漏洞公告

OpenTelemetry eBPF Instrumentation: Unbounded BPF internal metrics replay can exhaust CPU

Microsoft Security Advisory CVE-2026-35433 – .NET Elevation of Privilege Vulnerability

Microsoft Security Advisory CVE-2026-42899 – ASP.NET Core Denial of Service Vulnerability

Microsoft Security Advisory CVE-2026-32175 – .NET Core Tampering Vulnerability

ws: Uninitialized memory disclosure

AVideo: Authenticated Arbitrary File Read in view/update.php

ChromaDB Python project has a pre-authentication code injection vulnerability

ngrok is Vulnerable to Command Injection

OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads

OpenTelemetry eBPF Instrumentation: Redis error text is exported in span status messages

OpenTelemetry eBPF Instrumentation: Unsafe fastelf parsing allows malformed ELF to crash agent

Broken dropper in @mistralai/mistralai, @mistralai/mistralai-azure, @mistralai/mistralai-gcp

Malicious dropper in mistralai 2.4.6 PyPI package

ImageMagick: Policy Bypass in PSD decoder

Postgrex: Channel-name SQL injection in `Postgrex.Notifications.listen/3`

Docker: Race condition in docker cp allows bind mount redirection to host path

Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap

CloakBrowser: Unauthenticated path traversal via fingerprint parameter in cloakserve leads to arbitrary directory deletion

ImageMagick: Out-of-Bounds Read of a single byte in meta encoder

ImageMagick: Out-of-Bounds Read in connected components when the user supplies an invalid keep-top define

Budibase: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views API

Docker: `PUT /containers/{id}/archive` executes container binary on the host

Budibase: Row Action Trigger Bypasses View Row Filter Security Boundary Allowing Action on Out-of-Scope Rows