2026

music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the APEv2 parser reads an attacke

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.3.

Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic w

An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application

An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept certain over-precision inputs c

The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. Lat

The explicit decryption component of MongoDB libmongocrypt can return an unrecognized encrypted payload unchanged instea

An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte immediately past a

The MongoDB C++ Driver discards content after an embedded NUL byte in certain field and collection names accepted by the

An integer underflow in the KMS endpoint-parsing logic of MongoDB libmongocrypt can cause an allocation failure that ter

Improper certificate validation in gnutls v3.8.13 causes the application to accept certificates containing invalid exten

Improper certificate validation in gnutls v3.8.13 causes the application to reject legitimate certificates for valid use

QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminHotelRoomsBookingController::postProcess()

FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ff_rtsp_connect() in

FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows attackers to bypass protocol

FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTS

FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause den

savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer's isHrefSafeValue() validates an SVG href after

savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer allows a crafted SVG DTD with a #FIXED attribut

The Arkime live capture service (arkime-live) in Malcolm runs with network_mode: host, exposing port 8005 on all network

Malcolm's front nginx reverse proxy defines a "Dashboards → Arkime shortcut" location using a case-insensitive regex mat

Malcolm's upload-processing pipeline (scripts/safe-extract.py) enforces entry-count, nesting-depth, and total-uncompress

Malcolm's nginx Lua role-based access control (RBAC) layer decides whether an authenticated user may reach a role-restri

Insecure file permissions in the CodeCatalyst connection handler in AWS Toolkit for VS Code before 4.10.0 allowed local

A hostname verification bypass in GnuTLS v3.8.13 allows attackers to circumvent the Common Name fallback mechanism and e

The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and g

A policy-enforcement flaw in Zimbra Collaboration Suite allows an authenticated user to bypass disabled mail forwarding

An authorization bypass in the EWS FindItem handler of Zimbra Collaboration Suite 10.1.0 through 10.1.19 allows an authe

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, constructing msgpack5 with an empty

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder treats the re

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the array and map decoding paths ha

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder reparses an i

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.3.4 until 1.1

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 2.

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.3.4 until 1.1

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.

HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal durin

FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption

FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an

FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler th

FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper certificate validation vulnerability in tls_open() of liba

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.56.0 until 1.

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.

A kernel buffer overflow vulnerability in HP Sure Click versions prior to 4.4.33 may allow local privilege escalation or

libming through 0.4.8 contains a heap buffer overflow in r_readc() in src/blocks/fromswf.c. A crafted SWF file with a ma

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 throug

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 throug

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 throug

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 throug