CVE-2026-96422 | Medium | 5.5 | 2026-09-29 | Frame protocol metadissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service |
CVE-2026-88341 | Medium | 5.5 | 2026-09-22 | A reachable assertion vulnerability exists in YARA 4.5.8 when loading crafted .yrc compiled rule files. An attacker can provide a malicious file with an invali… |
CVE-2026-94623 | High | 7.5 | 2026-09-21 | vLLM through 0.29.0 contains a denial of service vulnerability in the NIXL connector's prefix caching implementation that fails to properly validate block coun… |
CVE-2026-75894 | High | 7.5 | 2026-09-18 | In osmo-iuh from 0.1.0 through 1.8.0 a reachable assertion was found in the ranap_handle_co_dt() function via a arbitrarily sized NAS-PDU that leads to process… |
CVE-2026-91147 | Medium | 5.9 | 2026-09-18 | A flaw was found in `cockpit-ws`. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a specially crafte… |
CVE-2026-84450 | Medium | 4.3 | 2026-09-18 | libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, a crafted image item containing a clap property and an ispe width or heig… |
CVE-2026-8674 | Medium | 5.3 | 2026-09-17 | Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 cha… |
CVE-2026-92971 | High | 7.5 | 2026-09-17 | InternLM LMDeploy through 0.17.0 contains a reachable assertion vulnerability in the DistServe decode migration loop that allows unauthenticated attackers to t… |
CVE-2026-92416 | Medium | 4.3 | 2026-09-16 | A vulnerability has been found in Open5GS up to 2.8.0. Affected by this issue is the function smf_n4_handle_session_report_request of the file src/smf/n4-handl… |
CVE-2026-80274 | High | 7.5 | 2026-09-16 | If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed NSEC3 pro… |
CVE-2026-76163 | High | 7.5 | 2026-09-16 | If BIND is loaded with a "`named.conf`" file that contains no global "`options`" block, an attacker can send a query of QTYPE TKEY which may cause an assertion… |
CVE-2026-73438 | Medium | 5.3 | 2026-09-16 | On affected platforms running Arista EOS with Open Shortest Path First version 3 (OSPFv3) configured, an unauthenticated attacker on the same OSPFv3 broadcast… |
CVE-2026-91961 | Medium | 6.5 | 2026-09-15 | FreeRDP before 3.31.0 contains a denial-of-service vulnerability in the URBDRC control-transfer request path that fails to validate OutputBufferSize before for… |
CVE-2026-91951 | Medium | 6.5 | 2026-09-15 | FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in the urbdrc client channel's urb_send_current_frame_number_result() function. A m… |
CVE-2026-55776 | Medium | 6.5 | 2026-09-15 | OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, an authenticated OpenBao caller with write access to transit/keys/* could t… |
CVE-2026-15893 | Medium | 6.5 | 2026-09-14 | net_if_ipv6_calc_reachable_time() in subsys/net/ip/net_if.c derives a randomized ND reachable time from ipv6->base_reachable_time as min_reachable + sys_rand32… |
CVE-2026-90786 | Medium | 5.3 | 2026-09-14 | A vulnerability was determined in Dvidelabs flatcc up to 0.6.3. This impacts the function align_order_members of the file src/compiler/semantics.c of the compo… |
CVE-2026-90785 | Medium | 5.3 | 2026-09-14 | A vulnerability was found in Dvidelabs flatcc up to 0.6.3. This affects the function analyze_struct of the file src/compiler/semantics.c of the component Struc… |
CVE-2026-90685 | Low | 2.8 | 2026-09-14 | A vulnerability has been found in GPAC up to f1219cde. Affected by this issue is the function lsr_exec_command_list of the file laser/lsr_dec.c of the componen… |
CVE-2026-90684 | Low | 2.8 | 2026-09-14 | A flaw has been found in GPAC up to f1219cde. Affected by this vulnerability is the function gf_node_get_field_count of the file scenegraph/base_scenegraph.c o… |
CVE-2026-90683 | Low | 3.3 | 2026-09-14 | A vulnerability was detected in GPAC up to f1219cde. Affected is the function gf_node_unregister of the file scenegraph/base_scenegraph.c of the component MP4B… |
CVE-2026-90613 | Low | 3.3 | 2026-09-14 | A security flaw has been discovered in GPAC up to f1219cde. Affected by this vulnerability is the function stbl_GetSampleInfos of the file isomedia/stbl_read.c… |
CVE-2026-90612 | Low | 3.3 | 2026-09-14 | A vulnerability was identified in GPAC up to f1219cde. Affected is the function gf_sm_dump_command_list of the file scene_manager/scene_dump.c of the component… |
CVE-2026-90611 | Low | 3.3 | 2026-09-14 | A vulnerability was determined in GPAC up to f1219cde. This impacts the function xmt_parse_element of the file scene_manager/loader_xmt.c of the component MP4B… |
CVE-2026-89146 | High | 7.5 | 2026-09-11 | libp2p-rendezvous through 0.17.1 fails to validate registration TTL values in discovery responses, allowing attackers to trigger timer arithmetic overflow. A m… |
CVE-2026-75584 | High | 7.5 | 2026-09-10 | ION-DTN before 4.2.1-a.1 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash the ION process by sending a BPv7 bun… |
CVE-2026-82068 | Medium | 6.5 | 2026-09-08 | A security issue in MongoDB Server allows an authenticated user with write privileges to trigger a persistent fatal assertion crash by sending specially crafte… |
CVE-2026-82065 | Medium | 6.5 | 2026-09-08 | A security issue in the MongoDB Server's storage engine integration layer allows an authenticated user with collection creation privileges to cause a persisten… |
CVE-2026-82064 | High | 7.5 | 2026-09-08 | A security issue in MongoDB Server allows an unauthenticated network user to cause a denial of service on a specific type of replica set member. The server con… |
CVE-2026-82059 | Medium | 5.3 | 2026-09-08 | An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any authenticated user rather than being restricted to interna… |
CVE-2026-82052 | Medium | 6.5 | 2026-09-08 | The $regexFindAll expression can be used by an authenticated user who can run aggregation pipeline stages to crash a MongoDB server (mongod). Under certain spe… |
CVE-2026-79379 | Medium | 6.5 | 2026-09-08 | A buffer overflow in the SBC_DecodeFrames() function of Bestechnic Co., Ltd BES2300 Bluetooth Audio SoC firmware v3.x and earlier and fixed in v.5.0 allows att… |
CVE-2026-86317 | Medium | 5.3 | 2026-09-07 | A vulnerability was detected in ggml-org llama.cpp up to 0.4.0. This impacts the function rpc_server::deserialize_tensor of the file ggml/src/ggml-rpc/ggml-rpc… |
CVE-2026-20504 | Medium | 5.3 | 2026-09-07 | In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base st… |
CVE-2026-20503 | Medium | 5.3 | 2026-09-07 | In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base st… |
CVE-2026-31911 | Medium | 5.5 | 2026-09-05 | libpcap BPF interpreter calls abort() if it encounters a BPF instruction that has an invalid opcode. In particular uncommon use cases a crafted filter program… |
CVE-2026-85534 | Medium | 5.9 | 2026-09-04 | A flaw was found in libsoup. When a client sends an HTTP/2 request body from a non-pollable input stream, the library can buffer more data than the current flo… |
CVE-2026-84971 | Medium | 6.5 | 2026-09-03 | Improper handling of an unexpected value size in the decryption path of a client-side encryption library can cause a failed internal check that terminates the… |
CVE-2026-14957 | High | 7.5 | 2026-09-02 | In FIPS mode, Libreswan's add_decoded_cert() function calls CERT_ExtractPublicKey() and asserts that the result is not NULL. However, CERT_ExtractPublicKey() r… |
CVE-2026-52131 | High | 7.5 | 2026-09-01 | llama.cpp b5693 and before has a Reachable Assertion via the gguf_reader::read function. |
CVE-2026-82590 | Medium | 4.3 | 2026-08-30 | A weakness has been identified in Open5GS up to 2.7.7. The affected element is the function smf_nudm_sdm_handle_get of the file src/smf/nudm-handler.c of the c… |
CVE-2026-30047 | High | 7.5 | 2026-08-27 | A reachable assertion vulnerability in the /nsmf-pdusession/v1/sm-contexts component of Open5GS v2.7.6 allows attackers to cause a Denial of Service (DoS) via… |
CVE-2026-30046 | High | 7.5 | 2026-08-27 | A reachable assertion vulnerability in the NUDM-UECM interface of Open5GS v2.7.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted DE… |
CVE-2026-19401 | High | 7.5 | 2026-08-26 | Any remote client can crash a (debugging/non-release build type) NSD serve child by sending it a special crafted message with a specially tuned number of DNS C… |
CVE-2026-53532 | | | 2026-08-24 | OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.4.0 through 3.4.1… |
CVE-2026-78186 | Medium | 4.3 | 2026-08-24 | A flaw has been found in Open5GS up to 2.8.0. This affects an unknown function of the file src/hss/hss-cx-path.c of the component HSS. This manipulation of the… |
CVE-2026-63388 | High | 8.4 | 2026-08-20 | Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a heap out-of-bounds write in bufferevent_sock.c when bufferevent_sock… |
CVE-2026-76926 | Low | 3.1 | 2026-08-19 | BUSMASTER file parser abnormal exit in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service |
CVE-2026-62377 | Medium | 4.3 | 2026-08-18 | libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF sequence accepted by heif_context_read_from_memory() can leav… |
CVE-2026-62289 | Medium | 4.3 | 2026-08-18 | libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF or AVIF file containing a clean aperture box can reduce an im… |
CVE-2026-52829 | High | 7.5 | 2026-08-18 | ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, an unauthenticated IPv4 peer can deterministically terminate a synced Zebra node using the defa… |
CVE-2026-43667 | Medium | 6.5 | 2026-08-17 | A reachable assertion was addressed with improved input validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, macOS Taho… |
CVE-2025-15684 | Medium | 5.3 | 2026-08-12 | A vulnerability was detected in Open5GS up to 2.7.6. Affected is the function diam_log_func of the file lib/diameter/common/init.c of the component CER Handler… |
CVE-2026-18707 | Medium | 4.3 | 2026-08-11 | An issue in MongoDB Server could allow an authenticated user, including one with no assigned privileges, to cause the server process to terminate unexpectedly… |
CVE-2026-18697 | High | 7.5 | 2026-08-11 | An issue in MongoDB Server's aggregation framework could allow an unauthenticated party to cause a mongos (router) process to terminate unexpectedly by submitt… |
CVE-2026-18695 | Medium | 6.5 | 2026-08-11 | An issue in MongoDB Server's handling of certain query predicates against time-series collections with a metaField could allow an authenticated user with write… |
CVE-2026-19519 | Medium | 4.3 | 2026-08-11 | A flaw was found in claircore's RPM package scanner. Crafted RPM header data in a container layer can cause an unchecked type assertion to panic the scanner. T… |
CVE-2026-71430 | Medium | 6.2 | 2026-08-06 | node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.25.1, the WrappedRE2::Replace function built its replacement result and passe… |
CVE-2026-18581 | Low | 3.3 | 2026-08-03 | A vulnerability was determined in ggml-org llama.cpp e15efe0. Affected by this issue is some unknown functionality of the file common/jinja/parser.cpp of the c… |
CVE-2026-67303 | Medium | 4.3 | 2026-08-01 | FreeRDP before 3.29.0 contains a reachable assertion (WINPR_ASSERT(OutputBufferLength == BytesReturned)) in serial_process_irp_device_control() in channels/ser… |
CVE-2026-52856 | High | 7.5 | 2026-07-31 | Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, a malformed packet received during the SF… |
CVE-2026-66754 | Medium | 5.9 | 2026-07-28 | Rouille 0.1.6 through 3.6.2 contains a reachable assertion vulnerability in the Request::remove_prefix function that allows remote unauthenticated attackers to… |
CVE-2026-17574 | Medium | 5.5 | 2026-07-27 | HDF5 contains a NULL pointer dereference vulnerability. Processing a crafted HDF5 file containing an attribute with an invalid variable-length datatype type fi… |
CVE-2026-17513 | Low | 3.3 | 2026-07-27 | A vulnerability was found in ggml-org whisper.cpp 95ea8f9b. Affected is the function ggml_ftype_to_ggml_type of the file ggml/src/ggml.c. The manipulation of t… |
CVE-2026-64254 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved:
NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR
When BAR_PE… |
CVE-2026-45815 | High | 7.5 | 2026-07-24 | Reachable Assertion vulnerability in Apache NimBLE.
A specially crafted ATT Read Multiple Variable Response (BLE_ATT_OP_READ_MULT_VAR_RSP) may trigger assert i… |
CVE-2026-9737 | Medium | 6.5 | 2026-07-22 | During query planning when reading the sort pattern in raw BSONObj form, in some places we don’t explicitly handle the meta expression case. This may lead to i… |
CVE-2026-13073 | Medium | 4.3 | 2026-07-22 | An authenticated user with read-only privileges can cause the mongod process to terminate abnormally by issuing a crafted aggregation command, resulting in den… |
CVE-2026-13058 | Medium | 6.5 | 2026-07-22 | An authenticated user with basic write privileges can cause the mongod process to terminate abnormally by sending a crafted transaction command with an incompl… |
CVE-2026-13055 | Medium | 6.5 | 2026-07-22 | The `$_internalIndexKey` aggregation expression can be used by any authenticated user to crash a MongoDB server (mongod). The expression fails to handle compou… |
CVE-2026-13204 | High | 7.5 | 2026-07-22 | If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may ex… |
CVE-2026-12617 | High | 7.5 | 2026-07-22 | The issue is unexpected program termination based on ordering and/or specific content in responses to queries for CNAME or DNAME, and A records. Specifically… |
CVE-2026-10822 | Medium | 6.5 | 2026-07-22 | If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit.
BIND will first… |
CVE-2026-14586 | Medium | 5.9 | 2026-07-22 | In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, in DNS-over-QUIC environments, with high concurrency and under pressure, an assertion in libngtcp2 abo… |
CVE-2026-10674 | Medium | 5.5 | 2026-07-21 | The NXP LPUART serial driver (drivers/serial/uart_mcux_lpuart.c), when CONFIG_UART_USE_RUNTIME_CONFIGURE is enabled, called LPUART_Deinit() at the start of mcu… |
CVE-2026-63140 | Medium | 6.5 | 2026-07-21 | Reachable Assertion (CWE-617) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted search request contai… |
CVE-2026-63806 | High | 7.1 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved:
KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned()
Drop… |
CVE-2026-44435 | High | 7.5 | 2026-07-16 | Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit 937d0e9, an assertion failure is raised w… |
CVE-2025-56365 | High | 7.5 | 2026-07-14 | A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, in the interaction model command processing logic. When an InvokeC… |
CVE-2025-56362 | High | 7.5 | 2026-07-14 | A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.2, specifically within the Level Control cluster's periodic server ti… |
CVE-2025-56361 | High | 7.5 | 2026-07-14 | A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) 1.3 thru 1.4, specifically within the Level Control cluster's server tick logic… |
CVE-2026-47475 | Medium | 6.2 | 2026-07-14 | NVIDIA TensorRT-LLM contains a vulnerability in the OpenAI-compatible inference API where an attacker could trigger a reachable assertion in the sampler thread… |
CVE-2026-58307 | Medium | 6.1 | 2026-07-09 | Out-of-bounds read, Reachable assertion vulnerability in Samsung Open Source Escargot allows Overread Buffers, Input Data Manipulation.
This issue affects Esc… |
CVE-2026-55514 | Medium | 6.5 | 2026-07-06 | vLLM is a library for LLM inference and serving. From 0.12.0 to before 0.24.0, sending a pure prompt embeds payload in a /v1/completions request with a model u… |
CVE-2026-13122 | Medium | 5.3 | 2026-07-06 | OpenVPN version 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service via a malformed authentication token tha… |
CVE-2026-50722 | High | 8.1 | 2026-07-02 | Libreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly verify the DER encoding of the ASN.1 digest when the IKEv2 AUTH… |
CVE-2026-50721 | High | 8.1 | 2026-07-02 | Libreswan, via the function RSA_authenticate_hash_signature_raw_rsa(), did not correctly verify the length of the authentication hash when the SIG payload of a… |
CVE-2026-12413 | High | 7.5 | 2026-07-02 | An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. Continued exploitation would cause a denial of service. The funct… |
CVE-2026-53319 | Medium | 5.5 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved:
blk-wbt: remove WARN_ON_ONCE from wbt_init_enable_default()
wbt_init_enable_default() use… |
CVE-2026-53292 | Medium | 5.5 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved:
net: phonet: do not BUG_ON() in pn_socket_autobind() on failed bind
syzbot reported a ker… |
CVE-2026-53285 | Medium | 5.5 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED
[W… |
CVE-2026-9718 | Medium | 6.5 | 2026-06-25 | CWE-617 Reachable Assertion vulnerability exists that could allow an authenticated attacker to trigger a denial-of-service condition, impacting system availabi… |
CVE-2026-47146 | Medium | 6.5 | 2026-06-25 | In EmberZNet v9.0.2 and earlier, malformed Color Control messages can lead to asserts that terminate the process. These messages must come from a device that h… |
CVE-2026-47145 | Medium | 6.5 | 2026-06-25 | In EmberZNet v9.0.2 and earlier, malformed Color Control messages can lead to asserts that terminate the process. These messages must come from a device that h… |
CVE-2026-53169 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved:
accel/ethosu: reject NPU_OP_RESIZE commands from userspace
NPU_OP_RESIZE is a U85-only co… |
CVE-2026-53039 | Medium | 5.5 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved:
ocfs2: validate group add input before caching
[BUG]
OCFS2_IOC_GROUP_ADD can trigger a BU… |
CVE-2026-52961 | Medium | 5.5 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved:
ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size
The generic/642 tes… |
CVE-2026-52954 | High | 7.5 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved:
libceph: handle rbtree insertion error in decode_choose_args()
A message of type CEPH_MSG… |
CVE-2026-52952 | High | 8.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved:
iommu: Fix WARN_ON in __iommu_group_set_domain_nofail() due to reset
In __iommu_group_set… |
CVE-2026-10651 | High | 7.1 | 2026-06-23 | bt_sdp_parse_attribute() in subsys/bluetooth/host/classic/sdp.c validated only that the SDP record buffer held the type-marker byte plus the 2-byte attribute I… |