Tagged “vex”
CVEs tagged vex, newest first.
7401 CVEsRSS
CVE-2026-114145High· 7.5GitPython: GitPython: arbitrary code execution via improper submodule path validation (CVE-2026-114145)
A flaw was found in GitPython. This vulnerability allows an attacker to achieve arbitrary code execution by supplying an untrusted submodule path. Because the library fails to properly validate destination paths before cloning repository d…
CVE-2026-114406Medium· 6.8Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns
The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued…
CVE-2026-114135High· 8.8Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorization
Jupyter Server is the backend for Jupyter web applications. From 2.0.0 until 2.6.0, enabling GatewayClient.url replaced the normal KernelWebsocketHandler with WebSocketChannelsHandler, which authenticated the user but did not call author…
CVE-2026-114136High· 7.5djangorestframework: djangorestframework: Denial of Service via improper charset handling in JSON parser (CVE-2026-114136)
A flaw was found in Django REST framework. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by exhausting server memory. The issue occurs because the JSON parser accepts arbitrary client-suppl…
CVE-2026-92183High· 7.80daygimp: gimp: Arbitrary code execution via stack-based buffer overflow in APNG parser (CVE-2026-92183)
A flaw was found in GIMP. This flaw allows an attacker to achieve arbitrary code execution by tricking a user into opening a specially crafted Animated Portable Network Graphics (APNG) image. The vulnerability is caused by a stack-based bu…
CVE-2026-114126High· 8.7Storybook dev server: devices on the same network can obtain the WebSocket token and write code into story files
Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, the Storybook development server can expose its WebSocket authentication token t…
CVE-2026-114127Medium· 5.4⚖ disputedastro: Astro: CSS injection via unvalidated view transition animation properties (CVE-2026-114127)
A flaw was found in Astro. Its server-side View Transition stylesheet generator fails to properly sanitize animation properties when creating transition styles. A remote attacker able to supply input to these properties can inject arbitrar…
CVE-2026-114128Medium· 6.1astro: astro: Cross-Site Scripting via unescaped dynamic content in script and style elements (CVE-2026-114128)
A flaw was found in Astro. The rendering engine fails to properly sanitize dynamic values placed inside script and style elements, mistakenly treating them as trusted markup. A remote attacker can exploit this issue by supplying crafted in…
CVE-2026-114125High· 8.6Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites
Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook develop…
CVE-2026-109619Critical· 9.2CISA KEVPoCRCE via stale global state
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after i…
CVE-2026-98869High· 7.8kernel: bpf: Infer zext_dst based on static register liveness analysis (CVE-2026-98869)
A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) verifier. A local attacker could achieve privilege escalation by loading a specially crafted BPF program into the kernel. The vulnerability occurs because the verifier fai…
CVE-2023-7356High· 8.8Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID Copy the content of a Periodic Advertisement Report to BASE only if the service UUID is Basic Au…
CVE-2026-109618Critical· 9.2CISA KEVPoCRCE via OOM corruption
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performin…
CVE-2026-105923Medium· 4.0Null-pointer dereference in QTriangulator reachable through VectorImage
A malicious SVG can trigger an integer overflow which in turn triggers a null-pointer dereference in VectorImage QML Type.
CVE-2026-17557Medium· 6.5Lm-evaluation-harness: lm-evaluation-harness: ssrf via job-spec model.url with bearer credential forwarding
A flaw was found in the `lm-evaluation-harness` component of Red Hat OpenShift AI. An authenticated user, able to submit an evaluation job, could exploit this by providing a malicious model URL in the `JobSpec`. This vulnerability allows…
CVE-2026-114236Low· 3.3Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers
storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process’ file descriptor limit
CVE-2026-92823Medium· 6.2Libmodulemd: libmodulemd: missing decompressed-size limit when parsing compressed yaml
A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through a custom read handler that does not enforce a cumulative decompressed-size limit before parsing. An attacker who can …
CVE-2026-92824Medium· 6.2Libmodulemd: libmodulemd: out-of-bounds read when emitting rpm-map artifacts
A flaw was found in libmodulemd. In the module stream v2 rpm-map emission path, an inner loop incorrectly uses the count of digest algorithms as its bound instead of the number of checksums in the current digest table. Crafted modulemd v…
CVE-2026-92822Medium· 6.2PoCLibmodulemd: libmodulemd: unbounded recursion when parsing nested xmd yaml
A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted into nested GVariant values through recursive YAML mapping and sequence helpers without a recursion-depth or node-count limit. An attacker who can …
CVE-2026-114038Medium· 5.1Device-mapper-multipath: device-mapper-multipath: information disclosure via malformed format string
A flaw was found in device-mapper-multipath. A local user can trigger an out-of-bounds read by sending a command with a format string ending in a trailing percent character to the multipath daemon. This issue can allow the user to expose…
CVE-2026-114041Medium· 6.5FreeRDP before 3.32.1 Heap Out-of-Bounds Read via RD Gateway Consent Message
FreeRDP before 3.32.1 on Windows contains a heap out-of-bounds read in client_cli_present_gateway_message that passes a byte count as wide-character printf precision. A malicious RD Gateway can send pre-authentication consent or service …
CVE-2026-114046Medium· 6.5PoCFreeRDP 3.0.0 before 3.32.0 null-pointer dereference via emulated smartcard
FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SCardGetStatusChange requests. A malicious RDP server can send a crafted reader-state entry with a …
CVE-2026-114044Medium· 5.3FreeRDP before 3.32.1 Android Client Heap OOB Read via Graphics Pipeline
FreeRDP before 3.32.1 contains a heap out-of-bounds read vulnerability in the Android client that allows malicious RDP servers to read beyond surface buffers by supplying unvalidated mappedWidth and mappedHeight values. Attackers can sen…
CVE-2026-114042Medium· 6.5PoCFreeRDP 3.32.0 Use-After-Free via drdynvc Virtual Channel PDU
FreeRDP 3.32.0 contains a use-after-free vulnerability in the drdynvc channel that frees a pool-owned stream with the owned-stream deallocator when totalLength is smaller than the chunk size. A malicious RDP server can send a single well…
CVE-2026-114045High· 8.8FreeRDP before 3.32.1 Heap Buffer Overflow via rdpsnd_server_select_format
FreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side rdpsnd channel because an integer wraparound in rdpsnd_server_select_format() DVI_ADPCM block-alignment arithmetic bypasses validation. A malicious RDP client…
CVE-2026-114043Medium· 6.5PoCVulnerability in FreeRDP
FreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipboard PNG-to-CF_DIB synthesis because winpr_read_png_from_buffer() allocates a bit-packed buffer for PNGs with bit depth below 8, while winpr_bitmap_write_buff…
CVE-2026-114047Medium· 6.8FreeRDP 2.0.0 before 3.32.0 Proxy Improper TLS Certificate Validation
FreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vulnerability in its proxy that accepts untrusted target TLS certificates when no verification module is configured. Network-positioned attackers can intercept …
CVE-2026-114052High· 7.5vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for ev…
vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every distinct request-controlled mm_processor_kwargs value in an unbounded dictionary. Unauthenticate…
CVE-2026-114051High· 7.5vLLM before 0.31.0 Denial of Service via min_tokens in /inference/v1/generate
vLLM before 0.31.0 skips the min_tokens <= max_tokens check for /inference/v1/generate requests with a null max_tokens, so the EngineCore input thread later dies on an uncaught VLLMValidationError while /health still returns 200. Unauthe…
CVE-2026-114055High· 7.5vLLM 0.7.3 before 0.31.0 DoS via Unvalidated mm_processor_kwargs
vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to control multimodal processor parameters by supplying per-request mm_processor_kwargs. Attackers can set large image s…