Threat database

CVE-2026-34892 is a missing authorization vulnerability in Rank Math SEO versions prior to 1.0.271.1. It allows exploitation due to incorrectly configured access control security levels, potentially leading to unauthorized modification of data. The vulnerability has a medium severity rating with a CVSS score of 6.5. A fixed version 1.0.271.1 is available to address this issue.

SQLite versions before 3.53.2 contain memory corruption vulnerabilities in the FTS5 full-text search extension. These flaws allow attackers to cause process crashes, memory exhaustion, or potentially execute arbitrary code by supplying a crafted database with malformed FTS5 page data. The vulnerabilities involve an out-of-bounds read and a heap buffer overflow triggered during FTS5 MATCH queries against malicious databases. Fixed versions are available in Ubuntu package updates.

.NET 8.0 for Red Hat Enterprise Linux has received an important security update addressing two denial of service vulnerabilities. One vulnerability (CVE-2026-34043) involves the serialize-javascript component, where specially crafted array-like objects can cause a denial of service. The other (CVE-2026-42899) is an infinite loop in the .NET runtime that can also cause denial of service. Updated versions .NET SDK 8.0.127 and .NET Runtime 8.0.27 are available to fix these issues.

CVE-2026-10722 is an integer overflow vulnerability in the cilium ebpf LoadCollectionSpec/LoadCollectionSpecFromReader btf.go loadRawSpec component. The vulnerability affects Microsoft product version 3.0. No CVSS score or detailed impact information is provided in the available data.

CVE-2026-39828 is a vulnerability involving the bypass of certificate restrictions in the golang.org/x/crypto/ssh package. The information provided is limited and does not include details on the impact, exploitation, or remediation status. The affected version explicitly stated is version 3.0.

A vulnerability identified as CVE-2026-39834 involves invoking an infinite loop when performing large channel writes in the golang.org/x/crypto/ssh package, specifically affecting version 3.0. The issue was published on May 27, 2026. No CVSS score or detailed impact information is provided.

A vulnerability identified as CVE-2026-39835 involves invoking a server panic during the CheckHostKey/Authenticate process in the golang.org/x/crypto/ssh package. The affected version is 3.0. No CVSS score or detailed impact information is provided.

A vulnerability in golang.org/x/crypto/ssh version 3.0 allows invoking a memory leak when rejecting channels, which can lead to a denial of service (DoS). This issue is identified as CVE-2026-39827 and is associated with CWE-924. No patch or fix information is currently provided.

CVE-2026-39831 is a vulnerability involving the bypass of physical interaction requirements for FIDO/U2F security keys in the golang.org/x/crypto/ssh package. The advisory references Microsoft but provides no detailed technical or impact information. The affected version is exactly 3.0. No CVSS score or exploit details are available.

A vulnerability in golang.org/x/crypto/ssh version 3.0 causes an underflow and panic when invoking byte arithmetic. This issue may lead to unexpected application crashes.

A vulnerability in golang.org/x/crypto/ssh version 3.0 can cause a server deadlock when the client sends unexpected responses. This issue may impact server availability by causing it to become unresponsive.

A vulnerability identified as CVE-2026-39829 exists in golang.org/x/crypto/ssh where invoking pathological RSA/DSA parameters may cause a denial of service (DoS). The advisory references Microsoft Security Response Center but does not provide detailed technical or remediation information. The affected version explicitly stated is version 3.0. No CVSS score or exploit in the wild is reported.

A vulnerability exists in golang.org/x/net/html related to incorrect handling of character references in DOCTYPE nodes. This issue is identified as CVE-2026-25681 and affects version 3.0 of the product. No CVSS score or detailed impact information is provided, and there is no indication of active exploitation or available patches.

A vulnerability identified as CVE-2026-27136 exists in the golang.org/x/net/html package version 3.0, where invoking duplicate attributes can lead to cross-site scripting (XSS). The issue was published on May 27, 2026. No CVSS score or detailed impact information is provided.

A vulnerability identified as CVE-2026-42502 involves incorrect handling of HTML elements in foreign content within the golang.org/x/net/html package. The issue is associated with Microsoft and affects version 3.0 of the product. No detailed technical or impact information is provided beyond the identification of the flaw.

CVE-2026-39824 is a vulnerability involving an integer overflow in the NewNTUnicodeString function within the golang.org/x/sys/windows package. The issue is identified as CWE-190, which relates to integer overflow or wraparound. The affected version is exactly version 3.0. No CVSS score or detailed impact information is provided, and no known exploits or patches are currently documented.

A denial of service vulnerability exists in golang.org/x/net/html version 3.0 when parsing arbitrary HTML. This flaw could allow an attacker to cause a denial of service by triggering excessive resource consumption during HTML parsing.

A vulnerability exists in golang.org/x/net/html related to incorrect handling of namespaced elements in foreign content. This issue affects version 3.0 of the product. No CVSS score or detailed impact information is provided.