CVE-2026-58010

Glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal()

A flaw was found in GLib. An off-by-one error can occur in the gvs_tuple_is_normal function in the glib/gvariant-serialiser.c file when doing an alignment padding check because the bounds check uses > instead of >=, causing an out-of-bounds read of only 1 byte. This issue can cause a minor information disclosure of 1 byte and a denial of service when the out-of-bounds read crosses a page boundary.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Gnome Redhat

Products

Glib Ai Inference Server Cert Manager and 14 more

CVE-2025-14087

Glib: glib: buffer underflow in gvariant parser leads to heap corruption

A flaw was found in GLib (Gnome Lib). This vulnerability allows a remote attacker to cause heap corruption, leading to a denial of service or potential code execution via a buffer-underflow in the GVariant parser when processing maliciously crafted input strings.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed

Vendors

Gnome Redhat

Products

Glib Ai Inference Server Cert Manager and 14 more

CVE-2026-50079

Vulnerabilities in the QNX Virtual Machine (QVM) affect QNX Hypervisor and QNX Hypervisor for Safety

Time-of-check Time-of-use (TOCTOU) Race Condition in the virtio network virtual device could allow an attacker in the guest to manipulate the virtual network device causing a crash of the QVM.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-96677

Apache Juneau: Cross-site scripting via unescaped request variables in HTML-doc chrome

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Juneau. HTML document serialization does not HTML-encode variable substitutions in the page chrome (header, nav, aside, footer and similar fields). Applications whose chrome includes request-derived variables, such as request headers, form data or path values, reflect those values unencoded, allowing cross-site scripting. The default chrome does not use request variables, so only applications that add them are affected. This issue affects Apache Juneau: through 9.2.0. Users are recommended to upgrade to version 9.2.1, which fixes the issue.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Juneau

CVE-2026-91759

Out-of-Bounds Write Vulnerability in Hitachi Dynamic Link Manager for Linux

Out-of-Bounds Write Vulnerability in Hitachi Dynamic Link Manager for Linux. This issue affects Hitachi Dynamic Link Manager for Linux: from 7.5.0-00 before 9.0.5-00.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-91758

Out-of-bounds Read and Write Vulnerability in Hitachi Dynamic Link Manager for Linux

Out-of-bounds Read and Write Vulnerability in Hitachi Dynamic Link Manager for Linux. This issue affects Hitachi Dynamic Link Manager for Linux: from 7.5.0-00 before 9.0.5-00.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-90975

CVE-2026-90975

A vulnerability in Realtek's RtUsbA64.sys USB audio driver allows a local, low-privileged user to abuse a kernel I/O control (IOCTL) interface that acts on a caller-supplied user-mode pointer without proper validation or capture. By issuing crafted property requests an attacker can obtain kernel-mode read and write access, which can be leveraged for local privilege escalation and arbitrary kernel code execution.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Realtek

Products

Rtusba64.sys

CVE-2026-85108

Apache James MIME4J: Denial of service due to Allocation of Resources Without Limits or Throttling

Allocation of Resources Without Limits or Throttling in Apache James Mime4J library prior version 0.8.15 allows Denial of Service upon parsing Mime messages. Users are recommended to upgrade to version 0.8.15 which fixes the issue by enforcing new limits and providing better defaults.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Apache

Products

James Mime4j James Mime4j Dom

CVE-2026-84473

CVE-2026-84473

Authentication Bypass / Missing Brute-Force Protection in remote.php/webdav/ in ownCloud ownCloud server 10.16.3 allows an unauthenticated remote attacker to perform unlimited online password guessing against WebDAV accounts via repeated HTTP Basic Authentication requests to the WebDAV endpoint.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Kiteworks

Products

Owncloud

CVE-2026-80303

Avast WFP stream parser integer underflow causes system crash

An integer underflow vulnerability in the Avast Windows Filtering Platform (WFP) stream parser on Windows allows denial of service by causing a system crash. The WFP callout driver processes network stream data and computes length values for packet fragment reassembly. The length calculation does not properly validate input stream sizes against expected boundaries. When processing specially crafted input, the length computation underflows, resulting in allocation or buffer access with an extremely large wrapped-around size value. The underflow can be triggered remotely via network traffic destined for the filtered port, or locally via crafted data provided to the filtering interface. The resulting memory allocation failure or out-of-bounds access causes a kernel panic and system crash.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-80302

Avast sandbox escape via arbitrary file write in virtualized environment

Insufficient isolation in the Avast sandbox file virtualization layer on Windows allows a local, low-privileged attacker executing inside the sandbox to write arbitrary files outside sandbox containment and execute code on the host. The sandbox virtualizes file system operations by intercepting write requests to protected system directories. However, the virtualization implementation fails to properly validate write targets in certain edge cases, allowing writes to bypass the virtualization redirection and reach the actual host file system in protected locations. An attacker can exploit this to overwrite executable files, system libraries, or startup configurations with arbitrary content, leading to code execution with host privileges on subsequent system operations or reboot.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-80301

Avast sandbox escape via unpreserved COM pathway through Task Scheduler

Improper isolation in the Avast sandbox on Windows allows a local, low-privileged attacker executing inside the sandbox to access COM interfaces to the Task Scheduler service, escape containment, and execute code with elevated privileges outside the sandbox. The sandbox virtualizes file system and registry access but does not adequately restrict COM interface access to Task Scheduler. A process inside the sandbox can instantiate COM objects bound to Task Scheduler functionality and invoke methods to schedule and execute tasks on the host system. The Task Scheduler COM pathway is not blocked by the sandbox policy, allowing arbitrary code execution in the host security context. This escape vector bypasses the sandbox's intended process and file isolation boundaries and can be chained with other host-level privilege escalation techniques.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-77473

AsyncSSH: SFTP Recursive Copy Path Traversal via Unsanitized Server-Supplied Filenames

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.1, recursive remote-to-local SFTP copies in SFTPClient._copy() in asyncssh/sftp.py, reached through get(), mget(), and copy(), trust filenames returned by a remote server's directory enumeration. A malicious or compromised SFTP server can return an absolute filename or a filename containing path separators and parent-directory traversal, causing destination path construction to escape the requested local directory and write attacker-selected content to locations writable by the client process. This issue is fixed in version 2.24.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Ronf

Products

Asyncssh

CVE-2026-76171

Apache James: SSRF filter bypass in the JMAP PushSubscription web-push client

In Apache James server prior version 3.9.1 improper validation in JMAP webPush SSRF validation did lead to the possibility to reach internal addresses. Users are recommended to upgrade to version 3.9.1 which fixes this issue.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Apache

Products

James

CVE-2026-76168

Apache James: ManageSieve file implementation cross-user path traversal

In Apache James server prior version 3.9.1 relying on the SieveFileRepository incorect validation of file paths can result in path transversal, allowing to set arbitrary SIEVE scripts for other users. This allows a logged in attacker to set arbitrary SIEVE scripts for other users, resulting in denial of service or even traffic capture. Users are recommended to upgrade to version 3.9.1 which fixes this issue.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Apache

Products

James

CVE-2026-73117

Apache Juneau: Response header CRLF injection and open redirect when applications set headers or redirect targets from request data

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability in Apache Juneau. The Apache Juneau REST server passed response header values and redirect targets to the servlet container unchecked. An application that sets a response header or redirect target from request data could let a remote client inject header lines (where the servlet container does not itself reject CR/LF) or redirect users to an arbitrary external site. The framework itself does not build headers or redirects from request data; exposure depends on application code. This issue affects Apache Juneau: through 9.2.0. Users are recommended to upgrade to version 9.2.1, which fixes the issue. Header values are now sanitized by default; applications that build redirect targets from request data must also switch from sendRedirect() to the new sendSafeRedirect().

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Juneau

CVE-2026-73116

Apache Juneau: REST client forwards credentials to a different origin when following HTTP redirects

Insufficiently Protected Credentials vulnerability in Apache Juneau. The Apache Juneau RestClient followed HTTP redirects while keeping credential headers from the original request, so a server that redirected the client to a different host or port, or from HTTPS to HTTP, could receive headers such as Authorization, Cookie, Proxy-Authorization and X-API-Key. This issue affects Apache Juneau: through 9.2.0. Users are recommended to upgrade to version 9.2.1, which fixes the issue. The fix applies to HTTP clients created by the RestClient builder; applications that supply their own HttpClient must disable automatic redirects or strip credential headers on cross-origin redirects themselves.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Juneau

CVE-2026-73101

Apache Juneau: Internal exception class and message disclosed via error response header and body regardless of secure defaults

Generation of Error Message Containing Sensitive Information vulnerability in Apache Juneau. The REST server sends the internal exception class and message to clients in a "Thrown" response header on every error response, and can include internal exception messages in the error body, even when stack-trace rendering is disabled. This reveals implementation details to remote clients. This issue affects Apache Juneau: through 9.2.0. Users are recommended to upgrade to version 9.2.1, which fixes the issue.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Juneau

CVE-2026-73100

Apache Juneau: Sensitive request headers logged in cleartext by the default request logger on server errors

Insertion of Sensitive Information into Log File vulnerability in Apache Juneau. The default REST server call logger records request headers for requests that end in a server error, without redacting them. Any client able to cause a server error gets headers such as Authorization, Cookie, Proxy-Authorization and X-API-Key written in cleartext to the application log, exposing them to anyone who can read the logs. This issue affects Apache Juneau: through 9.2.0. Users are recommended to upgrade to version 9.2.1, which fixes the issue.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Juneau

CVE-2026-66982

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where browser autocomplete was enabled on sensitive login form fields, allowing the browser to store and suggest previously entered values. A malicious user with access to the same browser or system could retrieve saved credentials, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Aion