🚨 CVE-2026-77176
A flaw was found in Kata Containers. In configurations utilizing genpolicy for Confidential Containers guest protection, a malicious host operator can exploit insufficient validation of CreateContainer mount and storage rules. This allows them to mount arbitrary container-rootfs paths over sensitive host locations or provision arbitrary content, potentially exposing confidential information or enabling the acceptance of attacker-controlled input.
🎖@cveNotify
A flaw was found in Kata Containers. In configurations utilizing genpolicy for Confidential Containers guest protection, a malicious host operator can exploit insufficient validation of CreateContainer mount and storage rules. This allows them to mount arbitrary container-rootfs paths over sensitive host locations or provision arbitrary content, potentially exposing confidential information or enabling the acceptance of attacker-controlled input.
🎖@cveNotify
Redhat
CVE-2026-77176 - Red Hat Customer Portal
CVE Details App
🚨 CVE-2026-75752
Substance3D - Painter is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
🎖@cveNotify
Substance3D - Painter is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
🎖@cveNotify
Adobe
Adobe Security Bulletin
Security updates available for Adobe Substance 3D - Painter | APSB26-129
🚨 CVE-2026-39113
Buffer Overflow vulnerability in SQLite affected version source snapshots/builds containing Fossil check-in 8bdc0d485e3ad0c7a1e818da66f106951d496b05cbe61d12c2c448f2f24b6d5d (Git mirror 169f68ed88b34cb68f720191c64c058f2ccec508, 2026-03-11) and later snapshots/builds allows an attacker to cause a denial of service via the ext/misc/sqlar.c, sqlarUncompressFunc(), sqlar_uncompress(), sqlite3_value_int64(), sqlite3_malloc(int), uncompress() components
🎖@cveNotify
Buffer Overflow vulnerability in SQLite affected version source snapshots/builds containing Fossil check-in 8bdc0d485e3ad0c7a1e818da66f106951d496b05cbe61d12c2c448f2f24b6d5d (Git mirror 169f68ed88b34cb68f720191c64c058f2ccec508, 2026-03-11) and later snapshots/builds allows an attacker to cause a denial of service via the ext/misc/sqlar.c, sqlarUncompressFunc(), sqlar_uncompress(), sqlite3_value_int64(), sqlite3_malloc(int), uncompress() components
🎖@cveNotify
GitHub
GitHub - 20000419/CVE-2026-39113: CVE-2026-39113: SQLite SQLAR heap-buffer-overflow advisory and reproducer
CVE-2026-39113: SQLite SQLAR heap-buffer-overflow advisory and reproducer - 20000419/CVE-2026-39113
🚨 CVE-2026-52489
Buffer Overflow vulnerability in gpac 31becc9e08b88e525a4a62013a4000de1c0f8fd9 allows an attacker to execute arbitrary code via the svgNameToImplementationName() function
🎖@cveNotify
Buffer Overflow vulnerability in gpac 31becc9e08b88e525a4a62013a4000de1c0f8fd9 allows an attacker to execute arbitrary code via the svgNameToImplementationName() function
🎖@cveNotify
Gist
CVE-2026-52489.txt
GitHub Gist: instantly share code, notes, and snippets.
🚨 CVE-2026-52491
An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the libtiff/tools/thumbnail.c: main() component
🎖@cveNotify
An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the libtiff/tools/thumbnail.c: main() component
🎖@cveNotify
Gist
CVE-2026-52491.txt
GitHub Gist: instantly share code, notes, and snippets.
🚨 CVE-2026-75421
aria2 <=1.37.0 has a stack-buffer-underflow vulnerability in the IOFile::getLine() function.
🎖@cveNotify
aria2 <=1.37.0 has a stack-buffer-underflow vulnerability in the IOFile::getLine() function.
🎖@cveNotify
GitHub
Stack-buffer-underflow in aria2::IOFile::getLine · Issue #2375 · aria2/aria2
Hi, I found a stack-buffer-underflow in function aria2::IOFile::getLine Steps to Reproduce: export CFLAGS="-g -O0 -fsanitize=address" CXXFLAGS="-g -O0 -fsanitize=address" cd ari...
🚨 CVE-2026-75465
The /api.php/user/get_list endpoint in Maccms v10 v2026.1000.4055 is vulnerable to an Incorrect Access Control issue. The interface fails to perform any authentication or authorization checks. An unauthenticated remote attacker can send a crafted HTTP GET request with limit and offset parameters to paginate and retrieve sensitive information of all registered users.
🎖@cveNotify
The /api.php/user/get_list endpoint in Maccms v10 v2026.1000.4055 is vulnerable to an Incorrect Access Control issue. The interface fails to perform any authentication or authorization checks. An unauthenticated remote attacker can send a crafted HTTP GET request with limit and offset parameters to paginate and retrieve sensitive information of all registered users.
🎖@cveNotify
GitHub
Release v2026.1000.4055 · magicblack/maccms10
maccms10 更新至 v2026.1000.4055：
1，新增插件市场与在线安装：RS256签名验签、SSRF出站防护、ZipSlip双重校验及多语言i18n。
2，新增社交功能：关注/粉丝、动态流、内容分享与私信，并配套社交模板。
3，新增PWA与Web Push推送：订阅SSRF白名单、CSRF与限流配额、异步广播队列及站内消息中心。
4，新增用户优惠券、限时秒杀与积分金币商城前端...
1，新增插件市场与在线安装：RS256签名验签、SSRF出站防护、ZipSlip双重校验及多语言i18n。
2，新增社交功能：关注/粉丝、动态流、内容分享与私信，并配套社交模板。
3，新增PWA与Web Push推送：订阅SSRF白名单、CSRF与限流配额、异步广播队列及站内消息中心。
4，新增用户优惠券、限时秒杀与积分金币商城前端...
🚨 CVE-2026-78898
Incorrect authorization in Downloads in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
🎖@cveNotify
Incorrect authorization in Downloads in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
🎖@cveNotify
Chrome Releases
Stable Channel Update for Desktop
The Chrome team is delighted to announce the promotion of Chrome 152 to the stable channel for Windows, Mac and Linux. This will roll out ov...
🚨 CVE-2026-78941
Information leak in Core in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
🎖@cveNotify
Information leak in Core in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
🎖@cveNotify
Chrome Releases
Stable Channel Update for Desktop
The Chrome team is delighted to announce the promotion of Chrome 152 to the stable channel for Windows, Mac and Linux. This will roll out ov...
🚨 CVE-2026-78974
UI misrepresentation in Linux Toolkit Theming in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
🎖@cveNotify
UI misrepresentation in Linux Toolkit Theming in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
🎖@cveNotify
Chrome Releases
Stable Channel Update for Desktop
The Chrome team is delighted to announce the promotion of Chrome 152 to the stable channel for Windows, Mac and Linux. This will roll out ov...
🚨 CVE-2026-79025
Improper input validation in Workers in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
🎖@cveNotify
Improper input validation in Workers in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
🎖@cveNotify
Chrome Releases
Stable Channel Update for Desktop
The Chrome team is delighted to announce the promotion of Chrome 152 to the stable channel for Windows, Mac and Linux. This will roll out ov...
🚨 CVE-2026-79088
Incorrect authorization in FileSystem in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
🎖@cveNotify
Incorrect authorization in FileSystem in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
🎖@cveNotify
Chrome Releases
Stable Channel Update for Desktop
The Chrome team is delighted to announce the promotion of Chrome 152 to the stable channel for Windows, Mac and Linux. This will roll out ov...
🚨 CVE-2026-79186
Incorrect authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
🎖@cveNotify
Incorrect authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
🎖@cveNotify
Chrome Releases
Stable Channel Update for Desktop
The Chrome team is delighted to announce the promotion of Chrome 152 to the stable channel for Windows, Mac and Linux. This will roll out ov...
🚨 CVE-2026-79289
Improper control of a resource through its lifetime in Workers in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Low)
🎖@cveNotify
Improper control of a resource through its lifetime in Workers in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Low)
🎖@cveNotify
Chrome Releases
Stable Channel Update for Desktop
The Chrome team is delighted to announce the promotion of Chrome 152 to the stable channel for Windows, Mac and Linux. This will roll out ov...
🚨 CVE-2026-38467
A SQL injection vulnerability in the tags manager in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users with users_mod privileges to execute arbitrary SQL commands via the tagid or type parameter in a crafted POST request to tools.php?action=manage_tags.
🎖@cveNotify
A SQL injection vulnerability in the tags manager in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users with users_mod privileges to execute arbitrary SQL commands via the tagid or type parameter in a crafted POST request to tools.php?action=manage_tags.
🎖@cveNotify
GitHub
GazellePW/sections/tools/managers/manage_tags.php at 86c4bedf727691b5a97af42a4864869d18446449 · Mosasauroidea/GazellePW
Movie-based Gazelle. Contribute to Mosasauroidea/GazellePW development by creating an account on GitHub.
🚨 CVE-2026-38474
GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 suffers from a Broken access control vulnerability in the IP lock manager, which allows remote authenticated users to add, modify, or delete IP lock entries for arbitrary accounts via tools.php?action=iplock.
🎖@cveNotify
GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 suffers from a Broken access control vulnerability in the IP lock manager, which allows remote authenticated users to add, modify, or delete IP lock entries for arbitrary accounts via tools.php?action=iplock.
🎖@cveNotify
GitHub
GazellePW/classes/iplock.class.php at 86c4bedf727691b5a97af42a4864869d18446449 · Mosasauroidea/GazellePW
Movie-based Gazelle. Contribute to Mosasauroidea/GazellePW development by creating an account on GitHub.
🚨 CVE-2026-30064
Improper input validation in the buildFilter function (processor/processor.go) of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.
🎖@cveNotify
Improper input validation in the buildFilter function (processor/processor.go) of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.
🎖@cveNotify
GitHub
[Bugs] OAuth2 Token Endpoint Panic via Unmatched Form Key · Issue #770 · free5gc/free5gc
Bug Description A DoS vulnerability exists in the OAuth2 token handling logic when processing POST requests on the /oauth2/token endpoint. The handler iterates through all key-value pairs from the ...
🚨 CVE-2026-30068
Improper input validation in the HandleUpdate function (/sbi/parameter_provision.go) of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.
🎖@cveNotify
Improper input validation in the HandleUpdate function (/sbi/parameter_provision.go) of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.
🎖@cveNotify
GitHub
[Bugs] UDM HandleUpdate Improper Validation of Input Size Leads to Uncontrolled Resource Consumption · Issue #765 · free5gc/free5gc
Bug Description The UDM parameter provisioning endpoint crashes when processing oversized request bodies. The HandleUpdate function in udm/internal/sbi/parameter_provision.go reads the entire reque...
🚨 CVE-2026-30069
A NULL pointer dereference in the UDMC registration handler component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via supplying crafted payload.
🎖@cveNotify
A NULL pointer dereference in the UDMC registration handler component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via supplying crafted payload.
🎖@cveNotify
GitHub
[Bugs] UDM RegistrationAmf3gppAccessProcedure panics on incomplete Amf3GppAccessRegistration · Issue #761 · free5gc/free5gc
Bug Description Nil pointer dereference in the UDMC registration handler for 3GPP access. The RegistrationAmf3gppAccessProcedure function assumes required nested fields are present in the Amf3GppAc...
🚨 CVE-2026-30070
An issue in the HandleGetSharedData function of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.
🎖@cveNotify
An issue in the HandleGetSharedData function of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.
🎖@cveNotify
GitHub
[Bugs] UDM SDM HandleGetSharedData panics on missing 'supported-features' query parameter · Issue #762 · free5gc/free5gc
Bug Description HandleGetSharedData panics when the 'supported-features' query parameter is omitted. The function assumes supportedFeatures has at least one element and accesses supportedFe...
🚨 CVE-2026-30072
A NULL pointer dereference in the CDR processing path of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via supplying crafted payload.
🎖@cveNotify
A NULL pointer dereference in the CDR processing path of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via supplying crafted payload.
🎖@cveNotify
GitHub
[Bugs] CHF OpenCDR panics on missing pduSessionInformation · Issue #759 · free5gc/free5gc
Bug Description Nil pointer dereference in the CDR processing path causes a crash when required nested fields are missing. In internal/sbi/processor/cdr.go, the OpenCDR function assumes pDUSessionC...