Bouncy Castle for Java versions before 1.85 contain an LDAP filter injection vulnerability in the legacy jdk1.4 LDAPStoreHelper component. This vulnerability allows an attacker to inject malicious LDAP filter content, potentially leading to limited confidentiality and integrity impacts. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level. No official patch or remediation details are provided in the available data. The affected versions include specific Ubuntu package versions of Bouncy Castle Java library prior to 1.85.
Coturn versions from 4.5.2 through 4.14.0, when started with the --acme-redirect <URL> option and exposing a plaintext-TCP listener, allow an unauthenticated remote client to obtain a 301 HTTP response containing up to approximately 870 bytes of adjacent process heap memory. This leaked memory region may include sensitive data such as TURN credentials, OAuth tokens, and relayed payloads due to a signed-to-unsigned conversion error. The issue is resolved in version 4.15.0.
A vulnerability in Node.js affects the permission model enforcement, allowing the process.report feature to write or overwrite files outside the designated --allow-fs-write paths. This flaw can lead to confidentiality issues or bypass the intended security boundaries in affected configurations. The vulnerability impacts Node.js versions 22.x, 24.x, and 26.x. The CVSS score is 3.3, indicating a medium severity level.
CVE-2026-62268 is a medium severity vulnerability affecting multiple specific versions of BorgBackup. The exact nature and technical details of the vulnerability are not provided. There is no CVSS score or detailed description available, and no known exploits in the wild have been reported.
An integer overflow vulnerability exists in the UA_Variant arrayDimensions product computation in open62541. This flaw may allow a remote attacker to read out-of-bounds heap memory, potentially leading to sensitive information disclosure. The vulnerability affects specific versions of open62541. The CVSS score is 7.5, indicating a medium severity. No known exploits are reported in the wild. No patch or remediation details are provided in the input data.
CVE-2026-59878 is an improper input validation vulnerability in Apache ActiveMQ AMQP and Apache ActiveMQ. A remote unauthenticated attacker can send a crafted frame size value to an exposed AMQP NIO connector, causing NIO threads to die. Rapid exploitation can exhaust the NIO thread pool, resulting in denial-of-service (DoS) conditions. This affects versions before 5.19.9 and from 6.0.0 before 6.2.8. Fixed versions include 5.19.9, 6.2.8, and 6.3.0.
An improper authorization vulnerability exists in Apache ActiveMQ Broker and related distributions, allowing an authenticated low-privilege user to bypass per-destination write access controls. This occurs when sending messages to a temporary composite destination composed of multiple real queues, enabling unauthorized message publishing to any destination in the composite. The issue affects versions before 5.19.9 and from 6.0.0 before 6.2.8. Upgrading to versions 5.19.9, 6.2.8, or 6.3.0 resolves the vulnerability.
A vulnerability in the file-icns plugin of GIMP allows an out-of-bounds read when processing crafted ICNS image files with truncated mask resources. This flaw can lead to information disclosure of heap memory or cause a crash resulting in denial of service. The issue affects multiple specific versions of GIMP. The vulnerability has a CVSS score of 7.1, indicating a medium severity level.
Apache Thrift c_glib bindings contain an improper validation of certificates when there is a host mismatch. This vulnerability affects versions before 0.24.0. The issue allows an attacker to bypass proper certificate validation, potentially leading to man-in-the-middle attacks. Users are advised to upgrade to version 0.24.0, which addresses this vulnerability.
An improper validation of certificates with host mismatch vulnerability exists in Apache Thrift C++ bindings affecting versions before 0.24.0. This flaw allows an attacker to bypass host verification during TLS certificate validation. The issue is fixed in Apache Thrift version 0.24.0. The vulnerability has a CVSS 3.1 score of 7.5, indicating a medium severity level with high confidentiality impact but no integrity or availability impact.
An integer overflow or wraparound vulnerability exists in Apache Thrift bindings for C++, c_glib, Go, netstd, Delphi, and Haxe. This affects Apache Thrift versions before 0.24.0. The vulnerability can cause a denial of service due to application crashes. Users are advised to upgrade to version 0.24.0, which addresses the issue.
An out-of-bounds read vulnerability exists in the Apache Thrift c_glib bindings affecting versions before 0.24.0. This vulnerability has a high CVSS score of 9.1, indicating critical impact on confidentiality and availability. The issue is fixed in version 0.24.0, and users are advised to upgrade to this version to remediate the vulnerability.
A resource allocation vulnerability exists in Apache Thrift Rust bindings prior to version 0.24.0. This flaw allows allocation of resources without limits or throttling, potentially leading to denial of service. The issue is fixed in version 0.24.0, and users are advised to upgrade to this version to mitigate the risk.
An out-of-bounds read vulnerability exists in the Apache Thrift C++ bindings due to improper validation of specified quantity in input. This affects versions prior to 0.24.0. The vulnerability has a high CVSS score of 9.1, indicating critical impact on confidentiality and availability. Users are advised to upgrade to version 0.24.0, which addresses the issue.
OpenStack Ironic Python Agent versions through 11.5.0 contain a vulnerability where a malicious boot container deployed using ironic-python-agent may extract the credentials used to download it. This issue has a medium severity with a CVSS score of 5.5. The vulnerability requires local access with high attack complexity and user interaction, but can lead to a complete confidentiality breach of credentials. No patch or remediation details are provided in the input data.
A missing authorization vulnerability in SELinux policycoreutils seunshares allows a user running in an unconfined context to kill root-owned processes also running in an unconfined context. This issue affects policycoreutils through version 3.10. The vulnerability has a medium severity rating and does not have a confirmed CVSS score. No information about patches or vendor advisories is provided.
CVE-2026-49300 is a medium severity vulnerability affecting multiple specific versions of the mbedtls library. The exact nature and technical details of the vulnerability are unknown based on the provided information. There is no CVSS score or detailed description available. No known exploits are reported in the wild. The affected versions include a range of mbedtls releases primarily used in Ubuntu distributions. No patch or remediation information is provided, so the patch status is not confirmed.
CVE-2026-50579 is a medium severity vulnerability affecting multiple specific versions of the mbedtls library. The description and technical details of the vulnerability are unknown, and no CVSS score or exploit information is available. The affected versions are explicitly listed, but no patch or remediation information is provided.
CVE-2026-50580 is a medium severity vulnerability affecting multiple specific versions of the mbedtls library. The exact nature and technical details of the vulnerability are unknown as no description or CVSS score is provided. The affected versions include various releases from 2.1.2-1 through 3.6.7-3ubuntu1, primarily in Ubuntu distributions. There is no information about available patches or vendor advisories, and no known exploits in the wild have been reported.
CVE-2026-50581 is a medium severity vulnerability affecting multiple specific versions of the mbedtls library. The exact nature and technical details of the vulnerability are unknown based on the provided data. There is no CVSS score or detailed description available. No information about patches or vendor advisories is provided. No known exploits are reported in the wild. The affected versions include various specific releases of mbedtls, primarily in Ubuntu distributions.