GitHub CLI (gh) versions prior to 2.97.0 contain a vulnerability where HTTP request URLs interpolate variable path components without percent encoding. This allows URL path metacharacters in attacker-controlled repository or resource values to cause the CLI to address a different API endpoint or resource than intended. The issue is fixed in version 2.97.0.
GitHub CLI (gh) versions prior to 2.97.0 have a vulnerability where multiple commands print externally controlled content without neutralizing terminal escape sequences. This allows an attacker who can influence that content to embed escape sequences that may be interpreted by the user's terminal, potentially causing cosmetic manipulation or, on some terminal emulators, command execution. The issue affects various commands beyond those addressed in a previous related vulnerability (CVE-2026-45803). The vulnerability is fixed in version 2.97.0.
GitHub CLI (gh) versions prior to 2.97.0 contain a vulnerability in the attestation verification process where user-supplied repository or workflow names are treated as regular expressions without escaping regex metacharacters. This allows an attacker to create lookalike repository or workflow names that bypass intended Sigstore attestation verification, potentially undermining supply chain verification in CI/CD pipelines. The issue is fixed in version 2.97.0.
OpenStack Ironic through version 38.0.0 contains a vulnerability where a project reader can craft a request to retrieve Portgroups assigned to Nodes owned or leased by other projects. This issue allows unauthorized information disclosure but does not impact integrity or availability. The CVSS score is 5.0, indicating a medium severity level.
A buffer overflow vulnerability exists in open62541 version 1.5.5 when the Local Discovery Server (LDS) is built with multicast discovery enabled via the MDNSD backend. An unauthenticated remote attacker can exploit this by sending a RegisterServer or RegisterServer2 request with many unique discoveryUrls, causing a denial of service.
A buffer overflow vulnerability exists in open62541 version 1.5.5 related to Discovery/LDS handling. This flaw allows a remote attacker to cause a denial of service condition. The vulnerability has a CVSS score of 7.5, indicating a medium severity level. The affected versions explicitly include 1.4.11.1-1build1, 1.4.18-1, and 1.4.11.1-1. There is no information about available patches or vendor advisories. No known exploits are reported in the wild.
A denial of service vulnerability exists in open62541 version 1.5.5 and earlier, exploitable via the UA_Client_getRemoteDataTypes component. This allows a remote attacker to cause service disruption without requiring authentication or user interaction.
PDM versions up to and including 2.26.9 automatically load project-local plugins from a .pdm-plugins directory during initialization. This behavior allows an attacker-controlled file in an untrusted repository checkout to execute arbitrary Python code with the privileges of the user running PDM. The vulnerability occurs because the load_plugins() function runs during Core.init() and adds the .pdm-plugins directory via site.addsitedir(), which processes .pth files and executes any import statements immediately. Even benign commands like 'pdm --version' trigger this code execution. The issue is fixed in version 2.27.0.
A vulnerability in Node.js HTTP/2 handling allows the function nghttp2_session_mem_send() to be called re-entrantly while nghttp2_session_mem_recv() is executing, leading to a heap-use-after-free condition. This affects Node.js versions 22.x, 24.x, and 26.x. The issue can cause a denial of service due to application crashes but does not impact confidentiality or integrity.
A vulnerability in Node.js node:sqlite allows a stale StatementSyncIterator created via DatabaseSync#createTagStore() to continue executing a cached prepared statement after it has been reset and rebound with new parameters. This occurs because SQLTagStore resets cached statements using sqlite3_reset() directly, bypassing the iterator invalidation mechanism introduced in recent releases. This flaw affects Node.js versions 22.x, 24.x, and 26.x. The vulnerability has a medium severity with a CVSS score of 5.3.
A vulnerability in Node.js affects the dns.resolveAny() function, causing the Node.js process to abort when a DNS response contains more than 256 A records. This can be repeatedly triggered to cause a denial of service. The issue impacts Node.js versions 22.x, 24.x, and 26.x.
A vulnerability in Node.js allows a spoofed TypedArray byteLength to trigger an assertion failure in synchronous node:zlib APIs, causing the process to crash. This affects all 11 synchronous zlib functions and can lead to denial of service through repeated exploitation. The flaw impacts Node.js versions 22.x, 24.x, and 26.x.
Bouncy Castle for Java versions before 1.85 have a vulnerability where the CMS verifySignatures method returns true even when SignedData contains zero signers. This affects multiple Bouncy Castle Java variants, including LTS and FIPS versions prior to specific releases. The issue could lead to improper signature verification results.
Bouncy Castle for Java versions before 1.85 contain a vulnerability in the OpenPGP CFB quick-check oracle on symmetric/session-key paths. This issue also affects Bouncy Castle for Java LTS versions before 2.73.12 and Bouncy Castle for Java FIPS versions before bcpg-fips 1.0.13, 2.0.13, and 2.1.13. The vulnerability has a CVSS score of 5.3, indicating medium severity. It allows an attacker to gain limited information about the symmetric/session keys used in OpenPGP operations. No known exploits are reported in the wild. The affected versions include several specific Ubuntu package versions listed in the input data.
Bouncy Castle for Java versions before 1.85 and certain LTS and FIPS versions improperly trust the signer-asserted signingTime during S/MIME path validation. This vulnerability could allow an attacker to influence signature validation by manipulating the signingTime attribute. The issue has a medium severity rating with a CVSS score of 5.3.
A vulnerability in Bouncy Castle for Java before version 1.85 causes the CMS AuthenticatedData content to not be bound to the MAC when authenticated attributes are present. This affects multiple Bouncy Castle Java versions including LTS and FIPS variants prior to specified fixed versions. The issue can lead to integrity violations of authenticated data.
Bouncy Castle for Java versions before 1.85 have a vulnerability where OpenPGP inline-signature policy failures are silently ignored. This affects both the standard and FIPS versions of Bouncy Castle for Java. The issue can lead to integrity violations without detection.
Bouncy Castle for Java versions before 1.85 contains a vulnerability in its MLS hash-ratchet implementation where it honors an arbitrary 32-bit generation counter from the sender. This flaw can lead to denial of service (DoS) conditions. The vulnerability has a CVSS score of 7.5, indicating a medium severity level. Multiple specific package versions of Bouncy Castle are affected. There is no explicit patch or remediation information provided in the source data.
Bouncy Castle for Java versions before 1.85 have a vulnerability in the OpenPGP user-attribute subpacket length handling, where the length is only bounded by the JVM maximum memory. This issue also affects certain LTS and FIPS versions prior to specified patch releases. The vulnerability can lead to denial of service due to resource exhaustion. The CVSS score is 7.5, indicating a medium severity impact primarily affecting availability.
Bouncy Castle for Java versions before 1.85 and LTS versions before 2.73.12 have a vulnerability in the BKS keystore where it accepts a legacy version using a weak 16-bit integrity MAC key. This weakness can lead to integrity compromise without affecting confidentiality or availability. The CVSS score is 7.5, indicating a medium severity vulnerability.