| Bug | Description | Note |
|---|
| CVE-2016-1584 | In all versions of Unity8 a running but not active application on a la ... | check proper tracking update |
| CVE-2016-20099 | L-SMASH through 2.14.5 contains an infinite loop vulnerability in vc1_ ... | check |
| CVE-2017-20286 | DevIL through 1.8.0 contains a heap-based buffer overflow in iGetPalet ... | check |
| CVE-2018-25305 | librsvg2-bin 2.40.13 contains a buffer overflow vulnerability that all ... | check |
| CVE-2018-25306 | PDFunite 0.41.0 contains a buffer overflow vulnerability that allows l ... | check |
| CVE-2019-25485 | R 3.4.4 on Windows x64 contains a buffer overflow vulnerability in the ... | check |
| CVE-2019-25683 | FileZilla 3.40.0 contains a denial of service vulnerability in the loc ... | check |
| CVE-2020-37279 | easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vu ... | check |
| CVE-2020-37280 | cbor-sync through 1.0.4 contains a resource exhaustion vulnerability i ... | check |
| CVE-2020-37281 | Gravitee API Management through 4.12.22 contains an authentication byp ... | check |
| CVE-2020-37282 | office-converter through 1.0.2 contains an OS command injection vulner ... | check |
| CVE-2021-48011 | Servor 1.0.0 through 4.0.2 contains a path traversal vulnerability tha ... | check |
| CVE-2021-48012 | fast-toml through 0.5.4 contains a prototype pollution vulnerability t ... | check |
| CVE-2022-4996 | A flaw has been found in mruby 3.1.0. Affected is the function udiv of ... | check |
| CVE-2022-23538 | github.com/sylabs/scs-library-client is the Go client for the Singular ... | check details, might as well affect golang-github-apptainer-container-library-client |
| CVE-2022-50942 | Incinga Web 2.8.2 contains a client-side cross-site scripting vulnerab ... | check status upstream |
| CVE-2022-51020 | Flower before 2.2.0 contains a cross-site request forgery vulnerabilit ... | check |
| CVE-2023-26044 | react/http is an event-driven, streaming HTTP client and server implem ... | check, is embedded inicinga-php-thirdparty, icingaweb2-module-reactbundle possibly affected |
| CVE-2023-47268 | In libslic3r/GCode/PostProcessor.cpp in Prusa PrusaSlicer through 2.6. ... | check |
| CVE-2023-49316 | In Math/BinaryField.php in phpseclib 3 before 3.0.34, excessively larg ... | check if affecting ldap-account-manager or unused path |
| CVE-2023-50251 | php-svg-lib is an SVG file parsing / rendering library. Prior to versi ... | check, other packages are embedding the library: civicrm, icinga-php-thirdparty and icingaweb2 to be checked |
| CVE-2023-50252 | php-svg-lib is an SVG file parsing / rendering library. Prior to versi ... | check, other packages are embedding the library: civicrm, icinga-php-thirdparty and icingaweb2 to be checked |
| CVE-2023-50262 | Dompdf is an HTML to PDF converter for PHP. When parsing SVG images Do ... | check sources embedding php-dompdf if affected |
| CVE-2024-22420 | JupyterLab is an extensible environment for interactive and reproducib ... | check completeness, src:jupyter-notebook? |
| CVE-2024-22421 | JupyterLab is an extensible environment for interactive and reproducib ... | check completeness, src:jupyter-notebook? |
| CVE-2024-34319 | A Server-Side Request Forgery (SSRF) in the serviceURL parameter of Pr ... | check |
| CVE-2024-34320 | ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incor ... | check |
| CVE-2024-34321 | ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflec ... | check |
| CVE-2024-34323 | ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insec ... | check |
| CVE-2024-34324 | An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to ex ... | check |
| CVE-2024-34326 | ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflec ... | check |
| CVE-2024-54192 | An issue inTcpreplay v4.5.1 allows a local attacker to cause a denial ... | check |
| CVE-2024-58389 | HoloViz Panel from 1.2.2 before 1.9.0 contains an open redirect vulner ... | check |
| CVE-2024-58392 | PhysicsFS through 3.2.0 contains an out-of-bounds read vulnerability i ... | check |
| CVE-2025-4382 | A flaw was found in systems utilizing LUKS-encrypted disks with GRUB c ... | double check if vulnerability only considered present after grub_is_cli_disabled is introduced |
| CVE-2025-6499 | A vulnerability classified as problematic was found in vstakhov libucl ... | check if impacts security wise rspamd, which embeds libucl and uses it a compile time |
| CVE-2025-8671 | A mismatch caused by client-triggered server-sent stream resets betwee ... | check, some projects will assign own CVEs and should then be covered under that specific CVE instead |
| CVE-2025-8941 | A flaw was found in linux-pam. The pam_namespace module may improperly ... | check likely RedHat specific incomplete fix for CVE-2025-6020, but asked to pinpoint incomplete fixes |
| CVE-2025-11010 | A vulnerability has been found in vstakhov libucl up to 0.9.2. Affecte ... | check if impacts security wise rspamd, which embeds libucl and uses it a compile time |
| CVE-2025-11147 | Reflected cross-site scripting (XSS) in Apt-Cacher-NG v3.2.1. The vuln ... | clarifying with reporter and Eduard Bloch on the issue. |
| CVE-2025-14575 | An Uncontrolled Search Path Element vulnerability in the OpenSSL TLS b ... | check |
| CVE-2025-15569 | A flaw has been found in Artifex MuPDF up to 1.26.1 on Windows. The im ... | check |
| CVE-2025-33221 | NVIDIA Display Driver for Windows and Linux contains a vulnerability i ... | check |
| CVE-2025-58064 | CKEditor 5 is a modern JavaScript rich-text editor with an MVC archite ... | check |
| CVE-2025-61261 | A reflected cross-site scripting (XSS) vulnerability in CKeditor v46.1 ... | check |
| CVE-2025-61982 | An arbitrary code execution vulnerability exists in the Code Stream di ... | check upstream status |
| CVE-2025-66578 | xmlseclibs is a library written in PHP for working with XML Encryption ... | check |
| CVE-2025-67108 | eProsima Fast-DDS v3.3 was discovered to contain improper validation f ... | check https://gist.github.com/lkloliver/81b5d5a8328d712dbfd497bf11dbe913, unclear if reported upstream |
| CVE-2025-69534 | Python-Markdown version 3.8 contain a vulnerability where malformed HT ... | Asking whether it really needs a backport: https://bugs.debian.org/1131896 |
| CVE-2025-69720 | The infocmp command-line tool in ncurses before 6.5-20251213 has a sta ... | check upstream status |
| CVE-2025-69969 | A lack of authentication and authorization mechanisms in the Bluetooth ... | check |
| CVE-2025-70887 | An issue in ralphje Signify before v.0.9.2 allows a remote attacker to ... | check |
| CVE-2025-71429 | GPT-SoVITS through 20250606v2pro contains an OS command injection vuln ... | check |
| CVE-2025-71433 | Kaneo before 2.1.6 contains a missing authorization vulnerability that ... | check |
| CVE-2026-0708 | A flaw was found in libucl. A remote attacker could exploit this by pr ... | check if impacts security wise rspamd, which embeds libucl and uses it a compile time |
| CVE-2026-1703 | When pip is installing and extracting a maliciously crafted wheel arch ... | check as well pipenv |
| CVE-2026-4833 | A weakness has been identified in Orc discount up to 3.0.1.2. This iss ... | check libtext-markdown-discount-perl, ruby-rdiscount, cantor, embedding discount; check if security impact present |
| CVE-2026-5422 | A path traversal vulnerability exists in jupyter-server version 2.17.0 ... | CNA contacted responsible for this CVE entry as this seems to be a duplicate of CVE-2026-35397 |
| CVE-2026-6657 | A vulnerability in jupyter-server versions 1.12.0 through 2.17.0 allow ... | CNA contacted responsible for this CVE entry as this seems to be a duplicate of CVE-2026-40110 |
| CVE-2026-7701 | A security vulnerability has been detected in Telegram Desktop up to 6 ... | check upstream reports |
| CVE-2026-7790 | Uncontrolled Resource Consumption vulnerability in ninenines cowlib (c ... | check if embedded copy in rabbitmq-server is problematic |
| CVE-2026-8851 | SOGo versions 5.12.7 and prior contains a SQL injection vulnerability ... | check correctness |
| CVE-2026-8863 | Multiple Microsoft-sigend UEFI SHIM bootloaders are vulnerable to Secu ... | check |
| CVE-2026-10051 | In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the se ... | check, jetty9 might not be affected as not explicitly mentioned in the GhSA and still supported |
| CVE-2026-10528 | A security flaw has been discovered in Orthanc DICOM Server up to 1.12 ... | check, uderlying issue in src:dcmtk and should the CVE be associated with it? Cf. #1138713 |
| CVE-2026-13326 | An out-of-bounds read in Qt NFC's language code length parsing allows ... | check |
| CVE-2026-14851 | A vulnerability relating to the exposure of confidential information i ... | check |
| CVE-2026-15713 | A vulnerability was found in libsoup's HTTP/2 protocol implementation. ... | While the above issue references this CVE, it doesn't match the CVE description at all, check with CNA (Red Hat) |
| CVE-2026-15779 | A flaw was found in samba's pam_winbind. When mkhomedir is enabled, pa ... | check if Red Hat specific |
| CVE-2026-16740 | Missing authentication for critical function vulnerability in TR7 Cybe ... | check |
| CVE-2026-16741 | Improper neutralization of special elements used in an OS command ('OS ... | check |
| CVE-2026-18358 | A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterpr ... | does not affect an upstream version, but need to check if still only Red Hat specific, check details RH bug |
| CVE-2026-19201 | An uncontrolled recursion vulnerability in the Windows SIPA event log ... | check, GHSA not yet public, maybe Windows specific |
| CVE-2026-20337 | A vulnerability in the zip archive parser of ClamAV could allow an una ... | check |
| CVE-2026-20338 | A vulnerability in the zip archive parser of ClamAV could allow an una ... | check |
| CVE-2026-22739 | Vulnerability in Spring Cloud when substituting the profile parameter ... | check |
| CVE-2026-24182 | NVIDIA Display Driver for Windows and Linux contains a vulnerability w ... | check |
| CVE-2026-24187 | NVIDIA Display Driver for Linux contains a vulnerability where an atta ... | check |
| CVE-2026-24190 | NVIDIA Display Driver for Windows and Linux contains a vulnerability i ... | check |
| CVE-2026-24192 | NVIDIA Display Driver for Linux contains a vulnerability where an atta ... | check |
| CVE-2026-24193 | NVIDIA Display Driver for Windows and Linux contains a vulnerability w ... | check |
| CVE-2026-24194 | NVIDIA Display Driver for Linux contains a vulnerability in a kernel m ... | check |
| CVE-2026-24195 | NVIDIA Display Driver for Linux contains a vulnerability in UVM, where ... | check |
| CVE-2026-24196 | NVIDIA Display Driver for Linux contains a vulnerability where a user ... | check |
| CVE-2026-24197 | NVIDIA Display Driver for Linux contains a vulnerability in the Multi- ... | check |
| CVE-2026-24198 | NVIDIA GPU Display Driver for Linux contains a vulnerability where an ... | check |
| CVE-2026-24199 | NVIDIA Display Driver for Linux contains a vulnerability in a kernel m ... | check |
| CVE-2026-27970 | Angular is a development platform for building mobile and desktop web ... | check status for older versions |
| CVE-2026-28343 | CKEditor 5 is a modern JavaScript rich-text editor with an MVC archite ... | check |
| CVE-2026-29022 | dr_libs dr_wav.h version 0.14.4 and earlier (fixed in commit 8a7258c) ... | qtads, dosbox-x, roc-toolkit, octave-ltfat, faudio bundle a copy, check security impact |
| CVE-2026-29036 | cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved na ... | check, report upstream status |
| CVE-2026-30478 | A Dynamic-link Library Injection vulnerability in GatewayGeo MapServer ... | check |
| CVE-2026-30479 | A Dynamic-link Library Injection vulnerability in OSGeo Project MapSer ... | check |
| CVE-2026-31053 | A double free vulnerability exists in librz/bin/format/le/le.c in the ... | check |
| CVE-2026-32313 | xmlseclibs is a library written in PHP for working with XML Encryption ... | check |
| CVE-2026-32600 | xml-security is a library that implements XML signatures and encryptio ... | check |
| CVE-2026-32635 | Angular is a development platform for building mobile and desktop web ... | check status for older versions |
| CVE-2026-34240 | JOSE is a Javascript Object Signing and Encryption (JOSE) library. Pri ... | check |
| CVE-2026-36499 | A missing upper-bound check in the udpif_set_threads() function of Ope ... | check, unclear status/validity |
| CVE-2026-39178 | A SQL injection vulnerability in SOGo before 5.12.7 allows authenticat ... | CVE-2026-39178 and CVE-2026-39179 are duplicates of CVE-2026-46445 and CVE-2026-46446, CNA contacted |
| CVE-2026-39179 | A SQL injection vulnerability in SOGo before 5.12.7 allows authenticat ... | CVE-2026-39178 and CVE-2026-39179 are duplicates of CVE-2026-46445 and CVE-2026-46446, CNA contacted |
| CVE-2026-39860 | Nix is a package manager for Linux and other Unix systems. A bug in th ... | check, potentially affecting guix if same issue in backporting fix for CVE-2024-2729 |
| CVE-2026-40033 | FreeRDP before 3.26.0 contains a heap-buffer-overflow vulnerability in ... | unclear fixing commit references, incorrect reference in CVE entry? |
| CVE-2026-41889 | pgx is a PostgreSQL driver and toolkit for Go. Prior to version 5.9.2, ... | check the other golang-github-jackc-pgx* sources |
| CVE-2026-42093 | Redash is a package for data visualization and sharing. From versions ... | check |
| CVE-2026-42199 | Grid is a data structure grid for rust. From version 0.17.0 to before ... | check |
| CVE-2026-42308 | Pillow is a Python imaging library. Prior to version 12.2.0, if a font ... | research fixing commit(s), maybe https://github.com/python-pillow/Pillow/pull/9518/changes |
| CVE-2026-42503 | gopls by default communicates via pipe. However, -port and -listen fla ... | check impact on golang-golang-x-tools |
| CVE-2026-43627 | llama.cpp builds b1283 through b9058 contain an integer overflow vulne ... | check |
| CVE-2026-43628 | llama.cpp builds b3978 through b9058 contain an integer underflow and ... | check |
| CVE-2026-43629 | llama.cpp builds b4882 through b9058 contain a heap buffer overflow vu ... | check |
| CVE-2026-43631 | llama.cpp builds b7492 through the latest b9060 contains a use-after-f ... | check |
| CVE-2026-43632 | llama.cpp builds b7492 through the latest b9060 contains a use-after-f ... | check |
| CVE-2026-43829 | Full details and mitigation steps are currently restricted and will be ... | check |
| CVE-2026-43830 | Full details and mitigation steps are currently restricted and will be ... | check |
| CVE-2026-43831 | Full details and mitigation steps are currently restricted and will be ... | check |
| CVE-2026-43832 | Full details and mitigation steps are currently restricted and will be ... | check |
| CVE-2026-43833 | Full details and mitigation steps are currently restricted and will be ... | check |
| CVE-2026-44933 | `PluginScript` attempts to `chroot` the plugin to the `repoManagerRoot ... | check |
| CVE-2026-46727 | An issue was discovered in Ruby 4 before 4.0.5. A race condition leadi ... | check |
| CVE-2026-47875 | Applications that deserialize execution contexts with Jackson2Executio ... | check |
| CVE-2026-47878 | DefaultExecutionContextSerializer, used by default in Spring Batch's J ... | check |
| CVE-2026-47881 | Spring Batch's FlatFileItemReader supports files where a single logica ... | check |
| CVE-2026-49206 | rapidcsv is a C++ CSV parser library. Prior to 8.99, RemoveColumn, Ins ... | check |
| CVE-2026-53999 | Radius is a cloud-native, portable application platform that makes app ... | check |
| CVE-2026-54525 | Markdown Preview Enhanced is a Markdown preview extension for Visual S ... | check |
| CVE-2026-54554 | FOG is a free open-source cloning/imaging/rescue suite/inventory manag ... | check |
| CVE-2026-55167 | LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. ... | check |
| CVE-2026-55223 | c3p0 is a JDBC Connection pooling library. In versions prior to 0.14.0 ... | check if that is an issue with the packaged version |
| CVE-2026-55572 | e107 is a content management system (CMS). Prior to 2.3.7, the bundled ... | check |
| CVE-2026-55573 | e107 is a content management system (CMS). Prior to 2.3.7, install.php ... | check |
| CVE-2026-55663 | mediasoup is a WebRTC video conferencing system. From version 3.20.0 u ... | check |
| CVE-2026-55786 | Flyto2 Core is an execution kernel for automation and AI-agent workflo ... | check |
| CVE-2026-55787 | Flyto2 Core is an execution kernel for automation and AI-agent workflo ... | check |
| CVE-2026-56816 | Netty is a network application framework for development of protocol s ... | check, potentially only in 4.2.y series |
| CVE-2026-56818 | Netty is an asynchronous, event-driven network application framework. ... | check missing upstream GHSA |
| CVE-2026-57862 | Kanboard 1.2.52 and prior contains a server-side request forgery vulne ... | check upstream report |
| CVE-2026-59951 | The MCP Python SDK, called mcp on PyPI, is a Python implementation of ... | check |
| CVE-2026-61711 | BuildKit is a toolkit for converting source code to build artifacts in ... | check security impact on docker.io |
| CVE-2026-61712 | BuildKit is a toolkit for converting source code to build artifacts in ... | check potential security impact on docker.io |
| CVE-2026-62846 | SQUID-2026:9 | check SQUID-2026:9 information not yet public |
| CVE-2026-62858 | YOURLS is a self-hosted, customizable URL shortener written in PHP. Pr ... | check |
| CVE-2026-64611 | A flaw was found in libcupsfilters. The cfIEEE1284NormalizeMakeModel() ... | check use in embedded cups, cups-filters |
| CVE-2026-67414 | RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.24, ... | check |
| CVE-2026-67416 | RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.24, ... | check |
| CVE-2026-67418 | RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.1 ... | check |
| CVE-2026-68495 | The CBOR parser in FasterXML jackson-dataformats-binary never invokes ... | check, night not affect our ancient version? |
| CVE-2026-68496 | The Smile parser in FasterXML jackson-dataformats-binary never invokes ... | check, might not affect our ancient version |
| CVE-2026-71054 | Vulnerability in Oracle Java SE (component: 2D). Supported versions t ... | check |
| CVE-2026-71261 | dr_libs dr_wav.h (all versions through current master) contains an int ... | check if embedded copy has security impact in roc-toolkit, qtads, qt6-multimedia, octave-ltfat, raylib, dosbox-x, mlpack and faudio |
| CVE-2026-71266 | tinyobjloader-c's tinyobj_parse_and_index_mtl_file (tinyobj_loader_c.h ... | check, embedded in src:goxel and src:raylib |
| CVE-2026-71437 | Mermaid is a JavaScript tool that uses Markdown-inspired text to creat ... | check introducing commit for further assessment |
| CVE-2026-71439 | Mermaid is a JavaScript tool that uses Markdown-inspired text to creat ... | check introducing commit, might then be only 11.6.0 and above. |
| CVE-2026-71891 | In Bouncy Castle for Java before 1.86, BLS12_381BasicScheme.keyValidat ... | check, maybe only introduced in 1.85? |
| CVE-2026-75593 | BuildKit is a toolkit for converting source code to build artifacts in ... | check security impact on docker.io |
| CVE-2026-76083 | Redash is a package for data visualization and sharing. From 10.0.0 un ... | check |
| CVE-2026-77371 | Redash is a package for data visualization and sharing. From 26.0.0 un ... | check |
| CVE-2026-77524 | KEDA is a Kubernetes-based Event Driven Autoscaling component. In vers ... | check |
| CVE-2026-77564 | Talos Linux is a Linux distribution built for Kubernetes deployments. ... | check |
| CVE-2026-77572 | VeraCrypt provides disk encryption with strong security based on TrueC ... | check |
| CVE-2026-78178 | A vulnerability was determined in jQWidgets up to 24.0.1. This affects ... | check |
| CVE-2026-79680 | Authentication bypass vulnerability in the password authentication mec ... | check |
| CVE-2026-79957 | ServiceNext contains an insecure direct object reference (IDOR) in the ... | check |
| CVE-2026-82026 | Radar before 1.12.2 contains a missing authorization vulnerability in ... | check |
| CVE-2026-82402 | Gogs is an open source self-hosted Git service. Prior to 0.15.0+dev, a ... | check |
| CVE-2026-83550 | A flaw was found in postgres-exporter. Due to the blank import of `net ... | check, Red Hat bugzilla entry is unhelpful at time of check in 2026-10-06 (only contains a hash reference) |
| CVE-2026-84233 | A flaw was found in rpm. A local attacker could supply a specially cra ... | check upstream details |
| CVE-2026-85298 | An Incorrect Authorization vulnerability in the AuthConfig validation ... | check |
| CVE-2026-85714 | Stirling-PDF is a locally hosted web application that facilitates vari ... | check |
| CVE-2026-86002 | Dokku is a docker-powered platform as a service. In Dokku versions bef ... | check |
| CVE-2026-86344 | A flaw was found in 389-ds-base. An unauthenticated remote attacker ca ... | check, not details provided on 2026-10-02 in Red Hat bugzilla |
| CVE-2026-86476 | A flaw was found in gst-plugins-base. A heap buffer overflow can be tr ... | check |
| CVE-2026-86846 | A flaw was found in DPDK lib/vhost vhost-crypto. A guest can supply an ... | check |
| CVE-2026-87020 | An integer overflow in a specified pitch and buffer-size computation l ... | check, might be a dupe of the existing issues addressed in 1.13, needs clarification |
| CVE-2026-88350 | An integer overflow vulnerability exists in MPack 1.1.1 in mpack_node_ ... | check, embedded in balboa, bpfilter, pocketpy |
| CVE-2026-88351 | An integer overflow vulnerability exists in the MPack Node API in MPac ... | check, embedded in balboa, bpfilter, pocketpy |
| CVE-2026-88829 | A flaw was found in BusyBox httpd's reverse proxy feature. When the pr ... | check |
| CVE-2026-88842 | A flaw was found in BusyBox dpkg. The write_status_file() function doe ... | check |
| CVE-2026-89091 | A flaw was found in ansible-core. When installing a collection with `a ... | check, details from Red Hat bugzilla not accessible on 2026-10-09 |
| CVE-2026-90954 | A flaw was found in BusyBox's dpkg-deb archive extraction. The ar arch ... | check |
| CVE-2026-92150 | F\xb4 (F Prime) is a framework that enables development and deployment ... | check |
| CVE-2026-92151 | F\xb4 (F Prime) is a framework that enables development and deployment ... | check |
| CVE-2026-92152 | F\xb4 (F Prime) is a framework that enables development and deployment ... | check |
| CVE-2026-92153 | F\xb4 (F Prime) is a framework that enables development and deployment ... | check |
| CVE-2026-92154 | F\xb4 (F Prime) is a framework that enables development and deployment ... | check |
| CVE-2026-92155 | F\xb4 (F Prime) is a framework that enables development and deployment ... | check |
| CVE-2026-92156 | F\xb4 (F Prime) is a framework that enables development and deployment ... | check |
| CVE-2026-92157 | F\xb4 (F Prime) is a framework that enables development and deployment ... | check |
| CVE-2026-92158 | F\xb4 (F Prime) is a framework that enables development and deployment ... | check |
| CVE-2026-92159 | F\xb4 (F Prime) is a framework that enables development and deployment ... | check |
| CVE-2026-92160 | F\xb4 (F Prime) is a framework that enables development and deployment ... | check |
| CVE-2026-92284 | Caddy is an extensible server platform that uses TLS by default. In ve ... | check references, refers to GHSA-j8px-rmrx-76h9 which is for CVE-2026-77281 |
| CVE-2026-92382 | An out-of-bounds write flaw was found in usbredir. Starting an isochro ... | check details once Red Hat opens up bugzilla entry |
| CVE-2026-92700 | Caddy is an extensible server platform that uses TLS by default. In ve ... | check references, refers to GHSA-j8px-rmrx-76h9 which is for CVE-2026-77281 |
| CVE-2026-92877 | The JAXB factory methods historically relied solely on `FEATURE_SECURE ... | check |
| CVE-2026-92925 | A flaw was found in Redis community. The cluster bus packet parser, re ... | check if redict affected |
| CVE-2026-93315 | When proxy networking with CA injection is enabled, a build can modify ... | check security impact on docker.io |
| CVE-2026-93316 | If BuildKit daemon is started with --cdi-disabled it can lead to daemo ... | check security impact on docker.io |
| CVE-2026-93317 | An unauthenticated attacker controlling a registry or OCI-layout blob ... | check security impact on docker.io |
| CVE-2026-93318 | A malicious image can advertise DiffIDs from another image while conta ... | check security impact on docker.io |
| CVE-2026-93319 | A malicious external BuildKit frontend can send requests using the int ... | check security impact on docker.io |
| CVE-2026-93320 | BuildKit may be tricked into performing file actions with special file ... | check security impact on docker.io |
| CVE-2026-93321 | A malicious frontend can submit an LLB definition that causes buildkit ... | check security impact on docker.io |
| CVE-2026-93322 | A malicious frontend can submit an LLB definition that causes buildkit ... | check security impact on docker.io |
| CVE-2026-93323 | The Dockerfile frontend loaded the Dockerfile and .dockerignore files ... | check security impact on docker.io |
| CVE-2026-93326 | A build step for a Git source, crafted in a specific way, can bypass s ... | check security impact on docker.io |
| CVE-2026-93879 | | check, missing further details in Red Hat bugzilla entry at 2026-10-13 |
| CVE-2026-94200 | Improper Validation of Consistency within Input vulnerability in Erlan ... | check |
| CVE-2026-95208 | An issue in the ConfirmNameConstraints() function (wolfcrypt/src/asn.c ... | check, valid assignment? https://gist.github.com/lkloliver/14edf8bbfbf5769949b85c7f5cc2eba2 |
| CVE-2026-96596 | Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability i ... | check |
| CVE-2026-100169 | Improper Authentication in the social account linking path of the Prow ... | check |
| CVE-2026-100229 | A flaw was found in GStreamer's H.266 codec parser library (libgstcode ... | check |
| CVE-2026-100231 | A flaw was found in the GStreamer multimedia framework's ASF muxer plu ... | check |
| CVE-2026-100394 | Nezha Monitoring is a self-hostable, lightweight, servers and websites ... | check |
| CVE-2026-100404 | Zulip is an open-source team collaboration tool. In Zulip Server versi ... | check |
| CVE-2026-100406 | dbt enables data analysts and engineers to transform their data using ... | check |
| CVE-2026-100413 | SeaweedFS is a distributed storage system for files and blobs. From 4. ... | check |
| CVE-2026-100888 | A weakness has been identified in Trusted Domain Project OpenDKIM up t ... | check upstream details |
| CVE-2026-100889 | A vulnerability was detected in Trusted Domain Project OpenDKIM up to ... | check upstream details |
| CVE-2026-100890 | A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. ... | check upstream details |
| CVE-2026-100891 | A vulnerability has been found in Trusted Domain Project OpenDMARC up ... | check upstream details |
| CVE-2026-100895 | A security flaw has been discovered in Trusted Domain Project OpenARC ... | check |
| CVE-2026-101020 | An incorrect permission assignment for critical resource issue exists ... | check |
| CVE-2026-101895 | Angular is a development platform for building mobile and desktop web ... | check |
| CVE-2026-101896 | Angular is a development platform for building mobile and desktop web ... | check |
| CVE-2026-101897 | Angular is a development platform for building mobile and desktop web ... | check |
| CVE-2026-102354 | BentoPDF is a privacy-focused PDF toolkit that runs in the browser. In ... | check |
| CVE-2026-102539 | Super Productivity is an advanced todo list app with integrated timebo ... | check |
| CVE-2026-102596 | Nango is an open-source platform for connecting agents and products to ... | check |
| CVE-2026-102603 | Gotify server is a simple server for sending and receiving messages in ... | check |
| CVE-2026-102672 | Electron is a framework for writing cross-platform desktop application ... | check |
| CVE-2026-102682 | Pipecat is an open-source Python framework for building real-time voic ... | check |
| CVE-2026-102695 | OmniFaces is a utility library for Faces. In OmniFaces versions before ... | check |
| CVE-2026-102748 | Dgraph is an open source distributed GraphQL database. Prior to 25.4.0 ... | check |
| CVE-2026-102831 | JupyterLab is an extensible environment for interactive and reproducib ... | check, might be introduced later |
| CVE-2026-102893 | Zulip is an open-source team collaboration tool. In Zulip Server versi ... | check |
| CVE-2026-102899 | Sentry is an application monitoring and error tracking platform. From ... | check |
| CVE-2026-102944 | cpp-httplib is a C++ header-only HTTP/HTTPS library. Prior to 0.51.0, ... | check |
| CVE-2026-103030 | Dio is a powerful HTTP client for Dart and Flutter. From 1.0.0 until 2 ... | check |
| CVE-2026-103060 | Improper Limitation of a Pathname to a Restricted Directory ('Path Tra ... | check |
| CVE-2026-103316 | The macOS version of the DigiD app is not signed with Hardened Runtime ... | check |
| CVE-2026-103417 | Firefox for iOS could autofill saved credentials into a new page if cr ... | check |
| CVE-2026-103418 | Firefox for iOS directly interpolated the page\u2019s HTML language at ... | check |
| CVE-2026-103502 | Improper Certificate Validation vulnerability in hexpm hex_core allows ... | check |
| CVE-2026-103503 | Improper Certificate Validation vulnerability in hexpm hex allows an a ... | check |
| CVE-2026-103671 | External control of assumed-Immutable web parameter issue exists in EC ... | check |
| CVE-2026-103902 | Improper verification of cryptographic signature vulnerability in Digi ... | check |
| CVE-2026-103904 | The public consent endpoint of JTL-Shop accepts arbitrary consent name ... | check |
| CVE-2026-103905 | The authentication middleware of the JTL-Shop administration backend p ... | check |
| CVE-2026-103928 | Metabase is an open source business intelligence and analytics platfor ... | check |
| CVE-2026-103929 | mise manages dev tools like node, python, cmake, and terraform. Prior ... | check |
| CVE-2026-103930 | cpp-httplib is a C++ header-only HTTP/HTTPS library. From 0.29.0 until ... | check |
| CVE-2026-103937 | Misskey is an open source, federated social media platform. From 13.0. ... | check |
| CVE-2026-103974 | lichess.org is the forever free, adless and open source chess server. ... | check |
| CVE-2026-103975 | Appium is a cross-platform automation framework for all kinds of apps, ... | check |
| CVE-2026-104086 | 7-Zip before 26.03 contains an uninitialized memory disclosure vulnera ... | check |
| CVE-2026-104103 | Ludwig is a low-code framework for building custom LLMs, neural networ ... | check |
| CVE-2026-104252 | Vitess is a database clustering system for horizontal scaling of MySQL ... | check |
| CVE-2026-104584 | reNgine up to v2.2.0 and current master branch (commit de4199222cca561 ... | check |
| CVE-2026-104585 | Mobile Security Framework (MobSF) v4.5.2 is vulnerable to Command Inje ... | check |
| CVE-2026-104587 | blob42 gosuki through commit 6e2bf34 contains a Stored Cross-Site Scri ... | check |
| CVE-2026-104875 | Ente provides end-to-end encrypted cloud services and security tools. ... | check |
| CVE-2026-105106 | Koha is vulnerable to OS command injection in the Task Scheduler delet ... | check |
| CVE-2026-105107 | Koha is vulnerable to SQL injection in the Most-circulated items repor ... | check |
| CVE-2026-105236 | Improper Certificate Validation vulnerability in the ssl application i ... | check |
| CVE-2026-105280 | Improper Validation of Integrity Check Value vulnerability in hexpm he ... | check |
| CVE-2026-105445 | An Incorrect Privilege Assignment vulnerability in Docker Hub's accoun ... | check |
| CVE-2026-105659 | Uncontrolled Resource Consumption vulnerability in mtrudel bandit allo ... | check |
| CVE-2026-105668 | Protection Mechanism Failure vulnerability in hexpm hex allows the own ... | check |
| CVE-2026-106108 | Quasar Framework is a framework for building high-performance Vue.js u ... | check |
| CVE-2026-107171 | An Hardcoded Cryptographic Key vulnerability existed in Trellix Agent ... | check |
| CVE-2026-107381 | svg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, Resolver::pr ... | check |
| CVE-2026-107460 | Server-Side Request Forgery (SSRF) protection in the UrlImageConverter ... | check |
| CVE-2026-108065 | SQL Injection (CWE-89) in the SOAP GetUser method of the /preapproval. ... | check |
| CVE-2026-108070 | A vulnerability involving improper access control in the TSplus Remote ... | check |
| CVE-2026-108071 | Incorrect authentication vulnerability in the TSplus Remote Access mul ... | check |
| CVE-2026-108072 | Vulnerability due to incorrect permissions in TSplus Remote Access sha ... | check |
| CVE-2026-108093 | A flaw was found in GIMP. The XCF loader processes image-simulation-in ... | research upstream information, Red Hat bugzilla is not open at 2026-10-09 |
| CVE-2026-108390 | Hestia Control Panel is a lightweight and powerful control panel for t ... | check |
| CVE-2026-108395 | The Model Context Protocol Java SDK is the official Java SDK for Model ... | check |
| CVE-2026-108577 | A vulnerability was determined in Konstanty Bialkowski libmodplug up t ... | check details for upstream |
| CVE-2026-108752 | JupyterHub through 6.0.1 contains an identifier collision vulnerabilit ... | check, upstream detail |
| CVE-2026-109144 | A vulnerability was identified in wbond certvalidator up to 0.11.1. Th ... | check |
| CVE-2026-109149 | A weakness has been identified in beautifier js-beautify up to 1.15.1/ ... | check |
| CVE-2026-109344 | DOMPurify from 3.4.13 before 3.4.16 contains a cross-site scripting vu ... | possibly not affecting older version, as upstream advisory claims from 3.4.13 on |
| CVE-2026-109438 | 3proxy from 0.9.7 through 1.0.1, fixed in commit 206c923, contains an ... | check |
| CVE-2026-109439 | Lantronix XPress-DR and XPress-DR-I (CoBos-family) firmware through 8. ... | check |
| CVE-2026-109527 | The Model Context Protocol Python SDK is the official Python SDK for M ... | check |
| CVE-2026-109968 | A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-s ... | check |
| CVE-2026-109969 | A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-s ... | check |
| CVE-2026-109970 | A flaw was found in the clevis PKCS#11 pin. The clevis-luks-pkcs11-ask ... | check |
| CVE-2026-109971 | A flaw was found in the clevis PKCS#11 pin. The clevis-decrypt-pkcs11 ... | check |
| CVE-2026-110217 | Lenve vhr through commit 03abbd3 contains an information disclosure vu ... | check |
| CVE-2026-110257 | OW2 ASM 5.0 before 9.11 contains an excessive memory allocation vulner ... | check |
| CVE-2026-110258 | OW2 ASM 3.0 before 9.11 contains an excessive memory allocation vulner ... | check |
| CVE-2026-110259 | OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerabili ... | check |
| CVE-2026-110260 | OW2 ASM 3.0 before 9.11 contains a quadratic memory allocation vulnera ... | check |
| CVE-2026-110261 | OW2 ASM 3.0 before 9.11 contains a denial of service vulnerability tha ... | check |
| CVE-2026-110262 | OW2 ASM 3.1 before 9.11 contains an excessive memory allocation vulner ... | check |
| CVE-2026-110263 | OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerabili ... | check |
| CVE-2026-110270 | OW2 ASM 3.0 before 9.11 contains an uncontrolled memory allocation vul ... | check |
| CVE-2026-110451 | Nix before 2.35.3 and Lix before 2.95.4 on macOS allow a Seatbelt sand ... | check |
| CVE-2026-110453 | Nix before 2.35.3, when unsandboxed on macOS or FreeBSD, incorrectly a ... | check |
| CVE-2026-110591 | OW2 ASM 1.4.3 before 9.11 contains an excessive resource consumption v ... | check |
| CVE-2026-110592 | BottleCRM 0.30 through 1.14.5 contains an HTML injection vulnerability ... | check |
| CVE-2026-110593 | BottleCRM through 1.14.5 contains a server-side template injection vul ... | check |
| CVE-2026-110594 | BottleCRM 0.43 through 1.14.5 contains a regular expression denial of ... | check |
| CVE-2026-110595 | BottleCRM 0.45 through 1.14.5 contains an uncontrolled memory allocati ... | check |
| CVE-2026-110596 | quirc through 1.2 contains an excessive-iteration vulnerability in fin ... | check |
| CVE-2026-110597 | Tinyexr through 3.2.0 contains a heap out-of-bounds read vulnerability ... | check |
| CVE-2026-110598 | Libyal libpff through 20260926 contains an integer underflow in libpff ... | check |
| CVE-2026-110599 | L-SMASH through 2.14.5 contains a double free vulnerability in hevc_se ... | check |
| CVE-2026-110600 | xlsxio through 0.2.37 contains a NULL pointer dereference vulnerabilit ... | check |
| CVE-2026-110601 | libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 contains a heap out- ... | check |
| CVE-2026-110602 | libmspack through 0.11alpha contains an uninitialized pointer free vul ... | check |
| CVE-2026-110603 | LASzip through 3.5.0 contains an invalid free vulnerability in laszip_ ... | check |
| CVE-2026-110604 | Mini-XML 4.0.0 through 4.0.6 contains an off-by-one stack out-of-bound ... | check |
| CVE-2026-110605 | libschrift through 0.10.2 contains a divide by zero vulnerability that ... | check |
| CVE-2026-110606 | LibreCAD libdxfrw through LC2.2.0 (LibreCAD through 2.2.1.5) contains ... | check |
| CVE-2026-110607 | BizSpring Shop through commit cf22d39daaf1 contains a payment verifica ... | check |
| CVE-2026-110608 | BizSpring Shop through commit cf22d39daaf1 contains an insecure direct ... | check |
| CVE-2026-110609 | Dromara Skyeye through commit 65d3ddcede70 contains an sql injection v ... | check |
| CVE-2026-110610 | ruoyi-vue-pro through 2026.09 contains a server-side request forgery v ... | check |
| CVE-2026-110611 | REBUILD through 4.5.0 contains an authorization bypass vulnerability i ... | check |
| CVE-2026-110612 | vlife through 2.0.1 contains an authentication bypass vulnerability th ... | check |
| CVE-2026-110613 | youlai-mall through commit 9f62de8 contains a missing authorization vu ... | check |
| CVE-2026-110614 | Yiuman citrus through 0.15.0 contains an ORDER BY sql injection vulner ... | check |
| CVE-2026-110615 | jshERP through 3.6 contains a missing authorization vulnerability in t ... | check |
| CVE-2026-110616 | NullHub through 2026.5.29 contains a missing authentication vulnerabil ... | check |
| CVE-2026-110617 | we-mp-rss through 1.5.3 contains a missing authorization vulnerability ... | check |
| CVE-2026-110618 | SmsForwarder through 3.5.0 contains a missing authentication vulnerabi ... | check |
| CVE-2026-110619 | frp 0.41.0 through 0.71.1 contains a missing authentication vulnerabil ... | check |
| CVE-2026-110620 | Formbricks before 4.9.0 contains an authorization bypass vulnerability ... | check |
| CVE-2026-110621 | Swetrix Cloud before 5.1.0 contains a missing authorization vulnerabil ... | check |
| CVE-2026-110622 | Papermerge Core through 3.5.3 contains a missing authorization vulnera ... | check |
| CVE-2026-110623 | Papermerge Core through 3.5.3 contains a missing authorization vulnera ... | check |
| CVE-2026-110624 | Papermerge Core through 3.5.3 contains a missing authorization vulnera ... | check |
| CVE-2026-110625 | ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scrip ... | check |
| CVE-2026-110626 | ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scrip ... | check |
| CVE-2026-110627 | ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scrip ... | check |
| CVE-2026-110628 | Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side reques ... | check |
| CVE-2026-110629 | VentureDrake Laravel CRM before 2.4.0 contains a missing authorization ... | check |
| CVE-2026-110630 | VentureDrake Laravel CRM before 2.4.0 contains an incorrect authorizat ... | check |
| CVE-2026-110631 | Komodo through 2.3.3 contains an authentication bypass vulnerability i ... | check |
| CVE-2026-110632 | Report One MyReport Updater through 2.1.1 exposes an unauthenticated g ... | check |
| CVE-2026-110633 | MyReport Updater through 2.1.1 contains a local privilege escalation v ... | check |
| CVE-2026-110634 | git-diff before 2.0.7 contains an OS command injection vulnerability t ... | check |
| CVE-2026-110635 | webp-converter before 3.0.0 contains an OS command injection vulnerabi ... | check |
| CVE-2026-110636 | pypdftk through 0.5 contains an OS command injection vulnerability in ... | check |
| CVE-2026-110637 | buildebooks before 0.2.2 contains an OS command injection vulnerabilit ... | check |
| CVE-2026-110638 | doc-recog through 1.1.6 contains an OS command injection vulnerability ... | check |
| CVE-2026-110639 | @mborne/extract before 0.2.1 contains an OS command injection vulnerab ... | check |
| CVE-2026-110640 | Whisper-node through 1.1.1 contains an OS command injection vulnerabil ... | check |
| CVE-2026-110641 | @runnerty/executor-decompress through 3.1.1 contains an OS command inj ... | check |
| CVE-2026-110642 | xhtml2pdf before 0.2.19 contains an OS command injection vulnerability ... | check |
| CVE-2026-110643 | transcribe2texts through 1.0.6 contains an OS command injection vulner ... | check |
| CVE-2026-110644 | nodejs-whisper through 0.3.1 contains an OS command injection vulnerab ... | check |
| CVE-2026-110645 | Video-stitch before 2.0.0-beta.1 contains an OS command injection vuln ... | check |
| CVE-2026-110646 | Beganovich snappdf from 1.1.0 before 6.1.0 contains an OS command inje ... | check |
| CVE-2026-110647 | Turnpress through 0.4.2 contains an OS command injection vulnerability ... | check |
| CVE-2026-110648 | @offactory/compress-fonts before 1.1.1 contains an OS command injectio ... | check |
| CVE-2026-110649 | Stills before 25.24.2 contains an OS command injection vulnerability t ... | check |
| CVE-2026-110650 | The thumbnail Python package through 1.5 contains an OS command inject ... | check |
| CVE-2026-110652 | ONLYOFFICE DocumentServer before 10.0.0 contains an unauthenticated se ... | check |
| CVE-2026-110654 | libzvbi through 0.2.45 contains an out-of-bounds write vulnerability i ... | check |
| CVE-2026-110655 | miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vu ... | check |
| CVE-2026-110656 | miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vu ... | check |
| CVE-2026-110657 | Khronos NNEF-Tools nnef through 1.0.10 and nnef-tools through 1.0.11 c ... | check |
| CVE-2026-110658 | Sofia-SIP through 1.13.18 contains a heap out-of-bounds read vulnerabi ... | check |
| CVE-2026-110659 | ELFIO through 3.12 contains a NULL pointer dereference vulnerability i ... | check |
| CVE-2026-110660 | vgmstream through r2117 contains a stack out-of-bounds read vulnerabil ... | check |
| CVE-2026-110661 | CGNS through 4.5.2 contains a stack out-of-bounds read vulnerability i ... | check |
| CVE-2026-110666 | A vulnerability was identified in cemtan sar2html 4.0.0. Affected is t ... | check |
| CVE-2026-110667 | A security flaw has been discovered in cemtan sar2html 4.0.0. Affected ... | check |
| CVE-2026-110690 | Cloud Commander (cloudcmd) versions 19.20.2 through 19.21.1 contains a ... | check |
| CVE-2026-110712 | libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability i ... | check |
| CVE-2026-110713 | libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability i ... | check |
| CVE-2026-110714 | libsmb2 through 6.2 contains an integer underflow vulnerability in dec ... | check |
| CVE-2026-110715 | MuJS 1.3.6 before 1.3.9 contains a heap out-of-bounds read and write v ... | check |
| CVE-2026-110716 | unshield through 1.6.2 contains a heap out-of-bounds read vulnerabilit ... | check |
| CVE-2026-110717 | Janus WebRTC Server through 1.4.3 contains a path traversal vulnerabil ... | check |
| CVE-2026-110718 | TurboDocx html-to-docx through 1.23.1 contains a server-side request f ... | check |
| CVE-2026-110719 | Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side reques ... | check |
| CVE-2026-110734 | Godot Engine through 4.7.2 has a heap out-of-bounds write in the Radia ... | check |
| CVE-2026-110735 | Godot Engine through 4.7.2 has a heap out-of-bounds write exists in th ... | check |
| CVE-2026-110736 | Godot Engine through 4.7.2 has an out-of-bounds read in the optimized ... | check |
| CVE-2026-110761 | ILIAS before 9.24, 10.12, and 11.5 contains a PHP object injection vul ... | check |
| CVE-2026-110762 | bbPress before 2.6.19 contains an information disclosure vulnerability ... | check |
| CVE-2026-110763 | lamp-boot 4.16.0-java17 through 4.21.2-java17 contains an insecure dir ... | check |
| CVE-2026-110764 | AstronRPA through 1.1.6 contains an insecure direct object reference v ... | check |
| CVE-2026-110765 | FlexPrice through 2.1.38 contains an authentication bypass vulnerabili ... | check |
| CVE-2026-110766 | Colanode server through 0.4.7 contains a path traversal vulnerability ... | check |
| CVE-2026-110767 | Gitingest through 0.3.1 contains a symlink following vulnerability in ... | check |
| CVE-2026-110768 | holaOS through 2026.822.1 contains an authorization bypass vulnerabili ... | check |
| CVE-2026-110769 | holaOS through 2026.822.1 contains a missing authorization vulnerabili ... | check |
| CVE-2026-110770 | Databasus 3.7.0 through 3.61.0 contains an authentication bypass vulne ... | check |
| CVE-2026-110771 | Shopizer through 3.2.5 contains an authorization bypass vulnerability ... | check |
| CVE-2026-110772 | Sure 0.7.0 through 0.7.6-alpha.6 contains a missing authorization vuln ... | check |
| CVE-2026-110773 | GrowChief through 0.3.0 contains a missing authorization vulnerability ... | check |
| CVE-2026-110774 | Blinko through 1.8.8 contains a broken access control vulnerability in ... | check |
| CVE-2026-110775 | Nexent through 2.7.0 contains a missing authorization vulnerability in ... | check |
| CVE-2026-110777 | A flaw was found in evolution-data-server. Calendar events containing ... | check |
| TEMP-1142597-FFA22A | GHSA-68ff-gq39-pqjm: relay: authentication bypass with the "plain" password hash algorithm | check, GHSA-68ff-gq39-pqjm claims >= 4.3.0 but potentially since v2.9-rc1 |