Search: 5.1.8.3

FreeRDP version 3.32.0 contains a use-after-free vulnerability in the drdynvc component. This vulnerability can cause a denial of service by crashing the affected system. The issue has a CVSS score of 6.5, indicating a medium severity level. Multiple specific Ubuntu package versions of FreeRDP are affected.

Astral uv versions before 0.8.22 contain a path traversal vulnerability that allows unauthorized modification of data. This vulnerability has a CVSS score of 6.5, indicating a medium severity level. The affected versions include specific builds of version 0.9.17+ds1. There is no indication of public exploits or active exploitation in the wild. No patch or remediation details are provided in the available data.

Vyper versions 0.3.4 through 0.5.0b1 contain a vulnerability in the create_from_blueprint function where an unchecked uint256 subtraction can cause an integer wraparound. This allows an attacker controlling the code_offset parameter to deploy contracts with no runtime code, potentially trapping ETH and tokens.

Vyper versions 0.3.8 through 0.5.0b1 contain an optimizer miscompilation bug that causes certain ternary expressions involving bitwise OR operations with nonzero integer literals to be incorrectly compiled to the constant 1. This flaw leads to incorrect values being used in storage writes, arithmetic operations, indexes, return values, or events, potentially causing deposits to be recorded incorrectly and funds to be locked without warning or revert.

Vyper 0.3.8 through 0.5.0b1 contains a compiler miscompilation vulnerability in parse_IfExp that reads nested arrays with narrower inner bounds using the wider result type's memory layout. When a ternary selects the narrower array, inner arrays after the first are read at wrong offsets, causing contracts to silently store corrupted values or revert.

A use-after-free vulnerability exists in sharp versions before 0.35.5 due to a bundled librsvg dependency affected by CVE-2026-96889. This vulnerability can be triggered by processing a crafted SVG image, potentially leading to arbitrary code execution on glibc-based Linux systems. The issue is fixed in sharp version 0.35.5.

Trigger.dev versions before 4.5.0-rc.3 have a path traversal vulnerability in the api/v1/packets and api/v2/packets endpoints. Authenticated tenants can exploit this flaw by using unsanitized filename splat segments with '../' sequences to escape their object key prefix. This allows them to obtain presigned GET or PUT URLs and potentially read or overwrite other tenants' run payloads and outputs.

An information leak vulnerability exists in ANGLE component of Google Chrome on Windows versions prior to 156.0.8078.47. This flaw allows a remote attacker to leak sensitive information by convincing a user to visit a crafted HTML page. The vulnerability has a medium severity rating with a CVSS score of 6.5.

CVE-2026-114038 is a vulnerability in the device-mapper-multipath component of Red Hat Enterprise Linux 10. A local user can trigger an out-of-bounds read by sending a specially crafted command with a format string ending in a trailing percent character to the multipath daemon. This can lead to limited information disclosure or cause the daemon to crash, resulting in a denial of service. The vulnerability does not allow code execution or privilege escalation and affects unprivileged users via accessible query commands. The impact is moderate with a CVSS score of 5.1.

CVE-2026-113737 is a path traversal vulnerability in the R6410418 Jackrong-llm-finetuning-guide project affecting the validate_indexed_tensors function in the qwen_mtp_gguf_pipeline.py script. Manipulation of the weight_map argument can lead to path traversal, potentially exploitable remotely. The project uses a rolling release system, so specific affected or fixed versions are not disclosed. The vulnerability has a medium severity score of 5.1 and public exploit code is available. The vendor has been informed but has not yet responded or issued a fix.

CVE-2025-60490 is a heap use-after-free vulnerability in the gf_filter_pid_send_event_downstream function of GPAC Project/MP4Box before version 2.5. This flaw allows attackers to cause a denial of service (DoS) by supplying a specially crafted MP4 file. The issue is fixed in version 2.5.

CVE-2025-71438 is an out-of-bounds read vulnerability in the GPAC Project's MP4Box component prior to version 26.07.0. The flaw exists in the gf_odf_ac4_cfg_dsi_v1 function within the /odf/descriptors.c file. An attacker can trigger a denial of service (DoS) by supplying a specially crafted AC4 file. This vulnerability has a medium severity rating with a CVSS score of 5.5. The issue is fixed in version 26.07.0.

CVE-2026-113707 is a race condition vulnerability in the a2aproject a2a-rs software, specifically in the InMemoryTaskStore::update function within the a2a-server/src/task_store/inmemory.rs file. This flaw affects versions 0.4.0 through 0.4.4 and can be exploited remotely. The vulnerability has a medium severity rating with a CVSS score of 5.3. A patch identified by commit 7050c7d329238539424ee46440e23b91c4825bee is available to address this issue.

A high-severity vulnerability (CVE-2026-91484) exists in the Java plugin component of Oracle Java SE, specifically affecting OpenJDK 8 versions listed. The vulnerability has a CVSS 3.1 score of 7.5, indicating high impact on confidentiality and integrity with no impact on availability. It requires local attack vector, high attack complexity, and low privileges without user interaction. No public exploits or cloud service implications are reported.

CVE-2026-91464 is a medium severity vulnerability affecting specific builds of OpenJDK 8, including versions distributed with Ubuntu 16.04 through 26.10. The flaw impacts Oracle Java SE and Oracle GraalVM for JDK. It has a CVSS 3.1 base score of 5.3, indicating a network attack vector with high complexity, no privileges required, and user interaction needed. The vulnerability allows high confidentiality impact but does not affect integrity or availability.

CVE-2026-91463 is a medium severity vulnerability affecting specific versions of OpenJDK 8, including various Ubuntu package builds. The vulnerability impacts Oracle Java SE and Oracle GraalVM for JDK. It has a CVSS 3.1 base score of 5.3, indicating a network attack vector with high complexity and requiring user interaction, resulting in high confidentiality impact but no integrity or availability impact.

CVE-2026-91462 is a medium severity vulnerability affecting specific builds of OpenJDK 8, including versions distributed for Ubuntu 16.04 through 26.10. The flaw impacts Oracle Java SE, Oracle GraalVM for JDK, and related Oracle products. It has a CVSS 3.1 base score of 5.9, indicating a network attack vector with high attack complexity and no privileges or user interaction required. The vulnerability results in integrity impact but no confidentiality or availability impact. No public exploits or known active exploitation have been reported.

CVE-2026-91411 is a medium severity vulnerability affecting specific builds of OpenJDK 8, including various Ubuntu package versions. The flaw impacts Oracle Java SE, Oracle GraalVM for JDK, and related products. It has a CVSS 3.1 base score of 6.5, indicating a network attack vector with high attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and high availability impact. No public exploits or known active exploitation have been reported.

CVE-2026-91396 is a medium severity vulnerability affecting specific versions of OpenJDK 8, including various Ubuntu package builds. It impacts Oracle Java SE, Oracle GraalVM for JDK, and related products. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a network exploitable flaw that requires no privileges or user interaction but results in integrity and availability impacts. No public exploits or known active exploitation have been reported. No patch or remediation details are provided in the available data.