| CVE-2026-21262 | Microsoft SQL Server Elevation of Privilege Vulnerability | High | 8.8 | Elevation of Privilege | Publicly disclosed |
| CVE-2026-26127 | .NET Denial of Service Vulnerability | High | 7.5 | Denial of Service | Publicly disclosed |
| CVE-2026-24289 | Windows Kernel Elevation of Privilege Vulnerability | High | 7.8 | Elevation of Privilege | |
| CVE-2026-24291 | Windows Accessibility Infrastructure (ATBroker.exe) Elevation of Privilege Vulnerability | High | 7.8 | Elevation of Privilege | |
| CVE-2026-24294 | Windows SMB Server Elevation of Privilege Vulnerability | High | 7.8 | Elevation of Privilege | |
| CVE-2026-25187 | Winlogon Elevation of Privilege Vulnerability | High | 7.8 | Elevation of Privilege | |
| CVE-2026-26132 | Windows Kernel Elevation of Privilege Vulnerability | High | 7.8 | Elevation of Privilege | |
| CVE-2026-23668 | Windows Graphics Component Elevation of Privilege Vulnerability | High | 7 | Elevation of Privilege | |
| CVE-2026-20967 | System Center Operations Manager (SCOM) Elevation of Privilege Vulnerability | High | 8.8 | Elevation of Privilege | |
| CVE-2026-23669 | RPC Runtime Library Remote Code Execution Vulnerability | High | 8.8 | Remote Code Execution | |
| CVE-2026-24283 | Multiple UNC Provider Kernel Driver Elevation of Privilege Vulnerability | High | 8.8 | Elevation of Privilege | |
| CVE-2026-25177 | Active Directory Domain Services Elevation of Privilege Vulnerability | High | 8.8 | Elevation of Privilege | |
| CVE-2026-26106 | Microsoft SharePoint Server Remote Code Execution Vulnerability | High | 8.8 | Remote Code Execution | |
| CVE-2026-26114 | Microsoft SharePoint Server Remote Code Execution Vulnerability | High | 8.8 | Remote Code Execution | |
| CVE-2026-26115 | SQL Server Elevation of Privilege Vulnerability | High | 8.8 | Elevation of Privilege | |
| CVE-2026-26116 | SQL Server Elevation of Privilege Vulnerability | High | 8.8 | Elevation of Privilege | |
| CVE-2026-26118 | Azure MCP Server Tools Elevation of Privilege Vulnerability | High | 8.8 | Elevation of Privilege | |
| CVE-2026-26110 | Microsoft Office Remote Code Execution Vulnerability | High | 8.4 | Remote Code Execution | |
| CVE-2026-26113 | Microsoft Office Remote Code Execution Vulnerability | High | 8.4 | Remote Code Execution | |
| CVE-2026-26105 | Microsoft SharePoint Server Spoofing Vulnerability | High | 8.1 | Spoofing | |
| CVE-2026-25172 | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability | High | 8 | Remote Code Execution | |
| CVE-2026-25173 | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability | High | 8 | Remote Code Execution | |
| CVE-2026-26111 | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability | High | 8 | Remote Code Execution | |
| CVE-2026-23660 | Windows Admin Center in Azure Portal Elevation of Privilege Vulnerability | High | 7.8 | Elevation of Privilege | |
| CVE-2026-23665 | Linux Azure Diagnostic extension (LAD) Elevation of Privilege Vulnerability | High | 7.8 | Elevation of Privilege | |
| CVE-2026-24287 | Windows Kernel Elevation of Privilege Vulnerability | High | 7.8 | Elevation of Privilege | |
| CVE-2026-24290 | Windows Projected File System Elevation of Privilege Vulnerability | High | 7.8 | Elevation of Privilege | |
| CVE-2026-24292 | Windows Connected Devices Platform Service Elevation of Privilege Vulnerability | High | 7.8 | Elevation of Privilege | |
| CVE-2026-24293 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | High | 7.8 | Elevation of Privilege | |
| CVE-2026-25175 | Windows NTFS Elevation of Privilege Vulnerability | High | 7.8 | Elevation of Privilege | |
| CVE-2026-25176 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | High | 7.8 | Elevation of Privilege | |
| CVE-2026-25189 | Windows DWM Core Library Elevation of Privilege Vulnerability | High | 7.8 | Elevation of Privilege | |
| CVE-2026-25190 | Windows GDI Remote Code Execution Vulnerability | High | 7.8 | Remote Code Execution | |
| CVE-2026-26107 | Microsoft Excel Remote Code Execution Vulnerability | High | 7.8 | Remote Code Execution | |
| CVE-2026-26108 | Microsoft Excel Remote Code Execution Vulnerability | High | 7.8 | Remote Code Execution | |
| CVE-2026-26112 | Microsoft Excel Remote Code Execution Vulnerability | High | 7.8 | Remote Code Execution | |
| CVE-2026-26128 | Windows SMB Server Elevation of Privilege Vulnerability | High | 7.8 | Elevation of Privilege | |
| CVE-2026-26131 | .NET Elevation of Privilege Vulnerability | High | 7.8 | Elevation of Privilege | |
| CVE-2026-26134 | Microsoft Office Elevation of Privilege Vulnerability | High | 7.8 | Elevation of Privilege | |
| CVE-2026-23661 | Azure IoT Explorer Information Disclosure Vulnerability | High | 7.5 | Information Disclosure | |
| CVE-2026-23662 | Azure IoT Explorer Information Disclosure Vulnerability | High | 7.5 | Information Disclosure | |
| CVE-2026-23664 | Azure IoT Explorer Information Disclosure Vulnerability | High | 7.5 | Information Disclosure | |
| CVE-2026-25181 | GDI+ Information Disclosure Vulnerability | High | 7.5 | Information Disclosure | |
| CVE-2026-26121 | Azure IOT Explorer Spoofing Vulnerability | High | 7.5 | Spoofing | |
| CVE-2026-26130 | ASP.NET Core Denial of Service Vulnerability | High | 7.5 | Denial of Service | |
| CVE-2026-25167 | Microsoft Brokering File System Elevation of Privilege Vulnerability | High | 7.4 | Elevation of Privilege | |
| CVE-2026-26133 | M365 Copilot Information Disclosure Vulnerability | High | 7.1 | Information Disclosure | |
| CVE-2026-23671 | Windows Bluetooth RFCOM Protocol Driver Elevation of Privilege Vulnerability | High | 7 | Elevation of Privilege | |
| CVE-2026-24285 | Win32k Elevation of Privilege Vulnerability | High | 7 | Elevation of Privilege | |
| CVE-2026-24295 | Windows Device Association Service Elevation of Privilege Vulnerability | High | 7 | Elevation of Privilege | |
| CVE-2026-25170 | Windows Hyper-V Elevation of Privilege Vulnerability | High | 7 | Elevation of Privilege | |
| CVE-2026-25171 | Windows Authentication Elevation of Privilege Vulnerability | High | 7 | Elevation of Privilege | |
| CVE-2026-25178 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | High | 7 | Elevation of Privilege | |
| CVE-2026-25179 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | High | 7 | Elevation of Privilege | |
| CVE-2026-24288 | Windows Mobile Broadband Driver Remote Code Execution Vulnerability | Medium | 6.8 | Remote Code Execution | |
| CVE-2026-23651 | Microsoft ACI Confidential Containers Elevation of Privilege Vulnerability | Medium | 6.7 | Elevation of Privilege | |
| CVE-2026-26124 | Microsoft ACI Confidential Containers Elevation of Privilege Vulnerability | Medium | 6.7 | Elevation of Privilege | |
| CVE-2026-24297 | Windows Kerberos Security Feature Bypass Vulnerability | Medium | 6.5 | Security Feature Bypass | |
| CVE-2026-26122 | Microsoft ACI Confidential Containers Information Disclosure Vulnerability | Medium | 6.5 | Information Disclosure | |
| CVE-2026-25168 | Windows Graphics Component Denial of Service Vulnerability | Medium | 6.2 | Denial of Service | |
| CVE-2026-25169 | Windows Graphics Component Denial of Service Vulnerability | Medium | 6.2 | Denial of Service | |
| CVE-2026-24282 | Push message Routing Service Elevation of Privilege Vulnerability | Medium | 5.5 | Information Disclosure | |
| CVE-2026-25180 | Windows Graphics Component Information Disclosure Vulnerability | Medium | 5.5 | Information Disclosure | |
| CVE-2026-25186 | Windows Accessibility Infrastructure (ATBroker.exe) Information Disclosure Vulnerability | Medium | 5.5 | Information Disclosure | |
| CVE-2026-26123 | Microsoft Authenticator Information Disclosure Vulnerability | Medium | 5.5 | Information Disclosure | |
| CVE-2026-25185 | Windows Shell Link Processing Spoofing Vulnerability | Medium | 5.3 | Spoofing | |
| CVE-2026-26030 | GitHub: CVE-2026-26030 Microsoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable | Critical | 9.9 | Remote Code Execution | |
| CVE-2026-21536 | Microsoft Devices Pricing Program Remote Code Execution Vulnerability | Critical | 9.8 | Remote Code Execution | |
| CVE-2026-23654 | GitHub: Zero Shot SCFoundation Remote Code Execution Vulnerability | High | 8.8 | Remote Code Execution | |
| CVE-2026-25188 | Windows Telephony Service Elevation of Privilege Vulnerability | High | 8.8 | Elevation of Privilege | |
| CVE-2026-26109 | Microsoft Excel Remote Code Execution Vulnerability | High | 8.4 | Remote Code Execution | |
| CVE-2026-26148 | Microsoft Azure AD SSH Login extension for Linux Elevation of Privilege Vulnerability | High | 8.1 | Elevation of Privilege | |
| CVE-2026-23672 | Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability | High | 7.8 | Elevation of Privilege | |
| CVE-2026-23673 | Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability | High | 7.8 | Elevation of Privilege | |
| CVE-2026-25165 | Performance Counters for Windows Elevation of Privilege Vulnerability | High | 7.8 | Elevation of Privilege | |
| CVE-2026-25166 | Windows System Image Manager Assessment and Deployment Kit (ADK) Remote Code Execution Vulnerability | High | 7.8 | Remote Code Execution | |
| CVE-2026-25174 | Windows Extensible File Allocation Table Elevation of Privilege Vulnerability | High | 7.8 | Elevation of Privilege | |
| CVE-2026-26117 | Arc Enabled Servers - Azure Connected Machine Agent Elevation of Privilege Vulnerability | High | 7.8 | Elevation of Privilege | |
| CVE-2026-26141 | Hybrid Worker Extension (Arc‑enabled Windows VMs) Elevation of Privilege Vulnerability | High | 7.8 | Elevation of Privilege | |
| CVE-2026-23674 | MapUrlToZone Security Feature Bypass Vulnerability | High | 7.5 | Security Feature Bypass | |
| CVE-2026-26144 | Microsoft Excel Information Disclosure Vulnerability | High | 7.5 | Information Disclosure | |
| CVE-2026-23667 | Broadcast DVR Elevation of Privilege Vulnerability | High | 7 | Elevation of Privilege | |
| CVE-2026-24296 | Windows Device Association Service Elevation of Privilege Vulnerability | High | 7 | Elevation of Privilege | |
| CVE-2026-23656 | Windows App Installer Spoofing Vulnerability | Medium | 5.9 | Spoofing | |
| CVE-2026-32187 | Microsoft Edge (Chromium-based) Defense in Depth Vulnerability - Rejected | N/A | 0 | Edge - Chromium | |
| CVE-2026-32169 | Azure Cloud Shell Elevation of Privilege Vulnerability | Critical | 10 | Elevation of Privilege | |
| CVE-2025-69720 | The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c. | Critical | 9.8 | | |
| CVE-2026-32191 | Microsoft Bing Images Remote Code Execution Vulnerability | Critical | 9.8 | Remote Code Execution | |
| CVE-2026-32194 | Microsoft Bing Images Remote Code Execution Vulnerability | Critical | 9.8 | Remote Code Execution | |
| CVE-2026-3381 | Compress::Raw::Zlib versions through 2.219 for Perl use potentially insecure versions of zlib | Critical | 9.8 | | |
| CVE-2026-33937 | Handlebars.js has JavaScript Injection via AST Type Confusion | Critical | 9.8 | | |
| CVE-2026-4176 | Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib | Critical | 9.8 | | |
| CVE-2026-34714 | Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configuration, because %{expr} injection occurs with tabpanel lacking P_MLE. | Critical | 9.2 | | |
| CVE-2026-4177 | YAML::Syck versions through 1.36 for Perl has several potential security vulnerabilities including a high-severity heap buffer overflow in the YAML emitter | Critical | 9.1 | | |
| CVE-2025-67030 | Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code | High | 8.8 | | |
| CVE-2026-23395 | Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ | High | 8.8 | | |
| CVE-2026-4450 | Chromium: CVE-2026-4450 Out of bounds write in V8 | High | 8.8 | Edge - Chromium | |
| CVE-2006-10003 | XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack | High | 8.6 | | |
| CVE-2026-23658 | Azure DevOps: msazure Elevation of Privilege Vulnerability | High | 8.6 | Elevation of Privilege | |
| CVE-2026-23659 | Azure Data Factory Information Disclosure Vulnerability | High | 8.6 | Information Disclosure | |
| CVE-2026-26125 | Payment Orchestrator Service Elevation of Privilege Vulnerability | High | 8.6 | Elevation of Privilege | |
| CVE-2026-26138 | Microsoft Purview Elevation of Privilege Vulnerability | High | 8.6 | Elevation of Privilege | |
| CVE-2026-26139 | Microsoft Purview Elevation of Privilege Vulnerability | High | 8.6 | Elevation of Privilege | |
| CVE-2026-33216 | NATS has MQTT plaintext password disclosure | High | 8.6 | | |
| CVE-2026-5121 | Libarchive: libarchive: arbitrary code execution via integer overflow in iso9660 image processing | High | 8.6 | | |
| CVE-2026-0031 | In multiple functions of mem_protect.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | High | 8.4 | | |
| CVE-2026-0038 | In multiple functions of mem_protect.c, there is a possible way to execute arbitrary code due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | High | 8.4 | | |
| CVE-2026-23374 | blktrace: fix __this_cpu_read/write in preemptible context | High | 8.4 | | |
| CVE-2026-27654 | NGINX ngx_http_dav_module vulnerability | High | 8.2 | | |
| CVE-2026-31788 | xen/privcmd: restrict usage in unprivileged domU | High | 8.2 | | |
| CVE-2026-33941 | Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options | High | 8.2 | | |
| CVE-2026-33186 | gRPC-Go has an authorization bypass via missing leading slash in :path | High | 8.1 | | |
| CVE-2026-33938 | Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block | High | 8.1 | | |
| CVE-2026-33940 | Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial | High | 8.1 | | |
| CVE-2025-69650 | GNU Binutils thru 2.46 readelf contains a double free vulnerability when processing a crafted ELF binary with malformed relocation data. During GOT relocation handling, dump_relocations may return early without initializing the all_relocations array. As a result, process_got_section_contents() may pass an uninitialized r_symbol pointer to free(), leading to a double free and terminating the program with SIGABRT. No evidence of exploitable memory corruption or code execution was observed; the impact is limited to denial of service. | High | 7.8 | | |
| CVE-2026-0032 | In multiple functions of mem_protect.c, there is a possible out-of-bounds write due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | High | 7.8 | | |
| CVE-2026-23231 | netfilter: nf_tables: fix use-after-free in nf_tables_addchain() | High | 7.8 | | |
| CVE-2026-23233 | f2fs: fix to avoid mapping wrong physical block for swapfile | High | 7.8 | | |
| CVE-2026-23234 | f2fs: fix to avoid UAF in f2fs_write_end_io() | High | 7.8 | | |
| CVE-2026-23235 | f2fs: fix out-of-bounds access in sysfs attribute read/write | High | 7.8 | | |
| CVE-2026-23243 | RDMA/umad: Reject negative data_len in ib_umad_write | High | 7.8 | | |
| CVE-2026-23268 | apparmor: fix unprivileged local user can do privileged policy management | High | 7.8 | | |
| CVE-2026-23281 | wifi: libertas: fix use-after-free in lbs_free_adapter() | High | 7.8 | | |
| CVE-2026-23287 | irqchip/sifive-plic: Fix frozen interrupt due to affinity setting | High | 7.8 | | |
| CVE-2026-23308 | pinctrl: equilibrium: fix warning trace on load | High | 7.8 | | |
| CVE-2026-23336 | wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() | High | 7.8 | | |
| CVE-2026-23340 | net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs | High | 7.8 | | |
| CVE-2026-23359 | bpf: Fix stack-out-of-bounds write in devmap | High | 7.8 | | |
| CVE-2026-23372 | nfc: rawsock: cancel tx_work before socket teardown | High | 7.8 | | |
| CVE-2026-23391 | netfilter: xt_CT: drop pending enqueued packets on template removal | High | 7.8 | | |
| CVE-2026-23392 | netfilter: nf_tables: release flowtable after rcu grace period on error | High | 7.8 | | |
| CVE-2026-27784 | NGINX ngx_http_mp4_module vulnerability | High | 7.8 | | |
| CVE-2026-32647 | NGINX ngx_http_mp4_module vulnerability | High | 7.8 | | |
| CVE-2026-4775 | Libtiff: libtiff: arbitrary code execution or denial of service via signed integer overflow in tiff file processing | High | 7.8 | | |
| CVE-2026-26017 | CoreDNS ACL Bypass | High | 7.7 | | |
| CVE-2026-33636 | LIBPNG has ARM NEON Palette Expansion Out-of-Bounds Read on AArch64 | High | 7.6 | | |
| CVE-2006-10002 | XML::Parser versions through 2.47 for Perl could overflow the pre-allocated buffer size cause a heap corruption (double free or corruption) and crashes | High | 7.5 | | |
| CVE-2026-1519 | Excessive NSEC3 iterations cause high CPU load during insecure delegation validation | High | 7.5 | | |
| CVE-2026-21710 | A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`.
When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`.
* This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x** | High | 7.5 | | |
| CVE-2026-23293 | net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled | High | 7.5 | | |
| CVE-2026-23300 | net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop | High | 7.5 | | |
| CVE-2026-25075 | strongSwan 4.5.0 < 6.0.5 EAP-TTLS AVP Parsing Integer Underflow | High | 7.5 | | |
| CVE-2026-25679 | Incorrect parsing of IPv6 host literals in net/url | High | 7.5 | | |
| CVE-2026-26018 | CoreDNS Loop Detection Denial of Service Vulnerability | High | 7.5 | | |
| CVE-2026-27135 | nghttp2 Denial of service: Assertion failure due to the missing state validation | High | 7.5 | | |
| CVE-2026-27142 | URLs in meta content attribute actions are not escaped in html/template | High | 7.5 | | |
| CVE-2026-27601 | Underscore.js has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack | High | 7.5 | | |
| CVE-2026-27651 | NGINX ngx_mail_auth_http_module vulnerability | High | 7.5 | | |
| CVE-2026-29785 | NATS Server panic via malicious compression on leafnode port | High | 7.5 | | |
| CVE-2026-30922 | pyasn1 Vulnerable to Denial of Service via Unbounded Recursion | High | 7.5 | | |
| CVE-2026-3104 | Memory leak in code preparing DNSSEC proofs of non-existence | High | 7.5 | | |
| CVE-2026-32141 | flatted: Unbounded recursion DoS in parse() revive phase | High | 7.5 | | |
| CVE-2026-32241 | Flannel vulnerable to cross-node remote code execution via extension backend BackendData injection | High | 7.5 | | |
| CVE-2026-32287 | Infinite loop in github.com/antchfx/xpath | High | 7.5 | | |
| CVE-2026-32597 | PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation) | High | 7.5 | | |
| CVE-2026-32748 | Squid has Denial of Service in ICP Response handling | High | 7.5 | | |
| CVE-2026-3336 | PKCS7_verify Certificate Chain Validation Bypass in AWS-LC | High | 7.5 | | |
| CVE-2026-3338 | PKCS7_verify Signature Validation Bypass in AWS-LC | High | 7.5 | | |
| CVE-2026-33416 | LIBPNG has use-after-free via pointer aliasing in `png_set_tRNS` and `png_set_PLTE` | High | 7.5 | | |
| CVE-2026-33526 | Squid vulnerable to Denial of Service in ICP Request handling | High | 7.5 | | |
| CVE-2026-33554 | ipmi-oem in FreeIPMI before 1.16.17 has exploitable buffer overflows on response messages. The Intelligent Platform Management Interface (IPMI) specification defines a set of interfaces for platform management. It is implemented by a large number of hardware manufacturers to support system management. It is most commonly used for sensor reading (e.g., CPU temperatures through the ipmi-sensors command within FreeIPMI) and remote power control (the ipmipower command). The ipmi-oem client command implements a set of a IPMI OEM commands for specific hardware vendors. If a user has supported hardware, they may wish to use the ipmi-oem command to send a request to a server to retrieve specific information. Three subcommands were found to have exploitable buffer overflows on response messages. They are: "ipmi-oem dell get-last-post-code - get the last POST code and string describing the error on some Dell servers," "ipmi-oem supermicro extra-firmware-info - get extra firmware info on Supermic | High | 7.5 | | |
| CVE-2026-33671 | Picomatch has a ReDoS vulnerability via extglob quantifiers | High | 7.5 | | |
| CVE-2026-33891 | Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input | High | 7.5 | | |
| CVE-2026-33895 | Forge has signature forgery in Ed25519 due to missing S > L check | High | 7.5 | | |
| CVE-2026-33939 | Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation | High | 7.5 | | |
| CVE-2026-3547 | wolfSSL: out-of-bounds read (DoS) in ALPN parsing due to incomplete validation | High | 7.5 | | |
| CVE-2026-3644 | Incomplete control character validation in http.cookies | High | 7.5 | | |
| CVE-2026-3805 | use after free in SMB connection reuse | High | 7.5 | | |
| CVE-2026-4046 | iconv crash due to assertion failure with untrusted input | High | 7.5 | | |
| CVE-2026-4111 | Libarchive: infinite loop denial of service in rar5 decompression via archive_read_data() in libarchive | High | 7.5 | | |
| CVE-2026-4224 | Stack overflow parsing XML with deeply nested DTD content models | High | 7.5 | | |
| CVE-2026-4424 | Libarchive: libarchive: information disclosure via heap out-of-bounds read in rar archive processing | High | 7.5 | | |
| CVE-2026-4645 | Github.com/antchfx/xpath: xpath: denial of service via crafted boolean xpath expressions | High | 7.5 | | |
| CVE-2026-5201 | Gdk-pixbuf: gdk-pixbuf: denial of service via heap-based buffer overflow when processing a specially crafted jpeg image | High | 7.5 | | |
| CVE-2025-66413 | Git for Windows leaks NTLM hash when cloning from an attacker-controlled server | High | 7.4 | | |
| CVE-2025-69648 | GNU Binutils thru 2.45.1 readelf contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF .debug_rnglists data. A logic flaw in the DWARF parsing path causes readelf to repeatedly print the same warning message without making forward progress, resulting in a non-terminating output loop that requires manual interruption. No evidence of memory corruption or code execution was observed. | High | 7.4 | | |
| CVE-2026-32775 | libexif through 0.6.25 has a flaw in decoding MakerNotes. If the exif_mnote_data_get_value function gets passed in a 0 size, the passed in-buffer would be overwritten due to an integer underflow. | High | 7.4 | | |
| CVE-2026-33896 | Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation) | High | 7.4 | | |
| CVE-2025-69651 | GNU Binutils thru 2.46 readelf contains a vulnerability that leads to an invalid pointer free when processing a crafted ELF binary with malformed relocation or symbol data. If dump_relocations returns early due to parsing errors, the internal all_relocations array may remain partially uninitialized. Later, process_got_section_contents() may attempt to free an invalid r_symbol pointer, triggering memory corruption checks in glibc and causing the program to terminate with SIGABRT. No evidence of further memory corruption or code execution was observed; the impact is limited to denial of service. | High | 7.1 | | |
| CVE-2026-23265 | f2fs: fix to do sanity check on node footer in {read,write}_end_io | High | 7.1 | | |
| CVE-2026-23267 | f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes | High | 7.1 | | |
| CVE-2026-23269 | apparmor: validate DFA start states are in bounds in unpack_pdb | High | 7.1 | | |
| CVE-2026-23289 | IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq() | High | 7.1 | | |
| CVE-2026-23296 | scsi: core: Fix refcount leak for tagset_refcnt | High | 7.1 | | |
| CVE-2026-23302 | net: annotate data-races around sk->sk_{data_ready,write_space} | High | 7.1 | | |
| CVE-2026-23306 | scsi: pm8001: Fix use-after-free in pm8001_queue_command() | High | 7.1 | | |
| CVE-2026-23310 | bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded | High | 7.1 | | |
| CVE-2026-23313 | i40e: Fix preempt count leak in napi poll tracepoint | High | 7.1 | | |
| CVE-2026-23315 | wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211() | High | 7.1 | | |
| CVE-2026-23318 | ALSA: usb-audio: Use correct version for UAC3 header validation | High | 7.1 | | |
| CVE-2026-23325 | wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211() | High | 7.1 | | |
| CVE-2026-23327 | cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() | High | 7.1 | | |
| CVE-2026-23343 | xdp: produce a warning when calculated tailroom is negative | High | 7.1 | | |
| CVE-2026-23361 | PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry | High | 7.1 | | |
| CVE-2026-23377 | ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz | High | 7.1 | | |
| CVE-2026-23378 | net/sched: act_ife: Fix metalist update behavior | High | 7.1 | | |
| CVE-2026-23386 | gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL | High | 7.1 | | |
| CVE-2026-23388 | Squashfs: check metadata block offset is within range | High | 7.1 | | |
| CVE-2026-23239 | espintcp: Fix race condition in espintcp_close() | High | 7 | | |
| CVE-2026-23240 | tls: Fix race condition in tls_sw_cancel_work_tx() | High | 7 | | |
| CVE-2026-23393 | bridge: cfm: Fix race condition in peer_mep deletion | High | 7 | | |
| CVE-2026-23868 | Giflib contains a double-free vulnerability that is the result of a shallow copy in GifMakeSavedImage and incorrect error handling. The conditions needed to trigger this vulnerability are difficult but may be possible. | High | 7 | | |
| CVE-2026-4105 | Systemd: systemd: privilege escalation via improper access control in registermachine d-bus method | Medium | 6.7 | | |
| CVE-2026-0966 | Libssh: buffer underflow in ssh_get_hexa() on invalid input | Medium | 6.5 | | |
| CVE-2026-1965 | bad reuse of HTTP Negotiate connection | Medium | 6.5 | | |
| CVE-2026-23247 | tcp: secure_seq: add back ports to TS offset | Medium | 6.5 | | |
| CVE-2026-23279 | wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() | Medium | 6.5 | | |
| CVE-2026-23398 | icmp: fix NULL pointer dereference in icmp_tag_validation() | Medium | 6.5 | | |
| CVE-2026-2369 | Libsoup: libsoup: buffer overread due to integer underflow when handling zero-length resources | Medium | 6.5 | | |
| CVE-2026-2436 | Libsoup: libsoup: denial of service via use-after-free in soupserver during tls handshake | Medium | 6.5 | | |
| CVE-2026-26120 | Microsoft Bing Tampering Vulnerability | Medium | 6.5 | Tampering | |
| CVE-2026-26136 | Microsoft Copilot Information Disclosure Vulnerability | Medium | 6.5 | Information Disclosure | |
| CVE-2026-3119 | Authenticated query containing a TKEY record may cause named to terminate unexpectedly | Medium | 6.5 | | |
| CVE-2026-33750 | brace-expansion: Zero-step sequence causes process hang and memory exhaustion | Medium | 6.5 | | |
| CVE-2026-3784 | wrong proxy connection reuse with credentials | Medium | 6.5 | | |
| CVE-2026-4426 | Libarchive: libarchive: denial of service via malformed iso file processing | Medium | 6.5 | | |
| CVE-2026-23272 | netfilter: nf_tables: unconditionally bump set->nelems before insertion | Medium | 6.4 | | |
| CVE-2026-23284 | net: ethernet: mtk_eth_soc: Reset prog ptr to old_prog in case of error in mtk_xdp_setup() | Medium | 6.4 | | |
| CVE-2026-29786 | node-tar: Hardlink Path Traversal via Drive-Relative Linkpath | Medium | 6.3 | | |
| CVE-2025-69647 | GNU Binutils thru 2.45.1 readelf contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF loclists data. A logic flaw in the DWARF parsing code can cause readelf to repeatedly print the same table output without making forward progress, resulting in an unbounded output loop that never terminates unless externally interrupted. A local attacker can trigger this behavior by supplying a malicious input file, causing excessive CPU and I/O usage and preventing readelf from completing its analysis. | Medium | 6.2 | | |
| CVE-2025-69652 | GNU Binutils thru 2.46 readelf contains a vulnerability that leads to an abort (SIGABRT) when processing a crafted ELF binary with malformed DWARF abbrev or debug information. Due to incomplete state cleanup in process_debug_info(), an invalid debug_info_p state may propagate into DWARF attribute parsing routines. When certain malformed attributes result in an unexpected data length of zero, byte_get_little_endian() triggers a fatal abort. No evidence of memory corruption or code execution was observed; the impact is limited to denial of service. | Medium | 6.2 | | |
| CVE-2025-71238 | scsi: qla2xxx: Fix bsg_done() causing double free | Medium | 6.2 | | |
| CVE-2026-23389 | ice: Fix memory leak in ice_set_ringparam() | Medium | 6.2 | | |
| CVE-2026-3904 | Calling NSS-backed functions that support caching via nscd may call the
nscd client side code and in the GNU C Library version 2.36 under high
load on x86_64 systems, the client may call memcmp on inputs that are
concurrently modified by other processes or threads and crash.
The nscd client in the GNU C Library uses the memcmp function with
inputs that may be concurrently modified by another thread, potentially
resulting in spurious cache misses, which in itself is not a security
issue. However in the GNU C Library version 2.36 an optimized
implementation of memcmp was introduced for x86_64 which could crash
when invoked with such undefined behaviour, turning this into a
potential crash of the nscd client and the application that uses it.
This implementation was backported to the 2.35 branch, making the nscd
client in that branch vulnerable as well. Subsequently, the fix for
this issue was backported to all vulnerable branches in the GNU C
Library repository.
It is | Medium | 6.2 | | |
| CVE-2026-4647 | Binutils: out-of-bounds read in xcoff relocation processing in gnu binutils bfd library | Medium | 6.1 | | |
| CVE-2026-21713 | A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timing information proportional to the number of matching bytes. Under certain threat models where high-resolution timing measurements are possible, this behavior could be exploited as a timing oracle to infer HMAC values.
Node.js already provides timing-safe comparison primitives used elsewhere in the codebase, indicating this is an oversight rather than an intentional design decision.
This vulnerability affects **20.x, 22.x, 24.x, and 25.x**. | Medium | 5.9 | | |
| CVE-2026-21717 | A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the Node.js process.
The most common trigger is any endpoint that calls `JSON.parse()` on attacker-controlled input, as JSON parsing automatically internalizes short strings into the affected hash table.
This vulnerability affects **20.x, 22.x, 24.x, and 25.x**. | Medium | 5.9 | | |
| CVE-2026-23246 | wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration | Medium | 5.9 | | |
| CVE-2026-23277 | net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit | Medium | 5.9 | | |
| CVE-2026-27137 | Incorrect enforcement of email constraints in crypto/x509 | Medium | 5.9 | | |
| CVE-2026-27138 | Panic in name constraint checking for malformed certificates in crypto/x509 | Medium | 5.9 | | |
| CVE-2026-34043 | Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects | Medium | 5.9 | | |
| CVE-2026-34085 | fontconfig before 2.17.1 has an off-by-one error in allocation during sfnt capability handling, leading to a one-byte out-of-bounds write, and potentially a crash or code execution. This is in FcFontCapabilities in fcfreetype.c. | Medium | 5.9 | | |
| CVE-2026-34353 | In OCaml through 4.14.3, Bigarray.reshape allows an integer overflow, and resultant reading of arbitrary memory, when untrusted data is processed. | Medium | 5.9 | | |
| CVE-2026-4437 | gethostbyaddr and gethostbyaddr_r may incorrectly handle DNS response | Medium | 5.9 | | |
| CVE-2026-4438 | gethostbyaddr and gethostbyaddr_r return invalid DNS hostnames | Medium | 5.9 | | |
| CVE-2026-5119 | Libsoup: libsoup: information disclosure via cleartext transmission of cookies during https tunnel establishment | Medium | 5.9 | | |
| CVE-2026-3099 | Libsoup: libsoup: authentication bypass via digest authentication replay attack | Medium | 5.8 | | |
| CVE-2026-21712 | A flaw in Node.js URL processing causes an assertion failure in native code when `url.format()` is called with a malformed internationalized domain name (IDN) containing invalid characters, crashing the Node.js process. | Medium | 5.7 | | |
| CVE-2026-33412 | Vim affected by Command injection via newline in glob() | Medium | 5.6 | | |
| CVE-2024-14027 | xattr: switch to CLASS(fd) | Medium | 5.5 | | |
| CVE-2025-69645 | Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug information. A logic error in the handling of DWARF compilation units can result in an invalid offset_size value being used inside byte_get_little_endian, leading to an abort (SIGABRT). The issue was observed in binutils 2.44. A local attacker can trigger the crash by supplying a malicious input file. | Medium | 5.5 | | |
| CVE-2025-69646 | Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug_rnglists data. A logic error in the handling of the debug_rnglists header can cause objdump to repeatedly print the same warning message and fail to terminate, resulting in an unbounded logging loop until the process is interrupted. The issue was observed in binutils 2.44. A local attacker can exploit this vulnerability by supplying a malicious input file, leading to excessive CPU and I/O usage and preventing completion of the objdump analysis. | Medium | 5.5 | | |
| CVE-2025-69649 | GNU Binutils thru 2.46 readelf contains a null pointer dereference vulnerability when processing a crafted ELF binary with malformed header fields. During relocation processing, an invalid or null section pointer may be passed into display_relocations(), resulting in a segmentation fault (SIGSEGV) and abrupt termination. No evidence of memory corruption beyond the null pointer dereference, nor any possibility of code execution, was observed. | Medium | 5.5 | | |
| CVE-2025-71239 | audit: add fchmodat2() to change attributes class | Medium | 5.5 | | |
| CVE-2025-71265 | fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata | Medium | 5.5 | | |
| CVE-2025-71266 | fs: ntfs3: check return value of indx_find to avoid infinite loop | Medium | 5.5 | | |
| CVE-2025-71267 | fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST | Medium | 5.5 | | |
| CVE-2025-71269 | btrfs: do not free data reservation in fallback from inline due to -ENOSPC | Medium | 5.5 | | |
| CVE-2026-23236 | fbdev: smscufx: properly copy ioctl memory to kernelspace | Medium | 5.5 | | |
| CVE-2026-23237 | platform/x86: classmate-laptop: Add missing NULL pointer checks | Medium | 5.5 | | |
| CVE-2026-23238 | romfs: check sb_set_blocksize() return value | Medium | 5.5 | | |
| CVE-2026-23242 | RDMA/siw: Fix potential NULL pointer dereference in header processing | Medium | 5.5 | | |
| CVE-2026-23244 | nvme: fix memory allocation in nvme_pr_read_keys() | Medium | 5.5 | | |
| CVE-2026-23245 | net/sched: act_gate: snapshot parameters with RCU on replace | Medium | 5.5 | | |
| CVE-2026-23248 | perf/core: Fix refcount bug and potential UAF in perf_mmap | Medium | 5.5 | | |
| CVE-2026-23253 | media: dvb-core: fix wrong reinitialization of ringbuffer on reopen | Medium | 5.5 | | |
| CVE-2026-23259 | io_uring/rw: free potentially allocated iovec on cache put failure | Medium | 5.5 | | |
| CVE-2026-23266 | fbdev: rivafb: fix divide error in nv3_arb() | Medium | 5.5 | | |
| CVE-2026-23271 | perf: Fix __perf_event_overflow() vs perf_remove_from_context() race | Medium | 5.5 | | |
| CVE-2026-23274 | netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels | Medium | 5.5 | | |
| CVE-2026-23276 | net: add xmit recursion limit to tunnel xmit functions | Medium | 5.5 | | |
| CVE-2026-23285 | drbd: fix null-pointer dereference on local read error | Medium | 5.5 | | |
| CVE-2026-23286 | atm: lec: fix null-ptr-deref in lec_arp_clear_vccs | Medium | 5.5 | | |
| CVE-2026-23290 | net: usb: pegasus: validate USB endpoints | Medium | 5.5 | | |
| CVE-2026-23291 | nfc: pn533: properly drop the usb interface reference on disconnect | Medium | 5.5 | | |
| CVE-2026-23292 | scsi: target: Fix recursive locking in __configfs_open_file() | Medium | 5.5 | | |
| CVE-2026-23298 | can: ucan: Fix infinite loop from zero-length messages | Medium | 5.5 | | |
| CVE-2026-23303 | smb: client: Don't log plaintext credentials in cifs_set_cifscreds | Medium | 5.5 | | |
| CVE-2026-23304 | ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() | Medium | 5.5 | | |
| CVE-2026-23307 | can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message | Medium | 5.5 | | |
| CVE-2026-23312 | net: usb: kaweth: validate USB endpoints | Medium | 5.5 | | |
| CVE-2026-23317 | drm/vmwgfx: Return the correct value in vmw_translate_ptr functions | Medium | 5.5 | | |
| CVE-2026-23319 | bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim | Medium | 5.5 | | |
| CVE-2026-23320 | usb: gadget: f_ncm: align net_device lifecycle with bind/unbind | Medium | 5.5 | | |
| CVE-2026-23324 | can: usb: etas_es58x: correctly anchor the urb in the read bulk callback | Medium | 5.5 | | |
| CVE-2026-23330 | nfc: nci: complete pending data exchange on device close | Medium | 5.5 | | |
| CVE-2026-23333 | netfilter: nft_set_rbtree: validate open interval overlap | Medium | 5.5 | | |
| CVE-2026-23334 | can: usb: f81604: handle short interrupt urb messages properly | Medium | 5.5 | | |
| CVE-2026-23335 | RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() | Medium | 5.5 | | |
| CVE-2026-23339 | nfc: nci: free skb on nci_transceive early error paths | Medium | 5.5 | | |
| CVE-2026-23346 | arm64: io: Extract user memory type in ioremap_prot() | Medium | 5.5 | | |
| CVE-2026-23347 | can: usb: f81604: correctly anchor the urb in the read bulk callback | Medium | 5.5 | | |
| CVE-2026-23348 | cxl: Fix race of nvdimm_bus object when creating nvdimm objects | Medium | 5.5 | | |
| CVE-2026-23351 | netfilter: nft_set_pipapo: split gc into unlink and reclaim phase | Medium | 5.5 | | |
| CVE-2026-23352 | x86/efi: defer freeing of boot services memory | Medium | 5.5 | | |
| CVE-2026-23356 | drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() | Medium | 5.5 | | |
| CVE-2026-23357 | can: mcp251x: fix deadlock in error path of mcp251x_open | Medium | 5.5 | | |
| CVE-2026-23360 | nvme: fix admin queue leak on controller reset | Medium | 5.5 | | |
| CVE-2026-23362 | can: bcm: fix locking for bcm_op runtime updates | Medium | 5.5 | | |
| CVE-2026-23364 | ksmbd: Compare MACs in constant time | Medium | 5.5 | | |
| CVE-2026-23365 | net: usb: kalmia: validate USB endpoints | Medium | 5.5 | | |
| CVE-2026-23367 | wifi: radiotap: reject radiotap with unknown bits | Medium | 5.5 | | |
| CVE-2026-23368 | net: phy: register phy led_triggers during probe to avoid AB-BA deadlock | Medium | 5.5 | | |
| CVE-2026-23370 | platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data | Medium | 5.5 | | |
| CVE-2026-23379 | net/sched: ets: fix divide by zero in the offload path | Medium | 5.5 | | |
| CVE-2026-23381 | net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled | Medium | 5.5 | | |
| CVE-2026-23382 | HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them | Medium | 5.5 | | |
| CVE-2026-23383 | bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing | Medium | 5.5 | | |
| CVE-2026-23385 | netfilter: nf_tables: clone set on flush only | Medium | 5.5 | | |
| CVE-2026-23390 | tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow | Medium | 5.5 | | |
| CVE-2026-23396 | wifi: mac80211: fix NULL deref in mesh_matches_local() | Medium | 5.5 | | |
| CVE-2026-23399 | nf_tables: nft_dynset: fix possible stateful expression memleak in error path | Medium | 5.5 | | |
| CVE-2026-29111 | systemd: Local unprivileged user can trigger an assert | Medium | 5.5 | | |
| CVE-2026-31802 | node-tar Symlink Path Traversal via Drive-Relative Linkpath | Medium | 5.5 | | |
| CVE-2026-4897 | Polkit: polkit: denial of service via unbounded input processing through standard input | Medium | 5.5 | | |
| CVE-2026-4948 | Firewalld: firewalld: local unprivileged user can modify firewall state due to d-bus setter mis-authorization | Medium | 5.5 | | |
| CVE-2026-28755 | NGINX ngx_stream_ssl_module vulnerability | Medium | 5.4 | | |
| CVE-2026-33343 | etcd: Nested etcd transactions bypass RBAC authorization checks | Medium | 5.4 | | |
| CVE-2026-3591 | A stack use-after-return flaw in SIG(0) handling code may enable ACL bypass | Medium | 5.4 | | |
| CVE-2026-2100 | P11-kit: p11-kit: null dereference via c_derivekey with specific null parameters | Medium | 5.3 | | |
| CVE-2026-21711 | A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them.
As a result, code running under `--permission` without `--allow-net` can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary.
This vulnerability affects Node.js **25.x** processes using the Permission Model where `--allow-net` is intentionally omitted to restrict network access. Note that `--allow-net` is currently an experimental feature. | Medium | 5.3 | | |
| CVE-2026-21714 | A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to exceed the maximum value of 2³¹-1. The server correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up.
This vulnerability affects HTTP2 users on Node.js 20, 22, 24 and 25. | Medium | 5.3 | | |
| CVE-2026-23865 | An integer overflow in the tt_var_load_item_variation_store function of the Freetype library in versions 2.13.2 and 2.13.3 may allow for an out of bounds read operation when parsing HVAR/VVAR/MVAR tables in OpenType variable fonts. This issue is fixed in version 2.14.2. | Medium | 5.3 | | |
| CVE-2026-24299 | M365 Copilot Information Disclosure Vulnerability | Medium | 5.3 | Information Disclosure | |
| CVE-2026-2673 | OpenSSL TLS 1.3 server may choose unexpected key agreement group | Medium | 5.3 | | |
| CVE-2026-32249 | NFA regex engine NULL pointer dereference affects Vim < 9.2.0137 | Medium | 5.3 | | |
| CVE-2026-33515 | Squid has issues in ICP message handling | Medium | 5.3 | | |
| CVE-2026-33672 | Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching | Medium | 5.3 | | |
| CVE-2026-33936 | python-ecdsa: Denial of Service via improper DER length validation in crafted private keys | Medium | 5.3 | | |
| CVE-2026-3713 | pnggroup libpng pnm2png pnm2png.c do_pnm2png heap-based overflow | Medium | 5.3 | | |
| CVE-2026-3731 | libssh SFTP Extension Name sftp.c sftp_extensions_get_data out-of-bounds | Medium | 5.3 | | |
| CVE-2026-3783 | token leak with redirect and netrc | Medium | 5.3 | | |
| CVE-2026-23241 | audit: add missing syscalls to read class | Medium | 5.1 | | |
| CVE-2025-69644 | An issue was discovered in Binutils before 2.46. The objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed debug information. A logic flaw in the handling of DWARF location list headers can cause objdump to enter an unbounded loop and produce endless output until manually interrupted. This issue affects versions prior to the upstream fix and allows a local attacker to cause excessive resource consumption by supplying a malicious input file. | Medium | 5 | | |
| CVE-2026-0385 | Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability | Medium | 5 | Spoofing | |
| CVE-2026-0964 | Libssh: improper sanitation of paths received from scp servers | Medium | 5 | | |
| CVE-2026-23255 | net: add proper RCU protection to /proc/net/ptype | Medium | 4.7 | | |
| CVE-2026-23278 | netfilter: nf_tables: always walk all pending catchall elements | Medium | 4.7 | | |
| CVE-2026-23371 | sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting | Medium | 4.7 | | |
| CVE-2026-23394 | af_unix: Give up GC if MSG_PEEK intervened. | Medium | 4.7 | | |
| CVE-2026-33916 | Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection | Medium | 4.7 | | |
| CVE-2026-23397 | nfnetlink_osf: validate individual option lengths in fingerprints | Medium | 4.4 | | |
| CVE-2026-25645 | Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function | Medium | 4.4 | | |
| CVE-2026-3494 | MariaDB Server Audit Plugin Comment Handling Bypass | Medium | 4.3 | | |
| CVE-2026-5107 | FRRouting FRR EVPN Type-2 Route bgp_evpn.c process_type2_route access control | Medium | 4.2 | | |
| CVE-2026-32776 | libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content. | Medium | 4 | | |
| CVE-2026-32777 | libexpat before 2.7.5 allows an infinite loop while parsing DTD content. | Medium | 4 | | |
| CVE-2025-66037 | OpenSC: Out of Bounds vulnerability | Low | 3.9 | | |
| CVE-2025-66038 | OpenSC: `sc_compacttlv_find_tag` can return out-of-bounds pointers | Low | 3.9 | | |
| CVE-2026-3632 | Libsoup: libsoup: http smuggling and server-side request forgery via malformed hostnames | Low | 3.9 | | |
| CVE-2026-3633 | Libsoup: libsoup: header and http request injection via crlf injection | Low | 3.9 | | |
| CVE-2026-3634 | Libsoup: libsoup: http header injection and response splitting via crlf injection in content-type header | Low | 3.9 | | |
| CVE-2025-49010 | OpenSC: Stack-buffer-overflow WRITE in GET RESPONSE | Low | 3.8 | | |
| CVE-2025-66215 | OpenSC: Stack-buffer-overflow WRITE in card-oberthur | Low | 3.8 | | |
| CVE-2026-28753 | NGINX ngx_mail_proxy_module vulnerability | Low | 3.7 | | |
| CVE-2025-70888 | An issue in mtrojnar Osslsigncode affected at v2.10 and before allows a remote attacker to escalate privileges via the osslsigncode.c component | Low | 3.3 | | |
| CVE-2026-0965 | Libssh: libssh: denial of service via improper configuration file handling | Low | 3.3 | | |
| CVE-2026-21715 | A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions correctly enforce them.
As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync.native()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.
This vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-read` is intentionally restricted. | Low | 3.3 | | |
| CVE-2026-21716 | An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permission checks, while their callback-based equivalents (`fs.fchmod()`, `fs.fchown()`) were correctly patched.
As a result, code running under `--permission` with restricted `--allow-fs-write` can still use promise-based `FileHandle` methods to modify file permissions and ownership on already-open file descriptors, bypassing the intended write restrictions.
This vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-write` is intentionally restricted. | Low | 3.3 | | |
| CVE-2026-4833 | Orc discount Markdown markdown.c compile recursion | Low | 3.3 | | |
| CVE-2026-0968 | Libssh: libssh: denial of service due to malformed sftp message | Low | 3.1 | | |
| CVE-2026-32778 | libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition. | Low | 2.9 | | |
| CVE-2026-27139 | FileInfo can escape from a Root in os | Low | 2.5 | | |
| CVE-2026-0967 | Libssh: libssh: denial of service via inefficient regular expression processing | Low | 2.2 | | |
| CVE-2025-13462 | tarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handling | N/A | | | |
| CVE-2026-0819 | Stack buffer overflow in PKCS7 SignedData encoding with custom signed attributes | N/A | | | |
| CVE-2026-1005 | Integer underflow leads to out-of-bounds access in sniffer AES-GCM/CCM/ARIA-GCM decrypt path | N/A | | | |
| CVE-2026-2297 | SourcelessFileLoader does not use io.open_code() | N/A | | | |
| CVE-2026-23941 | Request smuggling via first-wins Content-Length parsing in inets httpd | N/A | | | |
| CVE-2026-23942 | SFTP root escape via component-agnostic prefix check in ssh_sftpd | N/A | | | |
| CVE-2026-23943 | Pre-auth SSH DoS via unbounded zlib inflate | N/A | | | |
| CVE-2026-26137 | Microsoft Exchange Elevation of Privilege Vulnerability | N/A | | Elevation of Privilege | |
| CVE-2026-2645 | Acceptance of CertificateVerify Message before ClientKeyExchange in TLS 1.2 | N/A | | | |
| CVE-2026-2646 | Heap buffer overflow in session parsing with wolfSSL_d2i_SSL_SESSION() function | N/A | | | |
| CVE-2026-27448 | pyOpenSSL allows TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback | N/A | | | |
| CVE-2026-27459 | pyOpenSSL DTLS cookie callback buffer overflow | N/A | | | |
| CVE-2026-3229 | Integer Overflow in Certificate Chain Allocation | N/A | | | |
| CVE-2026-3230 | Improper key_share validation in TLS 1.3 HelloRetryRequest | N/A | | | |
| CVE-2026-32766 | astral-tokio-tar insufficiently validates PAX extensions during extraction | N/A | | | |
| CVE-2026-33055 | tar-rs incorrectly ignores PAX size headers if header size is nonzero | N/A | | | |
| CVE-2026-33056 | tar-rs: unpack_in can chmod arbitrary directories by following symlinks | N/A | | | |
| CVE-2026-33228 | flatted: Prototype Pollution via parse() | N/A | | | |
| CVE-2026-33413 | etcd: Authorization bypasses in multiple APIs | N/A | | | |
| CVE-2026-33542 | Incus does not verify combined fingerprint when downloading images from simplestreams servers | N/A | | | |
| CVE-2026-34073 | cryptography has incomplete DNS name constraint enforcement on peer names | N/A | | | |
| CVE-2026-3479 | pkgutil.get_data() does not enforce documented restrictions | N/A | | | |
| CVE-2026-3503 | Fault injection attack with ML-DSA and ML-KEM on ARM | N/A | | | |
| CVE-2026-3536 | Chromium: CVE-2026-3536 Integer overflow in ANGLE | N/A | | Edge - Chromium | |
| CVE-2026-3537 | Chromium: CVE-2026-3537 Object lifecycle issue in PowerVR | N/A | | Edge - Chromium | |
| CVE-2026-3538 | Chromium: CVE-2026-3538 Integer overflow in Skia | N/A | | Edge - Chromium | |
| CVE-2026-3539 | Chromium: CVE-2026-3539 Object lifecycle issue in DevTools | N/A | | Edge - Chromium | |
| CVE-2026-3540 | Chromium: CVE-2026-3540 Inappropriate implementation in WebAudio | N/A | | Edge - Chromium | |
| CVE-2026-3541 | Chromium: CVE-2026-3541 Inappropriate implementation in CSS | N/A | | Edge - Chromium | |
| CVE-2026-3542 | Chromium: CVE-2026-3542 Inappropriate implementation in WebAssembly | N/A | | Edge - Chromium | |
| CVE-2026-3543 | Chromium: CVE-2026-3543 Inappropriate implementation in V8 | N/A | | Edge - Chromium | |
| CVE-2026-3544 | Chromium: CVE-2026-3544 Heap buffer overflow in WebCodecs | N/A | | Edge - Chromium | |
| CVE-2026-3545 | Chromium: CVE-2026-3545 Insufficient data validation in Navigation | N/A | | Edge - Chromium | |
| CVE-2026-3548 | Buffer overflow in CRL number parsing in wolfSSL | N/A | | | |
| CVE-2026-3549 | ECH parsing heap buffer overflow | N/A | | | |
| CVE-2026-3579 | Non-constant time multiplication subroutine __muldi3 on RISC-V RV32I | N/A | | | |
| CVE-2026-3580 | Compiler-induced timing leak in sp_256_get_entry_256_9 on RISC-V | N/A | | | |
| CVE-2026-3849 | Buffer Overflow in HPKE via Oversized ECH Config | N/A | | | |
| CVE-2026-3909 | Chromium: CVE-2026-3909 Out of bounds write in Skia | N/A | | Edge - Chromium | |
| CVE-2026-3910 | Chromium: CVE-2026-3910 Inappropriate implementation in V8 | N/A | | Edge - Chromium | |
| CVE-2026-3913 | Chromium: CVE-2026-3913 Heap buffer overflow in WebML | N/A | | Edge - Chromium | |
| CVE-2026-3914 | Chromium: CVE-2026-3914 Integer overflow in WebML | N/A | | Edge - Chromium | |
| CVE-2026-3915 | Chromium: CVE-2026-3915 Heap buffer overflow in WebML | N/A | | Edge - Chromium | |
| CVE-2026-3916 | Chromium: CVE-2026-3916 Out of bounds read in Web Speech | N/A | | Edge - Chromium | |
| CVE-2026-3917 | Chromium: CVE-2026-3917 Use after free in Agents | N/A | | Edge - Chromium | |
| CVE-2026-3918 | Chromium: CVE-2026-3918 Use after free in WebMCP | N/A | | Edge - Chromium | |
| CVE-2026-3919 | Chromium: CVE-2026-3919 Use after free in Extensions | N/A | | Edge - Chromium | |
| CVE-2026-3920 | Chromium: CVE-2026-3920 Out of bounds memory access in WebML | N/A | | Edge - Chromium | |
| CVE-2026-3921 | Chromium: CVE-2026-3921 Use after free in TextEncoding | N/A | | Edge - Chromium | |
| CVE-2026-3922 | Chromium: CVE-2026-3922 Use after free in MediaStream | N/A | | Edge - Chromium | |
| CVE-2026-3923 | Chromium: CVE-2026-3923 Use after free in WebMIDI | N/A | | Edge - Chromium | |
| CVE-2026-3924 | Chromium: CVE-2026-3924 Use after free in WindowDialog | N/A | | Edge - Chromium | |
| CVE-2026-3925 | Chromium: CVE-2026-3925 Incorrect security UI in LookalikeChecks | N/A | | Edge - Chromium | |
| CVE-2026-3926 | Chromium: CVE-2026-3926 Out of bounds read in V8 | N/A | | Edge - Chromium | |
| CVE-2026-3927 | Chromium: CVE-2026-3927 Incorrect security UI in PictureInPicture | N/A | | Edge - Chromium | |
| CVE-2026-3928 | Chromium: CVE-2026-3928 Insufficient policy enforcement in Extensions | N/A | | Edge - Chromium | |
| CVE-2026-3929 | Chromium: CVE-2026-3929 Side-channel information leakage in ResourceTiming | N/A | | Edge - Chromium | |
| CVE-2026-3930 | Chromium: CVE-2026-3930 Unsafe navigation in Navigation | N/A | | Edge - Chromium | |
| CVE-2026-3931 | Chromium: CVE-2026-3931 Heap buffer overflow in Skia | N/A | | Edge - Chromium | |
| CVE-2026-3932 | Chromium: CVE-2026-3932 Insufficient policy enforcement in PDF | N/A | | Edge - Chromium | |
| CVE-2026-3934 | Chromium: CVE-2026-3934 Insufficient policy enforcement in ChromeDriver | N/A | | Edge - Chromium | |
| CVE-2026-3935 | Chromium: CVE-2026-3935 Incorrect security UI in WebAppInstalls | N/A | | Edge - Chromium | |
| CVE-2026-3936 | Chromium: CVE-2026-3936 Use after free in WebView | N/A | | Edge - Chromium | |
| CVE-2026-3937 | Chromium: CVE-2026-3937 Incorrect security UI in Downloads | N/A | | Edge - Chromium | |
| CVE-2026-3938 | Chromium: CVE-2026-3938 Insufficient policy enforcement in Clipboard | N/A | | Edge - Chromium | |
| CVE-2026-3939 | Chromium: CVE-2026-3939 Use after free in WebView | N/A | | Edge - Chromium | |
| CVE-2026-3940 | Chromium: CVE-2026-3940 Insufficient policy enforcement in DevTools | N/A | | Edge - Chromium | |
| CVE-2026-3941 | Chromium: CVE-2026-3941 Insufficient policy enforcement in DevTools | N/A | | Edge - Chromium | |
| CVE-2026-3942 | Chromium: CVE-2026-3942 Incorrect security UI in PictureInPicture | N/A | | Edge - Chromium | |
| CVE-2026-4159 | wc_PKCS7_DecodeEnvelopedData 1 byte out-of-bounds read | N/A | | | |
| CVE-2026-4395 | Heap-based buffer overflow in wc_ecc_import_x963_ex KCAPI path | N/A | | | |
| CVE-2026-4440 | Chromium: CVE-2026-4440 Out of bounds read and write in WebGL | N/A | | Edge - Chromium | |
| CVE-2026-4441 | Chromium: CVE-2026-4441 Use after free in Base | N/A | | Edge - Chromium | |
| CVE-2026-4442 | Chromium: CVE-2026-4442 Heap buffer overflow in CSS | N/A | | Edge - Chromium | |
| CVE-2026-4443 | Chromium: CVE-2026-4443 Heap buffer overflow in WebAudio | N/A | | Edge - Chromium | |
| CVE-2026-4444 | Chromium: CVE-2026-4444 Stack buffer overflow in WebRTC | N/A | | Edge - Chromium | |
| CVE-2026-4445 | Chromium: CVE-2026-4445 Use after free in WebRTC | N/A | | Edge - Chromium | |
| CVE-2026-4446 | Chromium: CVE-2026-4446 Use after free in WebRTC | N/A | | Edge - Chromium | |
| CVE-2026-4447 | Chromium: CVE-2026-4447 Inappropriate implementation in V8 | N/A | | Edge - Chromium | |
| CVE-2026-4448 | Chromium: CVE-2026-4448 Heap buffer overflow in ANGLE | N/A | | Edge - Chromium | |
| CVE-2026-4449 | Chromium: CVE-2026-4449 Use after free in Blink | N/A | | Edge - Chromium | |
| CVE-2026-4451 | Chromium: CVE-2026-4451 Insufficient validation of untrusted input in Navigation | N/A | | Edge - Chromium | |
| CVE-2026-4452 | Chromium: CVE-2026-4452 Integer overflow in ANGLE | N/A | | Edge - Chromium | |
| CVE-2026-4453 | Chromium: CVE-2026-4453 Integer overflow in Dawn | N/A | | Edge - Chromium | |
| CVE-2026-4454 | Chromium: CVE-2026-4454 Use after free in Network | N/A | | Edge - Chromium | |
| CVE-2026-4455 | Chromium: CVE-2026-4455 Heap buffer overflow in PDFium | N/A | | Edge - Chromium | |
| CVE-2026-4456 | Chromium: CVE-2026-4456 Use after free in Digital Credentials API | N/A | | Edge - Chromium | |
| CVE-2026-4457 | Chromium: CVE-2026-4457 Type Confusion in V8 | N/A | | Edge - Chromium | |
| CVE-2026-4458 | Chromium: CVE-2026-4458 Use after free in Extensions | N/A | | Edge - Chromium | |
| CVE-2026-4459 | Chromium: CVE-2026-4459 Out of bounds read and write in WebAudio | N/A | | Edge - Chromium | |
| CVE-2026-4460 | Chromium: CVE-2026-4460 Out of bounds read in Skia | N/A | | Edge - Chromium | |
| CVE-2026-4461 | Chromium: CVE-2026-4461 Inappropriate implementation in V8 | N/A | | Edge - Chromium | |
| CVE-2026-4462 | Chromium: CVE-2026-4462 Out of bounds read in Blink | N/A | | Edge - Chromium | |
| CVE-2026-4463 | Chromium: CVE-2026-4463 Heap buffer overflow in WebRTC | N/A | | Edge - Chromium | |
| CVE-2026-4464 | Chromium: CVE-2026-4464 Integer overflow in ANGLE | N/A | | Edge - Chromium | |
| CVE-2026-4519 | webbrowser.open() allows leading dashes in URLs | N/A | | | |
| CVE-2026-4673 | Chromium: CVE-2026-4673 Heap buffer overflow in WebAudio | N/A | | Edge - Chromium | |
| CVE-2026-4674 | Chromium: CVE-2026-4674 Out of bounds read in CSS | N/A | | Edge - Chromium | |
| CVE-2026-4675 | Chromium: CVE-2026-4675 Heap buffer overflow in WebGL | N/A | | Edge - Chromium | |
| CVE-2026-4676 | Chromium: CVE-2026-4676 Use after free in Dawn | N/A | | Edge - Chromium | |
| CVE-2026-4677 | Chromium: CVE-2026-4677 Out of bounds read in WebAudio | N/A | | Edge - Chromium | |
| CVE-2026-4678 | Chromium: CVE-2026-4678 Use after free in WebGPU | N/A | | Edge - Chromium | |
| CVE-2026-4679 | Chromium: CVE-2026-4679 Integer overflow in Fonts | N/A | | Edge - Chromium | |
| CVE-2026-4680 | Chromium: CVE-2026-4680 Use after free in FedCM | N/A | | Edge - Chromium | |
| CVE-2026-4732 | Out-of-bounds Read Overflow in tildearrow/furnace | N/A | | | |
| CVE-2026-4739 | Integer overflow vulnerabilities in InsightSoftwareConsortium/ITK | N/A | | | |
| CVE-2026-4746 | Heap Buffer Over-Write Vulenrabilty in timeplus-io/proton | N/A | | | |