2026

A stack-based buffer overflow in the _RdbLoadEntity function of the RDB graph decoders (src/serializers/decoders/*/decod

A heap-based out-of-bounds read in the BufferSerializerIOv2_ReadBuffer function (src/serializers/serializer_io.c) in Fal

A double free and use-after-free vulnerability in the RdbLoadDeletedNodes function of the RDB graph decoders (src/serial

OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation re

A flaw was found in the login theme rendering component of Keycloak. The issue occurs because the security filter respon

OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked job-held-on-cr

OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces

OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handling of cups

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because

Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted

A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not

Improper certificate validation in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a

Authorization bypass through user-controlled key in Microsoft Bookings allows an unauthorized attacker to elevate privil

When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset u

Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and

Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a mal

Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit

When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connecti

Deserialization of untrusted data in Microsoft Dataverse allows an unauthorized attacker to execute code over a network.

Missing authorization in Azure Event Grid allows an authorized attacker to perform spoofing over a network.

Exposure of sensitive information to an unauthorized actor in Azure API Center allows an unauthorized attacker to disclo

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams

When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) c

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cann

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.T

Missing authentication for critical function in Azure App Service allows an unauthorized attacker to execute code over a

Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network.

When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the co

On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation ca

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, src/SelectionTranslate.cpp embeds selected or pas

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, ChmFile::GetCharZ() narrows file-controlled unsig

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, and in pre-release 3.7.0.20369 when WebView2 is a

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, MaybeFlipBitmap() asks GDI+ to read the attacker-

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, InitializePolicies() starts the sumatrapdfrestric

SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, an attacker-controlled SyncTeX source filename is

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, FrameOnCommand() handles CmdExec by passing a nul

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, untrusted document paths and PDF link targets are

SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, four independently reachable range-validation variants

SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, LitParseHeader() in src/LitDoc.cpp computes the attacke

SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, src/MobiDoc.cpp narrows the untrusted unsigned mobiHdr.

Strawberry GraphQL is a library for creating GraphQL APIs. From 0.217.0 until 0.326.1, PermissionExtension.resolve() on

Strawberry GraphQL is a library for creating GraphQL APIs. From 0.312.3 until 0.327.2, the legacy graphql-ws subscriptio

A flaw was found in Eye of GNOME (eog). A heap-based buffer overflow exists in the PNG metadata reader due to improper s

TP-Link Tapo C325WB V2 generates the pre-shared key used by its local media streaming service with a time-seeded pseudo-

An unauthenticated denial-of-service vulnerability exists in Tapo C325WB v2 in the RTSP streaming service on TCP port 55

TP-Link Tapo C325WB V2 contains an unauthenticated authorization bypass vulnerability in the HTTPS JSON API dispatcher o

A flaw was found in ansible-core. When installing a collection with `ansible-galaxy collection install`, the archive ext

IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a local attacker to obtain sensitive information due to cl

IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to obtain sensitive information due to u