[SECURITY] [DLA 4778-1] pyasn1 security update

Debian LTS Advisory DLA-4778-1 [email protected] https://www.debian.org/lts/security/ Emmanuel Arias September 09, 2026 https://wiki.debian.org/LTS Package : pyasn1 Version : 0.4.8-3+deb12u3 CVE ID : CVE-2026-59884 CVE-2026-59885 CVE-2026-59886 Debian Bug : 1142388 It was discovered tha...

Unchecked Return Value

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Unchecked Return Value in the store process. An attacker can cause acceptance records to be finalized without supporting evidence files by completing an acceptance while the...

Unchecked Return Value

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Unchecked Return Value in the handleImages process. An attacker can cause unrecoverable loss of existing images and create a persistent inconsistency between the database an...

CVE-2026-86749

Snipe-IT versions put... call still caused the application to delete the previous image via deleteExistingImage and to reassign and persist the model's image reference to the new filename, destroying the existing image and leaving the database row pointing at a file that was never written. A mirr...

CVE-2026-86740

Snipe-IT before 8.7.0 fails to check the return value of Storage::delete in UploadedFilesController::destroy and Api\UploadedFilesController::destroy, allowing deletion requests to report success while files remain on disk. Administrators performing attachment deletions receive success responses...

CVE-2026-86739

Snipe-IT 8.6.3 and earlier do not check the return value of Storage::put when writing the signature PNG and the generated acceptance PDF in Account\AcceptanceController::store. On filesystem drivers that return false instead of throwing on a write failure for example the local disk with restricti...

Exploit for CVE-2026-79387

CVE-2026-79387: SQL Injection in PbootCMS V3.2.5 User Manageme...

EUVD-2026-74926

Snipe-IT versions put... call still caused the application to delete the previous image via deleteExistingImage and to reassign and persist the model's image reference to the new filename, destroying the existing image and leaving the database row pointing at a file that was never written. A mirr...

EUVD-2026-74917

Snipe-IT before 8.7.0 fails to check the return value of Storage::delete in UploadedFilesController::destroy and Api\UploadedFilesController::destroy, allowing deletion requests to report success while files remain on disk. Administrators performing attachment deletions receive success responses...

CVE-2026-86740 Snipe-IT before 8.7.0 Attachment Deletion Reports Success While File Remains

Snipe-IT before 8.7.0 fails to check the return value of Storage::delete in UploadedFilesController::destroy and Api\UploadedFilesController::destroy, allowing deletion requests to report success while files remain on disk. Administrators performing attachment deletions receive success responses...

CVE-2026-86740 Snipe-IT before 8.7.0 Attachment Deletion Reports Success While File Remains

Snipe-IT before 8.7.0 fails to check the return value of Storage::delete in UploadedFilesController::destroy and Api\UploadedFilesController::destroy, allowing deletion requests to report success while files remain on disk. Administrators performing attachment deletions receive success responses...

CVE-2026-86739 Snipe-IT before 8.7.0 Acceptance Finalization Without Stored Evidence

Snipe-IT 8.6.3 and earlier do not check the return value of Storage::put when writing the signature PNG and the generated acceptance PDF in Account\AcceptanceController::store. On filesystem drivers that return false instead of throwing on a write failure for example the local disk with restricti...

CVE-2026-86739

Snipe-IT versions 8.6.3 and earlier contain a defect in Account\AcceptanceController::store() where the return value of Storage::put() is not checked when writing the signature PNG and generated acceptance PDF . On filesystem drivers that silently return false on write failure (e.g., restrictive ...

EUVD-2023-60621

PocketMine-MP versions before 5.3.1 and 4.23.1 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper null value handling in arrays. Attackers can send malformed JSON with unexpected null elements in LoginPacket to crash the server...

glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list"

A flaw was found in GLib. An off-by-one error can occur in the gkeyfilegetlocalestringlist function in the gkeyfile.c file when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundar...

glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list"

A flaw was found in GLib. An off-by-one error can occur in the gkeyfilegetlocalestringlist function in the gkeyfile.c file when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundar...

PT-2026-88949

SiYuan before v3.8.2 inserts persisted notebook template paths into HTML input value attributes without proper attribute encoding. Attackers can craft malicious template paths that break out of the attribute context and execute JavaScript when a victim opens notebook configuration, enabling...

PT-2026-89009

Snipe-IT before 8.7.0 fails to check the return value of Storage::delete in UploadedFilesController::destroy and ApiUploadedFilesController::destroy, allowing deletion requests to report success while files remain on disk. Administrators performing attachment deletions receive success responses a...

PT-2026-89018

Snipe-IT versions put... call still caused the application to delete the previous image via deleteExistingImage and to reassign and persist the model's image reference to the new filename, destroying the existing image and leaving the database row pointing at a file that was never written. A mirr...

CVE-2026-86749: Unchecked Return Value

Snipe-IT versions put... call still caused the application to delete the previous image via deleteExistingImage and to reassign and persist the model's image reference to the new filename, destroying the existing image and leaving the database row pointing at a file that was never written. A mirr...