CVE-2018-19591

glibc: file descriptor leak in if_nametoindex() in sysdeps/unix/sysv/linux/if_index.c

In the GNU C Library (aka glibc or libc6) through 2.28, attempting to resolve a crafted hostname via getaddrinfo() leads to the allocation of a socket descriptor that is not closed. This is related to the if_nametoindex() function.

CVSS 3.1 · 7.5 High EPSS 5.5% KEV · Not listed

Vendors

Fedoraproject Gnu

Products

Fedora Glibc

CVE-2018-12886

gcc: spilling of stack protection address in cfgexpand.c and function.c leads to stack-overflow protection bypass

stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction sequences when targeting ARM targets that spill the address of the stack protector guard, which allows an attacker to bypass the protection of -fstack-protector, -fstack-protector-all, -fstack-protector-strong, and -fstack-protector-explicit against stack overflow by controlling what the stack canary is compared against.

CVSS 3.0 · 8.1 High EPSS 2.7% KEV · Not listed

Vendors

Gnu

Products

Gcc

CVE-2018-0495

ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries

Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing process in the _gcry_ecc_ecdsa_sign function in cipher/ecc-ecdsa.c, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.

CVSS 3.0 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Gnupg and 2 more

Products

Ubuntu Linux Debian Linux Libgcrypt and 11 more

CVE-2016-10739

glibc: getaddrinfo should reject IP addresses with trailing characters

In the GNU C Library (aka glibc or libc6) through 2.28, the getaddrinfo function would successfully parse a string that contained an IPv4 address followed by whitespace and arbitrary characters, which could lead applications to incorrectly assume that it had parsed a valid string, without the possibility of embedded HTTP headers or other potentially dangerous substrings.

CVSS 3.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Gnu Opensuse Redhat

Products

Glibc Leap Ansible Tower and 1 more

CVE-2016-10228

glibc: iconv program can hang when invoked with the -c option

The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a denial of service.

CVSS 3.0 · 5.9 Medium EPSS 4.1% KEV · Not listed

Vendors

Gnu Redhat

Products

Glibc Enterprise Linux

CVE-2015-20107

python: mailcap: findmatch() function does not sanitize the second argument

In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9

CVSS 3.1 · 7.8 High EPSS 2.8% KEV · Not listed

Vendors

Fedoraproject Netapp Python and 1 more

Products

Fedora Active Iq Unified Manager Ontap Select Deploy Administration Utility and 4 more

CVE-2026-107825

OWASP Coraza WAF: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessURI in internal/corazawaf/transaction.go handles a url.ParseRequestURI failure by retaining the raw URI but leaving QUERY_STRING, ARGS_GET, ARGS_GET_NAMES, and the GET-derived portion of ARGS empty. An unauthenticated attacker can place control bytes in a URI passed directly by integrations such as coraza-spoa, coraza-proxy-wasm, custom FFI hosts, or WASM hosts, causing Coraza to omit query parameters that the downstream integration may still process and allowing rules targeting those variables to be bypassed. The bundled coraza/v3/http integration is not affected because Go net/http rejects such malformed request targets before calling Coraza. This issue is fixed in version 3.8.0.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed

Vendors

Coraza

Products

Coraza

CVE-2026-78021

Sensitive Information Exposure via Error Messages in Dell SCG Policy Manager

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Generation of Error Message Containing Sensitive Information vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure and Information exposure.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Dell

Products

Policy Manager For Secure Connect Gateway Secure Connect Gateway Policy Manager

CVE-2026-107399

Mechanize sends credential headers to another origin after a meta refresh

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in Mechanize::HTTP::Agent#response_follow_meta_refresh when Mechanize#follow_meta_refresh is enabled. A page containing a meta refresh to another origin causes headers configured through Mechanize#request_headers= to be reapplied to the refresh request, allowing an attacker who controls content in the crawl to capture bearer tokens or session cookies. The default configuration is not affected because follow_meta_refresh is false, and the exposure is limited to caller-supplied default headers. This issue is fixed in version 2.14.1.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Sparklemotion

Products

Mechanize

CVE-2026-107383

MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, the GeoJSON Polygon and MultiPolygon binary encoders size a Buffer.allocUnsafe() allocation from each ring's numeric length before confirming that the ring is an array. A malformed non-array ring can therefore reserve bytes that the writing loop skips, and the connector sends the full buffer through execute() or batch(), disclosing uninitialized Node.js heap data into a database value. The persisted data can include other users' content, session material, database credentials, or TLS key material and may propagate to backups and replicas. The text-protocol query() path is not affected. This issue is fixed in versions 3.2.5, 3.3.4, 3.4.7, and 3.5.4.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Mariadb

Products

Connector-nodejs

CVE-2026-48484

pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the API `rpc` function in `api_blueprint.py` handles `multipart/form-data` uploads by reading the whole content of the uploaded file into memory with `file.read()`. This occurs before the data is sent to the underlying function. Since there is no size limit set at this point, a large file upload can exhaust the server's available memory which led to process termination. Version 0.5.0b3.dev101 contains a patch.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Pyload

Products

Pyload

CVE-2026-109751

Information disclosure in the Networking component

Information disclosure in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-109767

Information disclosure in the Networking component

Information disclosure in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-85891

Azure HDInsight Information Disclosure Vulnerability

Exposure of sensitive information to an unauthorized actor in Azure HDInsight allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure Hdinsights

CVE-2026-109771

Information disclosure in the WebRTC: Networking component

Information disclosure in the WebRTC: Networking component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-109777

Information disclosure in the Storage: IndexedDB component

Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-109769

Information disclosure in the Networking: Cache component

Information disclosure in the Networking: Cache component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-107842

Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled

Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, ModuleSearch can disclose protected page titles, URLs, and indexed context snippets to unauthenticated visitors when contao.search.index_protected is changed from enabled to disabled. Authorization metadata is stored per row in tl_search, but disabling the setting removes the protected-row filter without deleting rows indexed while protection was enabled. The protected pages continue to return an authorization response, so this issue exposes search metadata and indexed text rather than bypassing page access. This issue is fixed in versions 5.3.50 and 5.7.12.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Contao

Products

Contao

CVE-2026-109709

Information disclosure, privilege escalation in the Security: Process Sandboxing component

Information disclosure, privilege escalation in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-88834

Busybox: busybox: httpd user existence oracle in non-default shadow-disabled builds

A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limited to username enumeration and requires non-default compile options or uncommon password file states; default BusyBox builds with shadow password support are not affected.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Busybox Redhat

Products

Busybox Hummingbird