Vendor: microsoft

Apache Thrift: TSSLTransportFactory.java hostname verification

2026-05-05 CVE-2026-43869

Openvswitch: open vswitch: denial of service via malformed ftp epasv command

2026-05-05 CVE-2026-34956

Apache HTTP Server: http2: double free and possible RCE on early reset

2026-05-04 CVE-2026-23918

Apache HTTP Server: mod_auth_digest timing attack

2026-05-04 CVE-2026-33006

Apache HTTP Server: mod_dav_lock indirect lock crash

2026-05-04 CVE-2026-29169

Apache HTTP Server: mod_proxy_ajp: Heap Buffer Over-Read Due to Missing Null-Termination Check (ajp_msg_get_string)

2026-05-04 CVE-2026-34032

Apache HTTP Server: mod_proxy_ajp: Heap Over-Read and memory disclosure in ajp_parse_data()

2026-05-04 CVE-2026-34059

Apache HTTP Server: mod_rewrite elevation of privileges via ap_expr

2026-05-04 CVE-2026-24072

Apache HTTP Server: multiple modules: HTTP response splitting forwarding malicious status line

2026-05-04 CVE-2026-33523

Apache HTTP Server: Off-by-one OOB reads in AJP getter functions

2026-05-04 CVE-2026-33857

Gnutls: gnutls: policy bypass due to case-sensitive nameconstraints comparison

2026-05-04 CVE-2026-3833

Mariner

2026-05-04 CVE-2026-43964

lowMicrosoft MSRC 2026-W19

Missing input validation in the MP_REACH_NLRI component of FRRouting (FRR) stable/10.0 to stable/10.6 allows authenticated attackers to cause a Denial of Service (DoS) via supplying a crafted UPDATE message.

2026-05-04 CVE-2026-37458

Prometheus Azure AD remote write OAuth client secret exposed via config API

2026-05-04 CVE-2026-42151

Prometheus: remote read endpoint allows denial of service via crafted snappy payload

2026-05-04 CVE-2026-42154

io_uring/poll: fix multishot recv missing EOF on wakeup race

2026-05-02 CVE-2026-23473

Libssh: libssh: denial of service due to malformed sftp message

2026-05-01 CVE-2026-0968

lowMicrosoft MSRC 2026-W18

libssh2 userauth.c userauth_password integer overflow

2026-05-01 CVE-2026-7598

Mariner

2026-05-01 CVE-2026-37457

blktrace: fix __this_cpu_read/write in preemptible context

2026-04-27 CVE-2026-23374

ext4: avoid infinite loops caused by residual data

2026-04-27 CVE-2026-31448

ext4: publish jinode after initialization

2026-04-27 CVE-2026-31450

ipv6: add NULL checks for idev in SRv6 paths

2026-04-27 CVE-2026-23442

ksmbd: fix use-after-free of share_conf in compound request

2026-04-27 CVE-2026-23428

ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len()

2026-04-27 CVE-2026-31478

libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.

2026-04-27 CVE-2026-41080

media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex

2026-04-27 CVE-2026-31473

mtd: rawnand: serialize lock/unlock against other NAND operations

2026-04-27 CVE-2026-23434

nf_tables: nft_dynset: fix possible stateful expression memleak in error path

2026-04-27 CVE-2026-23399

pip self-update functionality can import newly installed modules after wheel installation

2026-04-27 CVE-2026-6357

xfs: avoid dereferencing log items after push callbacks

2026-04-27 CVE-2026-31453

lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files

2026-04-24 CVE-2026-41066

OpenPrinting CUPS: Heap out-of-bounds read in SNMP supply-level polling leaks stack memory to authenticated users

2026-04-24 CVE-2026-41079

Vim: Command injection via backtick expansion in tag filenames

2026-04-24 CVE-2026-41411

Libopensc: opensc: multiple uses of uninitialized variable

2026-04-23 CVE-2025-13763

Mariner

2026-04-23 CVE-2026-41989

Mariner

2026-04-22 CVE-2026-22004

Mariner

2026-04-22 CVE-2026-22009

Mariner

2026-04-22 CVE-2026-22017

RDMA/efa: Fix use of completion ctx after free

2026-04-22 CVE-2026-31493

s390/syscalls: Add spectre boundary for syscall dispatch table

2026-04-22 CVE-2026-31483

tracing: Fix potential deadlock in cpu hotplug with osnoise

2026-04-22 CVE-2026-31480

Mariner

2026-04-21 CVE-2026-21998

Mariner

2026-04-21 CVE-2026-22001

lowMicrosoft MSRC 2026-W17

Mariner

2026-04-21 CVE-2026-22002

Mariner

2026-04-21 CVE-2026-22005

Mariner

2026-04-21 CVE-2026-22015

scanf %mc off-by-one heap buffer overflow

2026-04-21 CVE-2026-5450

lowMicrosoft MSRC 2026-W17

pip doesn't reject concatenated ZIP and tar archives

2026-04-20 CVE-2026-3219

ALSA: usb-audio: Use correct version for UAC3 header validation

2026-04-18 CVE-2026-23318

apparmor: fix differential encoding verification

2026-04-18 CVE-2026-23409

apparmor: Fix double free of ns_name in aa_replace_profiles()

2026-04-18 CVE-2026-23408

apparmor: fix memory leak in verify_header

2026-04-18 CVE-2026-23403

mediumMicrosoft MSRC 2026-W16

apparmor: fix missing bounds check on DEFAULT table in verify_dfa()

2026-04-18 CVE-2026-23407

apparmor: fix race between freeing data and fs accessing it

2026-04-18 CVE-2026-23411

apparmor: fix race on rawdata dereference

2026-04-18 CVE-2026-23410

apparmor: fix side-effect bug in match_char() macro usage

2026-04-18 CVE-2026-23406