CVE Notifier

CVE-2026-8674 CWE-617 5.3

Assertion failure in the DNS stub resolver with a long search domain

Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 res…

cve.org The · GNU · C 3 hari lalu

CVE-2026-54578 CWE-354 N/A

mport verify can compare stale checksum data after hashing failures

mport is the MidnightBSD Package Manager. Prior to 2.7.8, mport_verify_package() in libmport/verify.c could continue after MD5File() or SHA256_File() failed and compare an expected checksum with stale data in the hash bu…

cve.org MidnightBSD:mport 3 hari lalu

CVE-2026-54586 CWE-319 N/A

mport permits repository and package mirror fetches over insecure transport

mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mport_fetch_index(), mport_fetch_bootstrap_index(), and mport_fetch_bundle() paths in libmport/fetch.c accepted non-HTTPS repository and package mirror URLs w…

cve.org MidnightBSD:mport 3 hari lalu

CVE-2026-54585 CWE-22 N/A

mport sample file handling can write outside the configured root

mport is the MidnightBSD Package Manager. Prior to 2.7.8, create_sample_file() in libmport/bundle_read_install_pkg.c did not constrain absolute source and destination paths from the sample-file manifest directive to mpor…

cve.org MidnightBSD:mport 3 hari lalu

CVE-2026-54580 CWE-354 N/A

mport index decompression can leave partial or corrupt index data after zstd failures

mport is the MidnightBSD Package Manager. Prior to 2.7.8, libmport/util.c did not make every truncated, corrupt, or failed zstd stream fatal in mport_decompress_zstd(), and libmport/fetch.c did not consistently propagate…

cve.org MidnightBSD:mport 3 hari lalu

CVE-2026-54582 CWE-73 N/A

mport package installation can overwrite existing unmanaged or differently owned files

mport is the MidnightBSD Package Manager. Prior to 2.7.8, package installation lacked a preflight check for incoming non-directory assets that already existed on disk. The affected logic across libmport/check_preconditio…

cve.org MidnightBSD:mport 3 hari lalu

CVE-2026-54577 CWE-20 N/A

mport audit can inspect the wrong package when options are present

mport is the MidnightBSD Package Manager. Prior to 2.7.8, the audit command in mport/mport.c computed option-adjusted local_argv and local_argc values but passed the original argument entry to audit_package(). When an op…

cve.org MidnightBSD:mport 3 hari lalu

CVE-2026-54583 CWE-22 N/A

mport package bundle downloads allow unsafe destination filenames

mport is the MidnightBSD Package Manager. Prior to 2.7.8, libmport/fetch.c did not consistently reject empty, dot, dot-dot, or slash-containing bundle filenames before composing package download and write paths. Maliciou…

cve.org MidnightBSD:mport 3 hari lalu

CVE-2026-54581 CWE-345 N/A

mport bootstrap index fetch can continue after hash verification failure

mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mport_fetch_bootstrap_index() function in libmport/fetch.c could return success when bootstrap index hash verification encountered a missing or invalid hash b…

cve.org MidnightBSD:mport 3 hari lalu

CVE-2026-28326 CWE-321 8.8

SolarWinds Access Rights Manager Unauthenticated Remote Code Execution Vulnerability

SolarWinds Access Rights Manager was reported to be affected by an unauthenticated remote code execution vulnerability. The issue stems from a hardcoded static key.

cve.org SolarWinds:Access · Rights · Manager 3 hari lalu

CVE-2026-93296 CWE-79 N/A

MISP Overmind: Stored Cross-Site Scripting via Unescaped Object Names in Statistics Legends

MISP contains a stored cross-site scripting (XSS) vulnerability in the Overmind theme's statistics views. The event General card (event_general.ctp) and the server/feed preview card (preview_general.ctp) constructed donu…

cve.org misp:misp 3 hari lalu

CVE-2026-93292 CWE-89 8.5

SigNoz 0.88.0 before 0.142.1 - SQL Injection in Trace Funnel Analytics Query Builders

SigNoz versions from 0.88.0 before 0.142.1 contain a SQL injection vulnerability in trace-funnel analytics endpoints that interpolate service_name and span_name fields into ClickHouse string literals without escaping. Au…

cve.org SigNoz:signoz 3 hari lalu