Reserved but Public CVEs

CVE-2026-45354 is a high-severity pre-authentication DSI protocol desynchronization vulnerability in Netatalk, an implementation of the Apple Filing Protocol (AFP). The issue affects Netatalk versions 1.5.0 through 4.4.2. Based on the available context, the flaw occurs in handling of the DSI protocol before authentication is completed, allowing protocol state to become desynchronized. No vulnerable function or code path is identified in the provided material.

CVE-2026-45354First seen May 15, 2026

CVE-2026-45356 is a high-severity integer underflow vulnerability in Netatalk's Spotlight RPC handling, specifically in a count decrement operation. The issue affects Netatalk versions 3.1.0 through 4.4.2. The available context identifies the flaw as occurring during Spotlight RPC count decrement processing, indicating that malformed or attacker-controlled RPC input can cause an integer value to wrap below zero, leading to unsafe subsequent memory handling or logic errors.

CVE-2026-45356First seen May 15, 2026

CVE-2026-45355 is a high-severity vulnerability in Netatalk affecting versions 3.1.0 through 4.4.2. The issue is described as an integer underflow that leads to a heap out-of-bounds read. Based on the available information, improper handling of a length, count, or similar arithmetic value causes an underflow condition, which subsequently results in reads beyond the bounds of an allocated heap buffer during processing of attacker-supplied data.

CVE-2026-45355First seen May 15, 2026

First seen Mar 18, 2026

First seen Mar 18, 2026

CVE-2025-33143 is an uncontrolled recursion vulnerability in IBM Db2 for Linux, UNIX and Windows, including Db2 Connect Server. An authenticated user can trigger the flaw by submitting a specially crafted SQL statement that causes uncontrolled recursion during database processing. The condition can exhaust stack or other process resources and terminate or destabilize the affected Db2 service, resulting in a denial-of-service condition.

CVE-2025-33143First seen Aug 22, 2026

CVE-2026-19953 is an IDNA hostname processing flaw in perl-URI. The issue is addressed by applying Unicode NFC normalization in the URI::_idna nameprep logic so that IDNA host encoding aligns with other clients. In vulnerable versions, the lack of proper normalization can cause the library to emit a non-standard, non-round-tripping A-label during hostname encoding. This can result in inconsistent canonicalization and incorrect handling of internationalized domain names by applications that rely on perl-URI for URI or hostname processing.

CVE-2026-19953First seen Aug 21, 2026

CVE-2026-55224 is a high-severity path traversal vulnerability in MineAdmin affecting versions earlier than 3.2.0-alpha.2. The flaw is caused by unsafe handling of the identifier parameter in plugin-related functionality, including the /admin/plugin/store/download endpoint, with advisory context indicating related install and uninstall operations are also affected. By supplying traversal sequences, an attacker can cause the application to resolve filesystem paths outside the intended plugin directory. The issue is associated with insufficient normalization and validation of the identifier value; the fix references normalizeIdentifier(), indicating the vulnerable code previously failed to properly constrain path resolution. Successful exploitation can permit access to arbitrary directories and misuse of plugin management logic beyond its intended scope.

CVE-2026-55224First seen Aug 19, 2026

CVE-2026-59324 is a cross-request message context handling flaw in Spring Integration flows that use .fluxTransform() with an asynchronous or reordering fluxFunction that emits raw payloads. Under concurrent processing on the same FluxMessageChannel subscription, reply-related headers such as replyChannel, errorChannel, correlation identifiers, and propagated security or tenant context can be taken from the most recently consumed upstream message rather than the message actually associated with the emitted payload. This creates a race condition in shared request state handling, causing message metadata to be applied to the wrong response. The result is cross-message header leakage and reply misrouting between concurrent requests.

CVE-2026-59324First seen Aug 20, 2026

CVE-2026-59307 is a Java deserialization vulnerability caused by a silently bypassed deserialization allow-list. The issue is described as arising when setBeanClassLoader replaces the deserializer while the mapper retains a stale reference, resulting in the expected allow-list enforcement not being applied to subsequent deserialization operations. In the affected message-processing path, an attacker able to supply arbitrary serialized bytes to the message content field can trigger unsafe Java deserialization and achieve remote code execution despite the system being configured under the assumption that only allow-listed classes would be accepted.

CVE-2026-59307First seen Aug 20, 2026

CVE-2026-19720 is a buffer overflow vulnerability in GNU Inetutils talkd. The flaw is triggered when talkd processes excessively long DNS names, leading to memory corruption due to insufficient bounds checking during hostname-related handling. Available information indicates the issue was reproduced by the maintainer and fixed through a patch validated during coordinated disclosure. Specific vulnerable function details are currently not available.

CVE-2026-19720First seen Aug 15, 2026

First seen Feb 4, 2026

CVE-2026-55074 is a jail escape vulnerability in the Ansible FreeBSD Jail Connection Plugin, ansible-jailexec. The flaw is caused by symlink following in the put_file file-transfer path, allowing writes to resolve outside the intended jail boundary. When file transfer operations are performed against a managed jail, an attacker who can control content or filesystem state inside that jail can influence path resolution so that host-side writes occur outside the jail. Because the write is performed with host-side root privileges, the issue can break containment and enable compromise of the underlying host.

CVE-2026-55074First seen Jun 18, 2026

CVE-2026-28311 is a critical remote code execution vulnerability in SolarWinds Serv-U file transfer software. It is one of the most severe flaws addressed in Serv-U version 2026.3. Successful exploitation can allow an attacker to execute arbitrary or malicious commands on an affected Serv-U system remotely. Available reporting indicates the broader Serv-U vulnerability set includes access control and privilege-related weaknesses, but specific technical details for the vulnerable component, function, or root cause of CVE-2026-28311 are not currently available.

CVE-2026-28311First seen Jul 22, 2026

First seen Jul 31, 2026

CVE-2024-9370 is a high-severity vulnerability in Google Chrome's V8 JavaScript engine caused by an incorrect optimization in the Maglev compiler's escape analysis. The flaw affects Chrome versions prior to the stable channel update released on 2024-10-01. A specially crafted HTML page can trigger a CHECK failure when Maglev elides an inlined allocation for a constructor's this object, and the Error() constructor later traverses the stack and encounters that elided receiver, violating compiler invariants. In release builds, this invariant violation is potentially exploitable for memory corruption and arbitrary code execution within the renderer process.

CVE-2024-9370First seen Apr 19, 2026

CVE-2025-8094 is a high-severity improper handling of permissions vulnerability in the GitLab Community Edition and Enterprise Edition project API. Under certain conditions, authenticated users with maintainer privileges could manipulate shared infrastructure resources beyond their intended access level through the project API. The flaw stems from insufficient permission enforcement in API operations governing access to shared CI/CD-related infrastructure resources, allowing a maintainer to act outside the intended authorization boundary. GitLab addressed the issue by refining permission checks within the project API to enforce proper access controls.

CVE-2025-8094First seen Jun 12, 2026

CVE-2026-6949First seen Jul 28, 2026

First seen Jul 13, 2026

CVE-2026-62263 is a Java deserialization vulnerability in the OpenAM WebAuthn component. The flaw is caused by an ObjectInputFilter depth greater than 1 bypass during deserialization, allowing attacker-controlled serialized data to be processed unsafely. A remote, unauthenticated attacker can provide a serialized stream rooted at AuthenticatorImpl and trigger execution of a nested gadget chain during deserialization when a suitable gadget is available on the application classpath. Successful exploitation results in pre-authentication remote code execution against affected OpenAM deployments.

CVE-2026-62263First seen Jul 24, 2026

CVE-2026-55614 is a high-severity HTTP request smuggling vulnerability in OpenWrt's uhttpd web server on keep-alive connections. The flaw is caused by case-sensitive matching of the Transfer-Encoding header, which can lead to inconsistent interpretation of message framing when different HTTP components in the request path parse the same request differently. This parser discrepancy can desynchronize request boundaries and allow a crafted request to be interpreted as multiple requests or to cause a subsequent request on the same connection to be misframed.

CVE-2026-55614First seen Jun 30, 2026

CVE-2026-55613 is a moderate HTTP request desynchronization vulnerability in OpenWrt's uhttpd web server affecting ubus POST request handling on keep-alive connections. The flaw is triggered when a ubus POST body encounters a parse error, causing request parsing state to become desynchronized rather than cleanly terminating or isolating the malformed request. This can break message boundary handling between successive HTTP requests on the same connection and create a request smuggling condition in front-end/back-end or client/server parsing flows.

CVE-2026-55613First seen Jun 30, 2026

CVE-2026-55612 is a high-severity HTTP request smuggling vulnerability in OpenWrt's uhttpd web server. The flaw affects request processing on keep-alive connections and is caused by an invalid reset of parser state related to chunk-length handling during HTTP message framing. This can cause uhttpd to misinterpret request boundaries when processing chunked request bodies, leading to front-end/back-end desynchronization conditions. In deployments where uhttpd is reachable by an attacker, a crafted sequence of HTTP requests can be used to smuggle a second request across a persistent connection and have it processed out of sync with the visible request stream.

CVE-2026-55612First seen Jun 30, 2026

CVE-2026-53920 is a high-severity information disclosure vulnerability in OpenWrt's odhcpd DHCPv6 service. The flaw is triggered when odhcpd processes a truncated DHCPv6 IA_NA or IA_PD option, leading to disclosure of stack memory. The issue affects the DHCPv6 Identity Association handling path in a default-enabled core network service and is reachable by a network-adjacent attacker able to send crafted DHCPv6 traffic to the target device.

CVE-2026-53920First seen Jun 30, 2026

CVE-2026-31022First seen Apr 16, 2026