Composer is vulnerable to Command Injection via Malicious Perforce Repository

PowerShell Command Injection in Podman HyperV Machine

Libtiff: libtiff: arbitrary code execution or denial of service via signed integer overflow in tiff file processing

NGINX ngx_http_mp4_module vulnerability

NGINX ngx_http_mp4_module vulnerability

Arbitrary file write using cgo pkg-config directive in cmd/go

Libxslt: libxml2: heap use-after-free in libxslt caused by atype corruption in xmlattrptr

Gcc: libstdc++ integer overflow in `new` operator

Glib: integer overflow in in g_escape_uri_string()

Libaom: libaom: heap buffer overflow in av1 encoder first-pass stats buffer via lap mode

Cyrus-sasl: heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise digest-md5 clients

Busybox: busybox: tls montgomery reduction allocates bytes instead of digits, causing a pre-auth heap buffer overflow

Libssh: libssh: use-after-free via data callbacks on closed channels

Libssh: libssh: denial of service via automatic certificate authentication loop

Libssh: libssh: integrity downgrade via openssl aes-gcm tag verification

Dracut: dracut: root code execution via dhcp options command injection in networkmanager initrd module

Libarchive: double-free vulnerability in rar5 decompression logic via dangling filtered_buf pointer in init_unpack()

A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB

undici WebSocket client vulnerable to denial of service via fragment count bypass

Dracut: dracut: root code execution via dhcp options command injection

ASP.NET Core Denial of Service Vulnerability

Apache HTTP Server: mod_http2 denial of service

Apache HTTP Server: mod_xml2enc heap overflow

Apache HTTP Server: mod_proxy_html buffer overflow

iskorotkov/avro: CPU Exhaustion in Avro Decoder

iskorotkov/avro: Integer Overflow in Avro Decoder

Invalid handling of CLASS != IN

BIND 9 server memory exhaustion during GSS-API TKEY negotiation

Crash during DNSSEC validation of malicious content

Heap overflow with multiple NSID, COOKIE, PADDING EDNS options

Long list of incoming EDNS options degrades performance

Gnutls: gnutls: denial of service via dtls packet reordering vulnerability

ws: Uninitialized memory disclosure

Wasmtime: Panic when allocating a table exceeding the size of the host's address space

urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API

ASP.NET Core Denial of Service Vulnerability

Quadratic string concatentation in consumeComment in net/mail

Crash when handling long CNAME response in net

Quadratic string concatenation in consumePhrase in net/mail

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

fast-uri vulnerable to host confusion via percent-encoded authority delimiters

Prometheus: remote read endpoint allows denial of service via crafted snappy payload

Prometheus Azure AD remote write OAuth client secret exposed via config API

Gnutls: gnutls: denial of service via heap buffer overflow in dtls handshake fragment reassembly

Libxml2: libxml2: denial of service via crafted xsd-validated document

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP)

ngtcp2 has a qlog transport parameter serialization stack buffer overflow

.NET and Visual Studio Denial of Service Vulnerability

.NET Denial of Service Vulnerability