CVE-2026-40510 OpenSC < 0.27.0-rc1 Stack Buffer Overflow via piv_process_history() in card-piv.c
Information published.
EPSS 0.00 CVE-2026-40510 OpenSC US
Výsledky hledání
3
CVE-2026-40528 OpenSC < 0.27.0 Buffer Overrun in do_key_value() via profile.c
Information published.
EPSS 0.00 CVE-2026-40528 OpenSC US
CVE-2026-21711 A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them. As a result, code running under `--permission` without `--allow-net` can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary. This vulnerability affects Node.js **25.x** processes using the Permission Model where `--allow-net` is intentionally omitted to restrict network access. Note that `--allow-net` is currently an experimental feature.
Information published.
EPSS 0.00 CVE-2026-21711 Node.js US
1
CVE-2026-41184 ServiceAccount token disclosure via install-cni container logs
Information published.
EPSS 0.01 CVE-2026-41184 US
6
CVE-2026-47294 Microsoft SharePoint Server Remote Code Execution Vulnerability
Improper neutralization of special elements used in an os command ('os command injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
EPSS 0.01 CVSS 8.0 CVE-2026-47294 Microsoft US
CVE-2026-9538 Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header
Information published.
EPSS 0.00 CVE-2026-9538 Archive::Tar US
CVE-2026-42497 Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory
Information published.
EPSS 0.00 CVE-2026-42497 US
CVE-2026-42496 Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory
Information published.
EPSS 0.00 CVE-2026-42496 US
CVE-2026-46108 ipmi:si: Return state to normal if message allocation fails
Information published.
EPSS 0.00 CVE-2026-46108 US
CVE-2026-42250 Off-by-One Leading to Out-of-Bounds Write in bzip2
Information published.
EPSS 0.00 CVE-2026-42250 bzip2 US PL 2 zdrojů
8
CVE-2026-46023 dm mirror: fix integer overflow in create_dirty_log()
Information published.
EPSS 0.00 CVE-2026-46023 US
CVE-2026-46044 ipmi:ssif: Clean up kthread on errors
Information published.
EPSS 0.00 CVE-2026-46044 US
CVE-2026-47104 libusb < 1.0.30 Out-of-Bounds Read in parse_iad_array()
Information published.
EPSS 0.00 CVE-2026-47104 libusb US
CVE-2026-23679 libusb < 1.0.30 NULL Pointer Dereference in parse_interface()
Information published.
EPSS 0.00 CVE-2026-23679 libusb US
CVE-2026-44899 Mistune Image Directive CSS Injection Vulnerability
Information published.
EPSS 0.00 CVE-2026-44899 Mistune US
CVE-2026-44898 Mistune TOC Anchor Injection XSS
Information published.
EPSS 0.00 CVE-2026-44898 Mistune US
CVE-2026-44897 Mistune Heading ID Attribute Injection XSS
Information published.
EPSS 0.00 CVE-2026-44897 Mistune US
CVE-2026-44708 Mistune Math Plugin XSS Escape Bypass
Information published.
EPSS 0.00 CVE-2026-44708 US
27
CVE-2026-5222 Cargo can be coerced to share credentials between registries
Information published.
EPSS 0.00 CVE-2026-5222 US
CVE-2026-5223 Crates in third party registries can override the cached source of other crates
Information published.
EPSS 0.00 CVE-2026-5223 US
CVE-2026-8466 Unbounded buffer accumulation in multipart header parsing causes denial of service in cowboy
Information published.
EPSS 0.00 CVE-2026-8466 cowboy US
CVE-2026-6402 webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins
Information published.
EPSS 0.00 CVE-2026-6402 webpack US
CVE-2026-9256 NGINX ngx_http_rewrite_module vulnerability
Information published.
EPSS 0.11 CVE-2026-9256 NGINX US
CVE-2026-42508 Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts
Information published.
EPSS 0.07 CVE-2026-42508 US
CVE-2026-39833 Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent
Information published.
EPSS 0.00 CVE-2026-39833 US
CVE-2026-46595 Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
Information published.
EPSS 0.01 CVE-2026-46595 US
CVE-2026-46598 Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent
Information published.
EPSS 0.00 CVE-2026-46598 US
CVE-2026-39832 Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent
Information published.
EPSS 0.01 CVE-2026-39832 US
CVE-2026-39828 Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh
Information published.
EPSS 0.00 CVE-2026-39828 US
CVE-2026-39834 Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh
Information published.
EPSS 0.01 CVE-2026-39834 US
CVE-2026-39835 Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh
Information published.
EPSS 0.01 CVE-2026-39835 US
CVE-2026-39827 Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh
Information published.
EPSS 0.00 CVE-2026-39827 US
CVE-2026-39831 Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh
Information published.
EPSS 0.00 CVE-2026-39831 golang.org US
CVE-2026-46597 Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh
Information published.
EPSS 0.00 CVE-2026-46597 golang US
CVE-2026-39830 Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh
Information published.
EPSS 0.01 CVE-2026-39830 US
CVE-2026-39829 Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh
Information published.
EPSS 0.00 CVE-2026-39829 US
CVE-2026-25681 Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
Information published.
EPSS 0.00 CVE-2026-25681 US
CVE-2026-27136 Invoking duplicate attributes can cause XSS in golang.org/x/net/html
Information published.
EPSS 0.00 CVE-2026-27136 US
CVE-2026-42502 Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
Information published.
EPSS 0.00 CVE-2026-42502 US
CVE-2026-39824 Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows
Information published.
EPSS 0.00 CVE-2026-39824 US
CVE-2026-25680 Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
Information published.
EPSS 0.00 CVE-2026-25680 US
CVE-2026-42506 Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
Information published.
EPSS 0.00 CVE-2026-42506 US
CVE-2026-39821 Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
Information published.
EPSS 0.01 CVE-2026-39821 US
CVE-2026-8376 Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds
Information published.
EPSS 0.00 CVE-2026-8376 US
CVE-2026-41401 libyang - Heap Use-After-Free Write in XML Metadata Parsing
Information published.
EPSS 0.01 CVE-2026-41401 libyang US
10
CVE-2025-14575 Uncontrolled Search Path Element in Qt Network OpenSSL TLS backend allows rogue CA certificate loading
Information published.
EPSS 0.00 CVE-2025-14575 Qt US
CVE-2026-8723 qs.stringify crashes on null/undefined entries in comma-format arrays under encodeValuesOnly
Information published.
EPSS 0.00 CVE-2026-8723 US
CVE-2026-8711 NGINX JavaScript vulnerability
Information published.
EPSS 0.10 CVE-2026-8711 NGINX US
CVE-2026-41054 Missing exit out of permission check in haveged could lead to root exploit
Information published.
EPSS 0.00 CVE-2026-41054 US
CVE-2026-5950 Unbounded resend loop in BIND 9 resolver
Information published.
EPSS 0.01 CVE-2026-5950 BIND US
CVE-2026-5947 SIG(0) validation during query flood may lead to undefined behavior
Information published.
EPSS 0.01 CVE-2026-5947 US
CVE-2026-5946 Invalid handling of CLASS != IN
Information published.
EPSS 0.02 CVE-2026-5946 US
CVE-2026-3593 Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS implementation
Information published.
EPSS 0.02 CVE-2026-3593 BIND US
CVE-2026-3592 Amplification vulnerabilities via self-pointed glue records
Information published.
EPSS 0.00 CVE-2026-3592 US
CVE-2026-3039 BIND 9 server memory exhaustion during GSS-API TKEY negotiation
Information published.
EPSS 0.01 CVE-2026-3039 BIND US
4
CVE-2026-23383 bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing
Information published.
EPSS 0.00 CVE-2026-23383 US
CVE-2026-43416 powerpc, perf: Check that current->mm is alive before getting user callchain
Information published.
EPSS 0.00 CVE-2026-43416 US
CVE-2025-38660 [ceph] parse_longname(): strrchr() expects NUL-terminated string
Information published.
EPSS 0.00 CVE-2025-38660 Ceph US
CVE-2026-31688 driver core: enforce device_lock for driver_match_device()
Information published.
1
CVE-2026-45659 Microsoft SharePoint Remote Code Execution Vulnerability
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
KEV ✓ EPSS 0.76 CVSS 8.8 CVE-2026-45659 Microsoft US