Permalink CVE-2026-89087

7.3 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): Low (L)

updated 3 hours ago by @LeSuisse Activity log

• Created suggestion 7 hours ago
• @LeSuisse ignored
  21 packages

  • python313Packages.cstruct
  • python314Packages.cstruct
  • ocamlPackages.cstruct-lwt
  • ocamlPackages.ppx_cstruct
  • ocamlPackages.cstruct-sexp
  • ocamlPackages.cstruct-unix
  • ocamlPackages.eqaf-cstruct
  • ocamlPackages.cstruct-async
  • ocamlPackages.ipaddr-cstruct
  • ocamlPackages_latest.cstruct
  • ocamlPackages.macaddr-cstruct
  • ocamlPackages_latest.cstruct-lwt
  • ocamlPackages_latest.ppx_cstruct
  • ocamlPackages_latest.cstruct-sexp
  • ocamlPackages_latest.cstruct-unix
  • ocamlPackages_latest.eqaf-cstruct
  • python313Packages.dissect-cstruct
  • python314Packages.dissect-cstruct
  • ocamlPackages_latest.cstruct-async
  • ocamlPackages_latest.ipaddr-cstruct
  • ocamlPackages_latest.macaddr-cstruct
  3 hours ago
• @LeSuisse restored package ocamlPackages_latest.cstruct 3 hours ago
• @LeSuisse accepted 3 hours ago
• @LeSuisse published on GitHub 3 hours ago

The cstruct package before 6.3.0 for OCaml mishandles indexes.

• https://osv.dev/vulnerability/OSEC-2026-20

---

cstruct

• <6.3.0

Permalink CVE-2026-89086

9.1 CRITICAL

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 3 hours ago by @LeSuisse Activity log

• Created suggestion 7 hours ago
• @LeSuisse ignored
  14 packages

  • cjose
  • jose
  • haskellPackages.jose
  • haskellPackages.jose-jwt
  • python313Packages.djoser
  • python313Packages.josepy
  • python314Packages.djoser
  • python314Packages.josepy
  • ocamlPackages_latest.jose
  • python313Packages.joserfc
  • python314Packages.joserfc
  • python313Packages.python-jose
  • python314Packages.python-jose
  • home-assistant-custom-components.calendar_export
  3 hours ago
• @LeSuisse restored package ocamlPackages_latest.jose 3 hours ago
• @LeSuisse accepted 3 hours ago
• @LeSuisse published on GitHub 3 hours ago

In the jose package before 0.11.0 for OCaml, library calls …

• https://github.com/ulrikstrid/ocaml-jose/commit/cf17d991ec6a0d1997956b6c7799890…
• https://osv.dev/vulnerability/OSEC-2026-19

---

jose

• <0.11.0

Permalink CVE-2026-88924

7.0 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 3 hours ago by @LeSuisse Activity log

• Created suggestion 7 hours ago
• @LeSuisse ignored
  2 packages

  • gnome.gvfs
  • yaziPlugins.gvfs
  3 hours ago
• @LeSuisse accepted 3 hours ago
• @LeSuisse published on GitHub 3 hours ago

Gvfs: gvfs-admin socket ownership race permits local root

• https://access.redhat.com/security/cve/CVE-2026-88924 vdb-entryx_refsource_REDHAT
• RHBZ#2531456 issue-trackingx_refsource_REDHAT
• https://gitlab.gnome.org/GNOME/gvfs/-/issues/875 exploit

---

gvfs

Patch: https://gitlab.gnome.org/GNOME/gvfs/-/commit/371909dd201eb66c5c4d18d9e88fdae4a070b76a

Permalink CVE-2026-49838

5.9 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 3 hours ago by @LeSuisse Activity log

• Created suggestion 7 hours ago
• @LeSuisse accepted 3 hours ago
• @LeSuisse published on GitHub 3 hours ago

GoBGP confederation validation panics on empty AS_PATH attribute

• https://github.com/osrg/gobgp/security/advisories/GHSA-frrj-87jh-2772 x_refsource_CONFIRM
• https://github.com/osrg/gobgp/commit/4a319a6c25630fb3cdbda3e9ccfe56e702bdaaa0 x_refsource_MISC

---

gobgp

• ==< 4.7.0

Permalink CVE-2026-49837

5.9 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 3 hours ago by @LeSuisse Activity log

• Created suggestion 7 hours ago
• @LeSuisse accepted 3 hours ago
• @LeSuisse published on GitHub 3 hours ago

GoBGP: BGP OPEN capability parser may read capability values outside declared CapLen boundaries

• https://github.com/osrg/gobgp/security/advisories/GHSA-gjrg-jjr3-56cm x_refsource_CONFIRM
• https://github.com/osrg/gobgp/commit/f02ca397821f6ca182ef4eb492c3cbc459552d7c x_refsource_MISC

---

gobgp

• ==< 4.6.0

Needs a bacport

Permalink CVE-2026-88047

8.6 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 hours ago by @LeSuisse Activity log

• Created suggestion 7 hours ago
• @LeSuisse ignored
  7 packages

  • tesseract3
  • tesseract4
  • tesseract5
  • python313Packages.pytesseract
  • python314Packages.pytesseract
  • perlPackages.ImageOCRTesseract
  • perl5Packages.ImageOCRTesseract
  3 hours ago
• @LeSuisse accepted 3 hours ago
• @LeSuisse published on GitHub 3 hours ago

Tesseract: ReadNormProtos stack buffer overflow

• https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-5j2p-r5vc-q7f3 x_refsource_CONFIRM
• https://github.com/tesseract-ocr/tesseract/commit/1bda5079b1c8a7e25f523486837426903d29ce84 x_refsource_MISC

---

tesseract

• ==<= 5.5.3

Permalink CVE-2026-88051

8.6 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 hours ago by @LeSuisse Activity log

• Created suggestion 7 hours ago
• @LeSuisse ignored
  7 packages

  • tesseract3
  • tesseract4
  • tesseract5
  • python313Packages.pytesseract
  • python314Packages.pytesseract
  • perlPackages.ImageOCRTesseract
  • perl5Packages.ImageOCRTesseract
  3 hours ago
• @LeSuisse accepted 3 hours ago
• @LeSuisse published on GitHub 3 hours ago

Tesseract: Heap out-of-bounds write in GenericVector<T>::read due to independent reserved/size_used_ fields

• https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-88qp-4g94-3rf3 x_refsource_CONFIRM
• https://github.com/tesseract-ocr/tesseract/commit/56e09ca12e751623fe796ce1554ce704bffd2ef0 x_refsource_MISC

---

tesseract

• ==<= 5.5.3

Permalink CVE-2026-88049

8.6 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 hours ago by @LeSuisse Activity log

• Created suggestion 7 hours ago
• @LeSuisse ignored
  7 packages

  • tesseract3
  • tesseract4
  • perl5Packages.ImageOCRTesseract
  • tesseract5
  • python313Packages.pytesseract
  • python314Packages.pytesseract
  • perlPackages.ImageOCRTesseract
  3 hours ago
• @LeSuisse accepted 3 hours ago
• @LeSuisse published on GitHub 3 hours ago

Tesseract: Heap out-of-bounds write in LSTM::Forward via na_/gate-matrix dimension mismatch

• https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-jgq8-pprg-vc68 exploitx_refsource_CONFIRM
• https://github.com/tesseract-ocr/tesseract/commit/b494ac18925f9d9aff9ef5815475de9943ab19bf x_refsource_MISC

---

tesseract

• ==<= 5.5.3

Permalink CVE-2026-88050

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 hours ago by @LeSuisse Activity log

• Created suggestion 7 hours ago
• @LeSuisse ignored
  7 packages

  • tesseract3
  • tesseract4
  • tesseract5
  • python313Packages.pytesseract
  • python314Packages.pytesseract
  • perlPackages.ImageOCRTesseract
  • perl5Packages.ImageOCRTesseract
  3 hours ago
• @LeSuisse accepted 3 hours ago
• @LeSuisse published on GitHub 3 hours ago

Tesseract: Out-of-bounds write in UnicharCompress via unvalidated recoder code values

• https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-7v9h-3q3m-w68g exploitx_refsource_CONFIRM
• https://github.com/tesseract-ocr/tesseract/commit/c94a5532ee04db5a4919542832fd94caee5ea58f x_refsource_MISC

---

tesseract

• ==<= 5.5.3

Permalink CVE-2026-88048

8.6 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 hours ago by @LeSuisse Activity log

• Created suggestion 7 hours ago
• @LeSuisse ignored
  7 packages

  • tesseract3
  • tesseract4
  • tesseract5
  • python313Packages.pytesseract
  • python314Packages.pytesseract
  • perlPackages.ImageOCRTesseract
  • perl5Packages.ImageOCRTesseract
  3 hours ago
• @LeSuisse accepted 3 hours ago
• @LeSuisse published on GitHub 3 hours ago

Tesseract: Heap out-of-bounds write/read in FullyConnected::Forward via layer/weight-matrix dimension mismatch

• https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-q44c-23p6-5mw6 x_refsource_CONFIRM
• https://github.com/tesseract-ocr/tesseract/commit/103dc134eb36411ddc6833ec20aa2c76795bd0ff x_refsource_MISC

---

tesseract

• ==<= 5.5.3

Permalink CVE-2026-88054

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 hours ago by @LeSuisse Activity log

• Created suggestion 7 hours ago
• @LeSuisse ignored
  7 packages

  • tesseract3
  • tesseract4
  • tesseract5
  • python313Packages.pytesseract
  • python314Packages.pytesseract
  • perlPackages.ImageOCRTesseract
  • perl5Packages.ImageOCRTesseract
  3 hours ago
• @LeSuisse accepted 3 hours ago
• @LeSuisse published on GitHub 3 hours ago

Tesseract: Denial of service via empty-stack dereference in Plumbing/Series at model load

• https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-f6h7-cqr4-6fx4 exploitx_refsource_CONFIRM
• https://github.com/tesseract-ocr/tesseract/commit/552771236b0d80cbdb0c7dd856120fa21a4672e5 x_refsource_MISC

---

tesseract

• ==<= 5.5.3

Permalink CVE-2026-88052

7.8 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 3 hours ago by @LeSuisse Activity log

• Created suggestion 7 hours ago
• @LeSuisse ignored
  7 packages

  • tesseract3
  • tesseract4
  • tesseract5
  • python313Packages.pytesseract
  • python314Packages.pytesseract
  • perlPackages.ImageOCRTesseract
  • perl5Packages.ImageOCRTesseract
  3 hours ago
• @LeSuisse accepted 3 hours ago
• @LeSuisse published on GitHub 3 hours ago

Tesseract: Heap out-of-bounds write in UNICHARSET::load_via_fgets via count/insert desynchronization

• https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-2hm8-q5c7-c373 x_refsource_CONFIRM
• https://github.com/tesseract-ocr/tesseract/commit/2d04d640db2e8c7e3bab2369d599343b5a8b8443 x_refsource_MISC

---

tesseract

• ==<= 5.5.3

Permalink CVE-2026-88053

8.6 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 hours ago by @LeSuisse Activity log

• Created suggestion 7 hours ago
• @LeSuisse ignored
  7 packages

  • tesseract3
  • tesseract4
  • tesseract5
  • python313Packages.pytesseract
  • python314Packages.pytesseract
  • perlPackages.ImageOCRTesseract
  • perl5Packages.ImageOCRTesseract
  4 hours ago
• @LeSuisse accepted 4 hours ago
• @LeSuisse published on GitHub 3 hours ago

Tesseract: Heap out-of-bounds write in Classify::ReadIntTemplates via unvalidated counts in crafted .traineddata

• https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-rphx-x795-5qjv x_refsource_CONFIRM
• https://github.com/tesseract-ocr/tesseract/commit/8b0574680f3b22f246ade6a4c8e3029104255c63 x_refsource_MISC

---

tesseract

• ==<= 5.5.3

Needs a backport

Permalink CVE-2026-88008

7.0 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): High (H)
• Subsequent System Impact Integrity (SI): High (H)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): High (H)
• Modified Subsequent System Impact Integrity (MSI): High (H)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 hours ago by @LeSuisse Activity log

• Created suggestion 7 hours ago
• @LeSuisse ignored package traefik-certs-dumper 3 hours ago
• @LeSuisse accepted 3 hours ago
• @LeSuisse published on GitHub 3 hours ago

Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization

• https://github.com/traefik/traefik/security/advisories/GHSA-w4v4-9rw7-5326 x_refsource_CONFIRM
• https://github.com/traefik/traefik/pull/13797 x_refsource_MISC
• https://github.com/traefik/traefik/commit/a277e94664ffc1ce9543df552d3bbf48d4d3b8b3 x_refsource_MISC
• https://github.com/traefik/traefik/releases/tag/v2.11.57 x_refsource_MISC
• https://github.com/traefik/traefik/releases/tag/v3.7.13 x_refsource_MISC

---

traefik

• ==>= 3.4.2, < 3.7.13
• ==>= 2.11.26, < 2.11.57

Permalink CVE-2026-88012

5.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated 3 hours ago by @LeSuisse Activity log

• Created suggestion 7 hours ago
• @LeSuisse ignored package traefik-certs-dumper 3 hours ago
• @LeSuisse accepted 3 hours ago
• @LeSuisse published on GitHub 3 hours ago

Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded

• https://github.com/traefik/traefik/security/advisories/GHSA-7ghq-v6jf-g56c x_refsource_CONFIRM
• https://github.com/traefik/traefik/pull/13717 x_refsource_MISC
• https://github.com/traefik/traefik/commit/a8d0bc425859dde7481a6c9a324e610b81d754d0 x_refsource_MISC
• https://github.com/traefik/traefik/releases/tag/v2.11.56 x_refsource_MISC
• https://github.com/traefik/traefik/releases/tag/v3.7.12 x_refsource_MISC

---

traefik

• ==>= 3.0.0, < 3.7.12
• ==>= 2.8.2, < 2.11.56

Permalink CVE-2026-88004

7.0 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): High (H)
• Subsequent System Impact Integrity (SI): High (H)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): High (H)
• Modified Subsequent System Impact Integrity (MSI): High (H)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 hours ago by @LeSuisse Activity log

• Created suggestion 7 hours ago
• @LeSuisse ignored package traefik-certs-dumper 3 hours ago
• @LeSuisse accepted 3 hours ago
• @LeSuisse published on GitHub 3 hours ago

Traefik entrypoint header-name sanitization bypassed via request trailers

• https://github.com/traefik/traefik/security/advisories/GHSA-v67p-phpq-fc8x x_refsource_CONFIRM
• https://github.com/traefik/traefik/pull/13822 x_refsource_MISC
• https://github.com/traefik/traefik/commit/55bbda4f65e0f9c533c870983a767a7081126db7 x_refsource_MISC
• https://github.com/traefik/traefik/releases/tag/v3.7.13 x_refsource_MISC

---

traefik

• ==>= 3.2.0, < 3.7.13

Permalink CVE-2026-88007

9.1 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 hours ago by @LeSuisse Activity log

• Created suggestion 7 hours ago
• @LeSuisse ignored package traefik-certs-dumper 3 hours ago
• @LeSuisse accepted 3 hours ago
• @LeSuisse published on GitHub 3 hours ago

Traefik HTTP/3 Backend NTLM Connection Reuse

• https://github.com/traefik/traefik/security/advisories/GHSA-qqjf-53cj-pwvv x_refsource_CONFIRM
• https://github.com/traefik/traefik/pull/13812 x_refsource_MISC
• https://github.com/traefik/traefik/commit/ff39c47d7459dec9cd8de63c1a4e7aa7315bdc1c x_refsource_MISC
• https://github.com/traefik/traefik/releases/tag/v2.11.57 x_refsource_MISC
• https://github.com/traefik/traefik/releases/tag/v3.7.13 x_refsource_MISC

---

traefik

• ==>= 3.0.0, < 3.7.13
• ==>= 2.11.0, < 2.11.57

Permalink CVE-2026-88878

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 hours ago by @LeSuisse Activity log

• Created suggestion 7 hours ago
• @LeSuisse ignored package traefik-certs-dumper 3 hours ago
• @LeSuisse accepted 3 hours ago
• @LeSuisse published on GitHub 3 hours ago

Traefik v2.8.2 through v3.6 HTTP/3 Timeout Bypass

• GitHub Security Advisory (GHSA-7ghq-v6jf-g56c) vendor-advisory
• VulnCheck Advisory: Traefik v2.8.2 through v3.6 HTTP/3 Timeout Bypass third-party-advisory

---

traefik

• =<3.7.13

Permalink CVE-2026-88009

8.8 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 hours ago by @LeSuisse Activity log

• Created suggestion 7 hours ago
• @LeSuisse ignored package traefik-certs-dumper 3 hours ago
• @LeSuisse accepted 3 hours ago
• @LeSuisse published on GitHub 3 hours ago

Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging

• https://github.com/traefik/traefik/security/advisories/GHSA-f52w-8j3h-j724 x_refsource_CONFIRM
• https://github.com/traefik/traefik/pull/13796 x_refsource_MISC
• https://github.com/traefik/traefik/commit/58d1e9ca204526823211e30fd4634101c59d58e9 x_refsource_MISC
• https://github.com/traefik/traefik/releases/tag/v2.11.57 x_refsource_MISC
• https://github.com/traefik/traefik/releases/tag/v3.7.13 x_refsource_MISC

---

traefik

• ==>= 3.0.0, < 3.7.13
• ==< 2.11.57

Permalink CVE-2026-88011

5.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): High (H)
• Subsequent System Impact Integrity (SI): High (H)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): High (H)
• Modified Subsequent System Impact Integrity (MSI): High (H)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 hours ago by @LeSuisse Activity log

• Created suggestion 7 hours ago
• @LeSuisse ignored package traefik-certs-dumper 3 hours ago
• @LeSuisse accepted 3 hours ago
• @LeSuisse published on GitHub 3 hours ago

Traefik: ForwardAuth identity spoofing via dot-form header alias

• https://github.com/traefik/traefik/security/advisories/GHSA-rf44-j88r-hh8c x_refsource_CONFIRM
• https://github.com/traefik/traefik/pull/13720 x_refsource_MISC
• https://github.com/traefik/traefik/commit/0331801c72329e0eaeb850e53ccce87c57fbecf8 x_refsource_MISC
• https://github.com/traefik/traefik/releases/tag/v2.11.56 x_refsource_MISC
• https://github.com/traefik/traefik/releases/tag/v3.7.12 x_refsource_MISC

---

traefik

• ==< 2.11.56
• ==>= 3.0.0, < 3.7.12

Permalink CVE-2026-88879

5.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): High (H)
• Subsequent System Impact Integrity (SI): High (H)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): High (H)
• Modified Subsequent System Impact Integrity (MSI): High (H)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 hours ago by @LeSuisse Activity log

• Created suggestion 7 hours ago
• @LeSuisse ignored package traefik-certs-dumper 3 hours ago
• @LeSuisse accepted 3 hours ago
• @LeSuisse published on GitHub 3 hours ago

Traefik before v2.11.56 Identity Spoofing via Header Alias

• GitHub Security Advisory (GHSA-rf44-j88r-hh8c) vendor-advisory
• VulnCheck Advisory: Traefik before v2.11.56 Identity Spoofing via Header Alias third-party-advisory

---

traefik

• =<3.7.13
• ==2.11.56
• <2.11.56

Permalink CVE-2026-88877

9.3 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 hours ago by @LeSuisse Activity log

• Created suggestion 7 hours ago
• @LeSuisse accepted 3 hours ago
• @LeSuisse ignored package traefik-certs-dumper 3 hours ago
• @LeSuisse published on GitHub 3 hours ago

Traefik v3.7.0 Authentication Bypass via from-to-www-redirect

• GitHub Security Advisory (GHSA-cjr6-pf59-jq29) vendor-advisory
• VulnCheck Advisory: Traefik v3.7.0 Authentication Bypass via from-to-www-redirect third-party-advisory

---

traefik

• =<3.7.13

Permalink CVE-2026-87090

8.3 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 3 hours ago by @LeSuisse Activity log

• Created suggestion 7 hours ago
• @LeSuisse ignored
  8 packages

  • envconsul
  • consul-alerts
  • consul-template
  • python313Packages.consul
  • python314Packages.consul
  • prometheus-consul-exporter
  • terraform-providers.consul
  • terraform-providers.hashicorp_consul
  3 hours ago
• @LeSuisse accepted 3 hours ago
• @LeSuisse published on GitHub 3 hours ago

Consul vulnerable to an authorization bypass in the catalog node-write path

• https://discuss.hashicorp.com/t/hcsec-2026-34-consul-vulnerable-to-an-authoriza…

---

Consul

• <2.0.4

Consul Enterprise

• <2.0.4

Permalink CVE-2026-88021

7.1 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 3 hours ago by @LeSuisse Activity log

• Created suggestion 7 hours ago
• @LeSuisse ignored
  8 packages

  • envconsul
  • consul-alerts
  • consul-template
  • python313Packages.consul
  • python314Packages.consul
  • prometheus-consul-exporter
  • terraform-providers.consul
  • terraform-providers.hashicorp_consul
  4 hours ago
• @LeSuisse accepted 4 hours ago
• @LeSuisse published on GitHub 3 hours ago

Consul vulnerable to an authorization bypass in the Connect service mesh

• https://discuss.hashicorp.com/t/hcsec-2026-37-consul-vulnerable-to-an-authoriza…

---

Consul

• <2.0.4

Consul Enterprise

• <2.0.4

Permalink CVE-2026-87106

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 3 hours ago by @LeSuisse Activity log

• Created suggestion 7 hours ago
• @LeSuisse ignored
  8 packages

  • envconsul
  • consul-alerts
  • consul-template
  • python313Packages.consul
  • python314Packages.consul
  • prometheus-consul-exporter
  • terraform-providers.consul
  • terraform-providers.hashicorp_consul
  4 hours ago
• @LeSuisse accepted 4 hours ago
• @LeSuisse published on GitHub 3 hours ago

Consul vulnerable to a denial of service in the native RPC listener

• https://discuss.hashicorp.com/t/hcsec-2026-35-consul-vulnerable-to-a-denial-of-…

---

Consul

• <2.0.4

Consul Enterprise

• <2.0.4

Permalink CVE-2026-87107

5.4 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): Low (L)

updated 3 hours ago by @LeSuisse Activity log

• Created suggestion 7 hours ago
• @LeSuisse ignored
  8 packages

  • envconsul
  • consul-alerts
  • consul-template
  • python313Packages.consul
  • python314Packages.consul
  • prometheus-consul-exporter
  • terraform-providers.consul
  • terraform-providers.hashicorp_consul
  4 hours ago
• @LeSuisse accepted 4 hours ago
• @LeSuisse published on GitHub 3 hours ago

Consul vulnerable to an authorization bypass in the catalog deregistration path

• https://discuss.hashicorp.com/t/hcsec-2026-36-consul-vulnerable-to-an-authoriza…

---

Consul

• <2.0.4

Consul Enterprise

• <2.0.4

Permalink CVE-2026-45762

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 4 hours ago by @LeSuisse Activity log

• Created suggestion 7 hours ago
• @LeSuisse accepted 4 hours ago
• @LeSuisse published on GitHub 4 hours ago

Suricata defrag: missing address-family check can lead to remote crash

• https://github.com/OISF/suricata/security/advisories/GHSA-gv2j-f6jv-3878 x_refsource_CONFIRM
• https://forum.suricata.io/t/suricata-8-0-5-and-7-0-16-released/6315 x_refsource_MISC
• https://redmine.openinfosecfoundation.org/issues/8510 x_refsource_MISC

---

suricata

• ==< 7.0.16
• ==>= 8.0.0, < 8.0.5

Permalink CVE-2026-45766

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 4 hours ago by @LeSuisse Activity log

• Created suggestion 7 hours ago
• @LeSuisse accepted 4 hours ago
• @LeSuisse published on GitHub 4 hours ago

Suricata nfs: unbounded stateful structures can lead to resource exhaustion

• https://github.com/OISF/suricata/security/advisories/GHSA-jqr4-ch38-wvm6 x_refsource_CONFIRM
• https://forum.suricata.io/t/suricata-8-0-5-and-7-0-16-released/6315 x_refsource_MISC
• https://redmine.openinfosecfoundation.org/issues/8418 x_refsource_MISC

---

suricata

• ==< 7.0.16
• ==>= 8.0.0, < 8.0.5

Permalink CVE-2026-45767

4.4 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): High (H)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): High (H)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 4 hours ago by @LeSuisse Activity log

• Created suggestion 7 hours ago
• @LeSuisse accepted 4 hours ago
• @LeSuisse published on GitHub 4 hours ago

Suricata datasets: save to absolute filename can be bypassed when combined with load command

• https://github.com/OISF/suricata/security/advisories/GHSA-gfxq-gffp-w9rv x_refsource_CONFIRM
• https://forum.suricata.io/t/suricata-8-0-5-and-7-0-16-released/6315 x_refsource_MISC
• https://redmine.openinfosecfoundation.org/issues/8546 x_refsource_MISC

---

suricata

• ==< 7.0.16
• ==>= 8.0.0, < 8.0.5

Permalink CVE-2026-45752

5.9 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 4 hours ago by @LeSuisse Activity log

• Created suggestion 7 hours ago
• @LeSuisse accepted 4 hours ago
• @LeSuisse published on GitHub 4 hours ago

Suricata detect/transform: use-after-free in decompress transforms

• https://github.com/OISF/suricata/security/advisories/GHSA-qmc9-vqq2-8mv3 x_refsource_CONFIRM
• https://forum.suricata.io/t/suricata-8-0-5-and-7-0-16-released/6315 x_refsource_MISC
• https://redmine.openinfosecfoundation.org/issues/8536 x_refsource_MISC

---

suricata

• ==>= 8.0.0, < 8.0.5

Permalink CVE-2026-45763

5.9 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 4 hours ago by @LeSuisse Activity log

• Created suggestion 7 hours ago
• @LeSuisse accepted 4 hours ago
• @LeSuisse published on GitHub 4 hours ago

Suricata lua: sandbox allocation limit not enforced for new allocations

• https://github.com/OISF/suricata/security/advisories/GHSA-9h43-frr8-xx6m x_refsource_CONFIRM
• https://forum.suricata.io/t/suricata-8-0-5-and-7-0-16-released/6315 x_refsource_MISC
• https://redmine.openinfosecfoundation.org/issues/8507 x_refsource_MISC

---

suricata

• ==>= 8.0.0, < 8.0.5

Permalink CVE-2026-46387

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 4 hours ago by @LeSuisse Activity log

• Created suggestion 7 hours ago
• @LeSuisse accepted 4 hours ago
• @LeSuisse published on GitHub 4 hours ago

Suricata http2: decompression bomb can cause denial of service in Suricata

• https://github.com/OISF/suricata/security/advisories/GHSA-45p7-j5wm-8wrx x_refsource_CONFIRM
• https://forum.suricata.io/t/suricata-8-0-5-and-7-0-16-released/6315 x_refsource_MISC
• https://redmine.openinfosecfoundation.org/issues/8513 x_refsource_MISC

---

suricata

• ==< 7.0.16
• ==>= 8.0.0, < 8.0.5

Permalink CVE-2026-45751

5.9 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 4 hours ago by @LeSuisse Activity log

• Created suggestion 7 hours ago
• @LeSuisse accepted 4 hours ago
• @LeSuisse published on GitHub 4 hours ago

Suricata detect/transform: use-after-free in dotprefix transform

• https://github.com/OISF/suricata/security/advisories/GHSA-59q6-j4w8-8pjx x_refsource_CONFIRM
• https://forum.suricata.io/t/suricata-8-0-5-and-7-0-16-released/6315 x_refsource_MISC
• https://redmine.openinfosecfoundation.org/issues/8537 x_refsource_MISC

---

suricata

• ==< 7.0.16
• ==>= 8.0.0, < 8.0.5

Permalink CVE-2026-45770

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 4 hours ago by @LeSuisse Activity log

• Created suggestion 7 hours ago
• @LeSuisse accepted 4 hours ago
• @LeSuisse published on GitHub 4 hours ago

Suricata lua: excessive flow variable registration can bypass sandbox

• https://github.com/OISF/suricata/security/advisories/GHSA-653j-cc95-vj4c x_refsource_CONFIRM
• https://forum.suricata.io/t/suricata-8-0-5-and-7-0-16-released/6315 x_refsource_MISC
• https://redmine.openinfosecfoundation.org/issues/8556 x_refsource_MISC

---

suricata

• ==>= 8.0.0, < 8.0.5

Permalink CVE-2026-45764

9.1 CRITICAL

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 4 hours ago by @LeSuisse Activity log

• Created suggestion 7 hours ago
• @LeSuisse accepted 4 hours ago
• @LeSuisse published on GitHub 4 hours ago

Suricata http2: protocol-change type confusion can lead to denial of service

• https://github.com/OISF/suricata/security/advisories/GHSA-5rvq-72r5-rqhr x_refsource_CONFIRM
• https://forum.suricata.io/t/suricata-8-0-5-and-7-0-16-released/6315 x_refsource_MISC
• https://redmine.openinfosecfoundation.org/issues/8492 x_refsource_MISC

---

suricata

• ==< 7.0.16
• ==>= 8.0.0, < 8.0.5

Permalink CVE-2026-45768

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 4 hours ago by @LeSuisse Activity log

• Created suggestion 7 hours ago
• @LeSuisse accepted 4 hours ago
• @LeSuisse published on GitHub 4 hours ago

Suricata ldap: unbounded responses per transaction can lead to resource exhaustion

• https://github.com/OISF/suricata/security/advisories/GHSA-cr4x-w4c4-57p7 x_refsource_CONFIRM
• https://forum.suricata.io/t/suricata-8-0-5-and-7-0-16-released/6315 x_refsource_MISC
• https://redmine.openinfosecfoundation.org/issues/8405 x_refsource_MISC

---

suricata

• ==>= 8.0.0, < 8.0.5

Permalink CVE-2026-45759

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 4 hours ago by @LeSuisse Activity log

• Created suggestion 7 hours ago
• @LeSuisse accepted 4 hours ago
• @LeSuisse published on GitHub 4 hours ago

Suricata http1: quadratic Content-Disposition processing can lead to denial of service

• https://github.com/OISF/suricata/security/advisories/GHSA-cfq5-g2v5-6652 x_refsource_CONFIRM
• https://forum.suricata.io/t/suricata-8-0-5-and-7-0-16-released/6315 x_refsource_MISC
• https://redmine.openinfosecfoundation.org/issues/8529 x_refsource_MISC

---

suricata

• ==< 7.0.16
• ==>= 8.0.0, < 8.0.5

Permalink CVE-2026-45765

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 4 hours ago by @LeSuisse Activity log

• Created suggestion 7 hours ago
• @LeSuisse accepted 4 hours ago
• @LeSuisse published on GitHub 4 hours ago

Suricata dnp3: unbounded reassembly can lead to resource exhaustion

• https://github.com/OISF/suricata/security/advisories/GHSA-m8x4-c78g-r4vj x_refsource_CONFIRM
• https://forum.suricata.io/t/suricata-8-0-5-and-7-0-16-released/6315 x_refsource_MISC
• https://redmine.openinfosecfoundation.org/issues/8460 x_refsource_MISC

---

suricata

• ==< 7.0.16
• ==>= 8.0.0, < 8.0.5

Permalink CVE-2026-45761

3.3 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated 4 hours ago by @LeSuisse Activity log

• Created suggestion 7 hours ago
• @LeSuisse accepted 4 hours ago
• @LeSuisse published on GitHub 4 hours ago

Suricata detect: case-insensitive frame handling can cause heap buffer overflow during rule load

• https://github.com/OISF/suricata/security/advisories/GHSA-r74x-74x5-r9vm x_refsource_CONFIRM
• https://forum.suricata.io/t/suricata-8-0-5-and-7-0-16-released/6315 x_refsource_MISC
• https://redmine.openinfosecfoundation.org/issues/8526 x_refsource_MISC

---

suricata

• ==< 7.0.16
• ==>= 8.0.0, < 8.0.5

Permalink CVE-2026-45769

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 4 hours ago by @LeSuisse Activity log

• Created suggestion 7 hours ago
• @LeSuisse accepted 4 hours ago
• @LeSuisse published on GitHub 4 hours ago

ikev2: unbounded client transform storage can lead to resource exhaustion

• https://github.com/OISF/suricata/security/advisories/GHSA-hg2g-r464-5593 x_refsource_CONFIRM
• https://forum.suricata.io/t/suricata-8-0-5-and-7-0-16-released/6315 x_refsource_MISC
• https://redmine.openinfosecfoundation.org/issues/8415 x_refsource_MISC

---

suricata

• ==< 7.0.16
• ==>= 8.0.0, < 8.0.5

Permalink CVE-2026-88885

7.3 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 4 hours ago by @LeSuisse Activity log

• Created suggestion 7 hours ago
• @LeSuisse accepted 4 hours ago
• @LeSuisse published on GitHub 4 hours ago

Renovate before 44.14.7 Command Injection via depName

• GitHub Security Advisory (GHSA-mpf8-qxrw-gq3w) vendor-advisory
• VulnCheck Advisory: Renovate before 44.14.7 Command Injection via depName third-party-advisory

---

renovate

• <15.4.0
• <44.14.7
• <10.4.0
• ==44.14.7
• ==10.4.0
• ==15.4.0

Permalink CVE-2026-88882

9.2 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): High (H)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): High (H)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 4 hours ago by @LeSuisse Activity log

• Created suggestion 7 hours ago
• @LeSuisse accepted 4 hours ago
• @LeSuisse published on GitHub 4 hours ago

Renovate before 44.11.2 Credential Exfiltration via Link Header

• GitHub Security Advisory (GHSA-rh7w-ccch-gh49) vendor-advisory
• VulnCheck Advisory: Renovate before 44.11.2 Credential Exfiltration via Link Header third-party-advisory

---

renovate

• <15.4.0
• <10.4.0
• <44.11.2
• ==10.4.0
• ==15.4.0
• ==44.11.2

Permalink CVE-2026-88884

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): Low (L)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Low (L)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 4 hours ago by @LeSuisse Activity log

• Created suggestion 7 hours ago
• @LeSuisse accepted 4 hours ago
• @LeSuisse published on GitHub 4 hours ago

Renovate before 44.3.1 Authentication Bypass via Digest Updates

• GitHub Security Advisory (GHSA-g4qr-hw2h-687r) vendor-advisory
• VulnCheck Advisory: Renovate before 44.3.1 Authentication Bypass via Digest Updates third-party-advisory

---

renovate

• <15.4.0
• <44.3.1
• <10.4.0
• ==44.3.1
• ==10.4.0
• ==15.4.0

Permalink CVE-2026-88889

8.5 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 4 hours ago by @LeSuisse Activity log

• Created suggestion 7 hours ago
• @LeSuisse accepted 4 hours ago
• @LeSuisse published on GitHub 4 hours ago

Renovate before 44.14.7 Command Injection via distributionType

• GitHub Security Advisory (GHSA-f2v7-35mm-3hx7) vendor-advisory
• VulnCheck Advisory: Renovate before 44.14.7 Command Injection via distributionType third-party-advisory

---

renovate

• <15.4.0
• <44.14.7
• <10.4.0
• ==44.14.7
• ==10.4.0
• ==15.4.0

Permalink CVE-2026-88880

9.2 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): High (H)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): High (H)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 4 hours ago by @LeSuisse Activity log

• Created suggestion 7 hours ago
• @LeSuisse accepted 4 hours ago
• @LeSuisse published on GitHub 4 hours ago

Renovate before 44.11.3 Credential Exfiltration via Link Header

• GitHub Security Advisory (GHSA-9hmg-9h89-jhmx) vendor-advisory
• VulnCheck Advisory: Renovate before 44.11.3 Credential Exfiltration via Link Header third-party-advisory

---

renovate

• <15.4.0
• <44.11.3
• <10.4.0
• ==44.11.3
• ==10.4.0
• ==15.4.0

Permalink CVE-2026-88881

9.2 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): High (H)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): High (H)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 4 hours ago by @LeSuisse Activity log

• Created suggestion 7 hours ago
• @LeSuisse accepted 4 hours ago
• @LeSuisse published on GitHub 4 hours ago

Renovate before 44.11.3 Credential Exfiltration via Link Header

• GitHub Security Advisory (GHSA-w57v-h33h-835c) vendor-advisory
• VulnCheck Advisory: Renovate before 44.11.3 Credential Exfiltration via Link Header third-party-advisory

---

renovate

• <15.4.0
• <44.11.3
• <10.4.0
• ==44.11.3
• ==10.4.0
• ==15.4.0

Permalink CVE-2026-88886

8.5 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 4 hours ago by @LeSuisse Activity log

• Created suggestion 7 hours ago
• @LeSuisse accepted 4 hours ago
• @LeSuisse published on GitHub 4 hours ago

Renovate before 44.14.7 Command Injection via gradle-wrapper

• GitHub Security Advisory (GHSA-7chm-46wx-888m) vendor-advisory
• VulnCheck Advisory: Renovate before 44.14.7 Command Injection via gradle-wrapper third-party-advisory

---

renovate

• <15.4.0
• <44.14.7
• <10.4.0
• ==44.14.7
• ==10.4.0
• ==15.4.0

Permalink CVE-2026-88887

9.2 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): High (H)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): High (H)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 4 hours ago by @LeSuisse Activity log

• Created suggestion 7 hours ago
• @LeSuisse accepted 4 hours ago
• @LeSuisse published on GitHub 4 hours ago

Renovate before 44.11.2 Credential Exfiltration via Link Header

• GitHub Security Advisory (GHSA-v73q-hvqx-hxwx) vendor-advisory
• VulnCheck Advisory: Renovate before 44.11.2 Credential Exfiltration via Link Header third-party-advisory

---

renovate

• <15.4.0
• <10.4.0
• <44.11.2
• ==10.4.0
• ==15.4.0
• ==44.11.2

Permalink CVE-2026-88883

8.3 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): High (H)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): High (H)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 4 hours ago by @LeSuisse Activity log

• Created suggestion 7 hours ago
• @LeSuisse accepted 4 hours ago
• @LeSuisse published on GitHub 4 hours ago

Renovate before 44.14.4 TLS Private Key Log Sanitisation

• GitHub Security Advisory (GHSA-4hmw-qw74-vrhm) vendor-advisory
• VulnCheck Advisory: Renovate before 44.14.4 TLS Private Key Log Sanitisation third-party-advisory

---

renovate

• <15.4.0
• <10.4.0
• <44.14.44
• ==44.14.44
• ==10.4.0
• ==15.4.0

Permalink CVE-2026-88888

7.3 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 4 hours ago by @LeSuisse Activity log

• Created suggestion 7 hours ago
• @LeSuisse accepted 4 hours ago
• @LeSuisse published on GitHub 4 hours ago

Renovate before 44.14.7 Command Injection via Mix organization

• GitHub Security Advisory (GHSA-v85g-rq5w-c46q) vendor-advisory
• VulnCheck Advisory: Renovate before 44.14.7 Command Injection via Mix organization third-party-advisory

---

renovate

• <15.4.0
• <44.14.7
• <10.4.0
• ==44.14.7
• ==10.4.0
• ==15.4.0

Permalink CVE-2026-89094

9.9 CRITICAL

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 4 hours ago by @LeSuisse Activity log

• Created suggestion 7 hours ago
• @LeSuisse ignored
  3 packages

  • forgejo-cli
  • forgejo-mcp
  • forgejo-runner
  4 hours ago
• @LeSuisse accepted 4 hours ago
• @LeSuisse published on GitHub 4 hours ago

Forgejo before 16.0.4 allows remote code execution via a crafted …

• https://news.ycombinator.com/item?id=49645907
• https://codeberg.org/forgejo/forgejo/milestone/139655

---

Forgejo

• <15.0.8
• <16.0.4