbredir. Starting an isochro ... | check details once Red Hat opens up bugzilla entry |
| CVE-2026-92700 | Caddy is an extensible server platform that uses TLS by default. In ve ... | check references, refers to GHSA-j8px-rmrx-76h9 which is for CVE-2026-77281 |
| CVE-2026-92925 | A flaw was found in Redis community. The cluster bus packet parser, re ... | check if redict affected |
| CVE-2026-93315 | When proxy networking with CA injection is enabled, a build can modify ... | check security impact on docker.io |
| CVE-2026-93316 | If BuildKit daemon is started with --cdi-disabled it can lead to daemo ... | check security impact on docker.io |
| CVE-2026-93317 | An unauthenticated attacker controlling a registry or OCI-layout blob ... | check security impact on docker.io |
| CVE-2026-93318 | A malicious image can advertise DiffIDs from another image while conta ... | check security impact on docker.io |
| CVE-2026-93319 | A malicious external BuildKit frontend can send requests using the int ... | check security impact on docker.io |
| CVE-2026-93320 | BuildKit may be tricked into performing file actions with special file ... | check security impact on docker.io |
| CVE-2026-93321 | A malicious frontend can submit an LLB definition that causes buildkit ... | check security impact on docker.io |
| CVE-2026-93322 | A malicious frontend can submit an LLB definition that causes buildkit ... | check security impact on docker.io |
| CVE-2026-93323 | The Dockerfile frontend loaded the Dockerfile and .dockerignore files ... | check security impact on docker.io |
| CVE-2026-93326 | A build step for a Git source, crafted in a specific way, can bypass s ... | check security impact on docker.io |
| CVE-2026-93879 | | check, missing further details in Red Hat bugzilla entry at 2026-10-13 |
| CVE-2026-95155 | FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, ... | check |
| CVE-2026-95208 | An issue in the ConfirmNameConstraints() function (wolfcrypt/src/asn.c ... | check, valid assignment? https://gist.github.com/lkloliver/14edf8bbfbf5769949b85c7f5cc2eba2 |
| CVE-2026-100164 | Observable response discrepancy vulnerability in Rolantis Information ... | check |
| CVE-2026-100888 | A weakness has been identified in Trusted Domain Project OpenDKIM up t ... | check upstream details |
| CVE-2026-100889 | A vulnerability was detected in Trusted Domain Project OpenDKIM up to ... | check upstream details |
| CVE-2026-100890 | A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. ... | check upstream details |
| CVE-2026-100891 | A vulnerability has been found in Trusted Domain Project OpenDMARC up ... | check upstream details |
| CVE-2026-100895 | A security flaw has been discovered in Trusted Domain Project OpenARC ... | check |
| CVE-2026-101272 | The mechanism binding files generated during a shredding process to th ... | check |
| CVE-2026-101273 | Some of our API endpoints allowed to create order payments referencing ... | check |
| CVE-2026-101274 | When pretix is used as the identity provider in a Single-Sign-On (SSO) ... | check |
| CVE-2026-102831 | JupyterLab is an extensible environment for interactive and reproducib ... | check, might be introduced later |
| CVE-2026-103995 | Response body and chunk parsing would handle non-hex or negative integ ... | check |
| CVE-2026-104016 | ProtobufParser parses length-prefixed protobuf string and bytes fields ... | check |
| CVE-2026-104189 | The 3D Viewer for Nextcloud is a comprehensive 3D model viewer applica ... | check |
| CVE-2026-104383 | Improper Control of Generation of Code in Pigeon MFA service in EagleC ... | check |
| CVE-2026-104384 | Insufficiently Protected Credentials in tunnel gateway and provisionin ... | check |
| CVE-2026-104596 | libosmocore through 1.14.1 contains out-of-bounds reads in the GSM 04. ... | check |
| CVE-2026-104597 | libosmocore through 1.14.1 contains an out-of-bounds read in iuup_rx_i ... | check |
| CVE-2026-104598 | libosmo-sigtran through 2.2.1 contains an out-of-bounds read in the M3 ... | check |
| CVE-2026-104895 | The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw- ... | check |
| CVE-2026-105323 | Improper neutralization of input during web page generation ('cross-si ... | check |
| CVE-2026-105477 | A vulnerability in Veeam Agent for Linux allows for local privilege es ... | check |
| CVE-2026-105612 | PostgreSQL Anonymizer contains a vulnerability that data-modifying CTE ... | check |
| CVE-2026-105613 | PostgreSQL Anonymizer's range-based dummy functions dont constraint th ... | check |
| CVE-2026-105614 | PostgreSQL Anonymizer's `anon.image_blur()` function doesn't check the ... | check |
| CVE-2026-105615 | PostgreSQL's optimized statistics on a table are visible as long as yo ... | check |
| CVE-2026-105616 | PostgreSQL restricts acces to the salt and shift via the `SHOW` comman ... | check |
| CVE-2026-105617 | PostgreSQL Anonymizer doesn't invalidate plans prepared after a rule w ... | check |
| CVE-2026-105618 | PostgreSQL Anonymizer's documentation recommends applying rules on par ... | check |
| CVE-2026-105619 | PostgreSQL Anonymizer doesn't mask data accessed thru a security_invok ... | check |
| CVE-2026-105620 | PostgreSQL Anonymizer doesn't mask data returned by a sub-query in a r ... | check |
| CVE-2026-105946 | Out-of-bounds read in the QAuthenticator NTLM authentication handling ... | check |
| CVE-2026-105963 | Externally-Generated Error Message Containing Sensitive Information vu ... | check, NFU, but is embedded in sonic-pi and check if security impacted |
| CVE-2026-105987 | KGS Software tia Viewer is vulnerable to Stored XSS via the annotation ... | check |
| CVE-2026-106017 | Improper certificate validation in the OpenVPN 3 Core library version ... | check, details, embedded in openvpn3-client? |
| CVE-2026-106076 | A vulnerability allowing an authenticated organization-transfer peer t ... | check |
| CVE-2026-106077 | A vulnerability allowing a user with the Veeam Backup for Microsoft 36 ... | check |
| CVE-2026-106078 | A vulnerability allowing an unauthenticated attacker to bypass REST AP ... | check |
| CVE-2026-106971 | An integer overflow in the MessagePack\BufferUnpacker component of ryb ... | check |
| CVE-2026-106972 | An uncontrolled recursion in the MessagePack\BufferUnpacker::unpack() ... | check |
| CVE-2026-107067 | An issue in Shirt Pocket's SuperDuper! 4.0.9 and earlier allow a local ... | check |
| CVE-2026-107145 | The twofactor_gauthenticator plugin for Roundcube is vulnerable to bru ... | check |
| CVE-2026-107146 | The twofactor_gauthenticator plugin for Roundcube is vulnerable to ses ... | check |
| CVE-2026-107147 | The twofactor_gauthenticator plugin for Roundcube is vulnerable to 2fa ... | check |
| CVE-2026-107157 | Specially crafted CBOR input passed to QCborValue::fromCbor() in Qt Co ... | check |
| CVE-2026-107472 | An out-of-bounds read vulnerability in the QTextCodec TSCII encoding o ... | check |
| CVE-2026-107590 | An out-of-bounds write vulnerability in the Qt QTextCodec iconv-based ... | check |
| CVE-2026-107671 | A vulnerability allowing an attacker with valid Administrator credenti ... | check |
| CVE-2026-108093 | A flaw was found in GIMP. The XCF loader processes image-simulation-in ... | research upstream information, Red Hat bugzilla is not open at 2026-10-09 |
| CVE-2026-108140 | A vulnerability allowing an authenticated user with the Restore Operat ... | check |
| CVE-2026-108141 | A vulnerability allowing an authenticated user with the Restore Operat ... | check |
| CVE-2026-108142 | A vulnerability allowing an unauthenticated attacker to bypass authori ... | check |
| CVE-2026-108752 | JupyterHub through 6.0.1 contains an identifier collision vulnerabilit ... | check, upstream detail |
| CVE-2026-109344 | DOMPurify from 3.4.13 before 3.4.16 contains a cross-site scripting vu ... | possibly not affecting older version, as upstream advisory claims from 3.4.13 on |
| CVE-2026-109823 | An attacker can read the name of filesystem paths of your application ... | check |
| CVE-2026-110181 | PostgreSQL Anonymizer contains a vulnerability related to anonymizatio ... | check |
| CVE-2026-110182 | PostgreSQL Anonymizer contains a vulnerability related to the anon.par ... | check |
| CVE-2026-110183 | PostgreSQL Anonymizer contains a vulnerability related to static maski ... | check |
| CVE-2026-110747 | ProtobufParser._readStringKey() reads the length prefix of a protobuf ... | check |
| CVE-2026-110910 | ### Summary `qs.stringify` with `allowEmptyArrays: true` writes the ... | check |
| CVE-2026-110928 | | check, unclear if usptream is affected by the specific issue? |
| CVE-2026-111105 | Telegram rlottie Numeric Truncation Remote Code Execution Vulnerabilit ... | check |
| CVE-2026-112214 | A flaw was found in the GStreamer ASF demuxer in gst-plugins-ugly. Whe ... | check, no details yet (2026-10-20) |
| CVE-2026-112258 | A flaw was found in GIMP. The XCF loader can leave a dangling pointer ... | check, double if isolated correct commit,relation to CVE-2026-112261 |
| CVE-2026-112261 | A flaw was found in GIMP. Opening a crafted XCF that selects a path an ... | check, double if isolated correct commit, relation to CVE-2026-112258 |
| CVE-2026-112353 | GFI KerioConnect (Kerio Connect) before 10.0.8 Patch 2 contains a stor ... | check |
| CVE-2026-112362 | @fastify/express is a Fastify plugin that runs Express middleware insi ... | check |
| CVE-2026-114349 | When a broker decodes a compressed record batch, the per-record decode ... | check |
| CVE-2026-114595 | In EPICS Base release 7.0.10 and prior, an integer overflow in network ... | check |
| CVE-2026-114596 | In EPICS Base release 7.0.10 and prior, an improper validation of mess ... | check |
| CVE-2026-114597 | In EPICS Base release 7.0.10 and prior, an insufficient validation of ... | check |
| CVE-2026-114598 | In EPICS Base release 7.0.10 and prior, an insufficient validation of ... | check |
| CVE-2026-114820 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ... | check |
| CVE-2026-115533 | The LeRobot library is vulnerable to arbitrary code execution via unsa ... | check |
| CVE-2026-115700 | Interpretation Conflict vulnerability in hackney_url in benoitc hackne ... | check |
| CVE-2026-115924 | Rembg is a tool to remove images background. Prior to 2.0.82, the publ ... | check |
| CVE-2026-116070 | Docker-Proxy through 5.1.9 contains a missing authentication vulnerabi ... | check |
| CVE-2026-116078 | Allocation of Resources Without Limits or Throttling vulnerability in ... | check |
| CVE-2026-116477 | A security vulnerability has been detected in a2aproject a2a-dotnet up ... | check |
| CVE-2026-116478 | A vulnerability was detected in a2aproject a2a-go up to 2.4.0. This af ... | check |
| CVE-2026-116479 | A flaw has been found in a2aproject a2a-java up to 1.2.0.Final. This i ... | check |
| CVE-2026-116482 | A vulnerability has been found in subhajitkhan online-clinic-managemen ... | check |
| CVE-2026-116502 | A flaw has been found in turboderp-org ExLlamaV2 up to 0.3.2. The impa ... | check |
| CVE-2026-116515 | A security vulnerability has been detected in itsourcecode Online Book ... | check |
| CVE-2026-116554 | A flaw has been found in Argilla up to 2.8.0. The affected element is ... | check |
| CVE-2026-116555 | A vulnerability has been found in Argilla up to 2.8.0. The impacted el ... | check |
| CVE-2026-116556 | A vulnerability was found in Argilla up to 2.8.0. This affects an unkn ... | check |
| CVE-2026-116575 | Mem0 provides persistent memory infrastructure for AI agents and appli ... | check |
| CVE-2026-116580 | Seroval facilitates JavaScript value stringification, including comple ... | check |
| CVE-2026-116581 | Seroval facilitates JavaScript value stringification, including comple ... | check |
| CVE-2026-116582 | Seroval facilitates JavaScript value stringification, including comple ... | check |
| CVE-2026-116583 | Seroval facilitates JavaScript value stringification, including comple ... | check |
| CVE-2026-116584 | Seroval facilitates JavaScript value stringification, including comple ... | check |
| CVE-2026-116585 | Go JOSE provides an implementation of the Javascript Object Signing an ... | check |
| CVE-2026-116586 | Go JOSE provides an implementation of the Javascript Object Signing an ... | check |
| CVE-2026-116587 | Go JOSE provides an implementation of the Javascript Object Signing an ... | check |
| CVE-2026-116588 | Datadog dd-trace-py is the Datadog Python APM client. From 1.5.0 until ... | check |
| CVE-2026-116589 | Datadog dd-trace-py is the Datadog Python APM client. From 3.13.0 unti ... | check |
| CVE-2026-116590 | snappy-java is a Java port of the snappy, a fast C++ compresser/decomp ... | check |
| CVE-2026-116591 | compress provides various compression algorithms. Prior to 1.20.2, the ... | check |
| CVE-2026-116608 | A security vulnerability has been detected in DAMO Academy VideoLLaMA2 ... | check |
| CVE-2026-116620 | A security vulnerability has been detected in Tencent RapidJSON up to ... | check |
| CVE-2026-116671 | Infinite loop in Xpdf 4.06 and earlier, due to incorrect validation of ... | check |
| CVE-2026-116675 | TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and ... | check |
| CVE-2026-116676 | Atlantis is a self-hosted golang application that listens for Terrafor ... | check |
| CVE-2026-116677 | OpenWISP Controller is a network and WiFi controller for provisioning, ... | check |
| CVE-2026-116678 | Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to ... | check |
| CVE-2026-116679 | Neko is a a self-hosted virtual browser that runs in Docker and uses W ... | check |
| CVE-2026-116680 | HomeBox is a home inventory and organization system. Prior to version ... | check |
| CVE-2026-116682 | FileBrowser Quantum is a free, self-hosted, web-based file manager. Pr ... | check |
| CVE-2026-116683 | CTFer.io's CTFd Terraform Provider manages CTFd resources as code. Fro ... | check |
| CVE-2026-116687 | CKEditor 5 is a modern JavaScript rich-text editor with an MVC archite ... | check |
| CVE-2026-116688 | CKEditor 5 is a modern JavaScript rich-text editor with an MVC archite ... | check |
| CVE-2026-116723 | FLTK through 1.4.5 contains a stack-based buffer overflow vulnerabilit ... | check |
| CVE-2026-116724 | FLTK through 1.4.5 contains an integer overflow vulnerability in Fl_BM ... | check |
| CVE-2026-116725 | gbsplay through 0.0.103 contains an out-of-bounds read vulnerability i ... | check |
| CVE-2026-116726 | Gbsplay through 0.0.103 contains a heap out-of-bounds read vulnerabili ... | check |
| CVE-2026-116727 | gbsplay through 0.0.103 contains a heap out-of-bounds read vulnerabili ... | check |
| CVE-2026-116728 | libfvde through 20260923 contains a heap out-of-bounds read vulnerabil ... | check |
| CVE-2026-116729 | libfvde through 20260923 contains a heap out-of-bounds read vulnerabil ... | check |
| CVE-2026-116730 | Furnace through 0.6.8.3 contains an out-of-bounds heap read vulnerabil ... | check |
| CVE-2026-116731 | Furnace through 0.6.8.3 contains an out-of-bounds write vulnerability ... | check |
| CVE-2026-116732 | libdwarf through 2.3.3 contains a heap out-of-bounds read vulnerabilit ... | check |
| CVE-2026-116733 | flatcc through 0.6.4 contains an out-of-bounds read vulnerability in _ ... | check |
| CVE-2026-116734 | flatcc through 0.6.4 contains an integer overflow vulnerability in the ... | check |
| CVE-2026-116735 | libpff through 20260926 contains an off-by-one bounds check in libpff_ ... | check |
| CVE-2026-116736 | Libpff through 20260926 contains a heap out-of-bounds read vulnerabili ... | check |
| CVE-2026-116737 | libphdi through 20260902 contains a heap out-of-bounds read vulnerabil ... | check |
| CVE-2026-116738 | VMime through 0.9.2 contains an integer underflow in the uuEncoder::de ... | check |
| CVE-2026-116739 | VMime through 0.9.2 contains an information disclosure vulnerability i ... | check |
| CVE-2026-116740 | libcss through 0.9.2 contains a NULL pointer dereference vulnerability ... | check |
| CVE-2026-116741 | Speex (libspeex) through 1.2.1 contains an out-of-bounds write vulnera ... | check |
| CVE-2026-116742 | HTSlib through 1.24 contains a heap out-of-bounds write and read vulne ... | check |
| CVE-2026-118027 | Frame poisoning in the Layout component. This vulnerability was fixed ... | check |
| CVE-2026-118384 | GNU mtools through 4.0.49 has an out-of-bounds write in parse_vses in ... | check if fixed in 4.0.49 |
| CVE-2026-118435 | Out-of-bounds write vulnerability in Samsung Open Source escargot allo ... | check |
| TEMP-1142597-FFA22A | GHSA-68ff-gq39-pqjm: relay: authentication bypass with the "plain" password hash algorithm | check, GHSA-68ff-gq39-pqjm claims >= 4.3.0 but potentially since v2.9-rc1 |