—CVE-2026-50195containerd: CRI checkpoint import allows local image tag poisoning
—CVE-2026-47262containerd image-triggered runtime DoS via unbounded group parsing
—In the Linux kernel, the following vulnerability has been resolved: bpf: Free reuseport cBPF prog after RCU grace period.
—In the Linux kernel, the following vulnerability has been resolved: ip6_vti: set netns_immutable on the fallback device.
—In the Linux kernel, the following vulnerability has been resolved: RDMA: During rereg_mr ensure that REREG_ACCESS is compatible If IB_MR_R…
HIGH8.8CedarJava has policy injection vulnerability
HIGH8.8CedarJava has type confusion vulnerability
MEDIUM5.8guzzlehttp/guzzle: Dot-Only Cookie Domains Match All Hosts
MEDIUM5.9guzzlehttp/guzzle: Silent HTTPS-Proxy Downgrade to Cleartext
MEDIUM5.3NL Portal Backend Libraries: Unauthenticated form resolver forwards the privileged Objecten-API token to a caller-supplied URL (SSRF)
HIGH8.3libssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds heap read vulnerability in the sftp_symlink() function in src/sf…
CRITICAL9.9Network-AI: Improper Neutralization of Special Elements used in an OS Command
CRITICAL9.1Network-AI: CVE-2026-46701 fix incomplete — empty default secret still authorizes all requests
MEDIUM6.5A path traversal in handling the "path" component of .repo files processed by libzypp before 17.38.13 in the 17.x series, or before 16.22.1…
MEDIUM6.1OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry.
MEDIUM5.4Coturn is a free open source implementation of TURN and STUN Server.
MEDIUM4.9libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation.
—OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry.
HIGH8.1Coturn is a free open source implementation of TURN and STUN Server.
—In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mi…
MEDIUM4.8guzzlehttp/psr7: CRLF Injection in HTTP Start-Line Serialization
MEDIUM5.3ts-deepmerge: Prototype Method Override leads to DoS
CRITICAL9.0HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allo…
MEDIUM5.3A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` frame.
LOW1.8A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation.