CVE-2026-91752

GNU libextractor before 1.15 contains a stack-based buffer overflow vulnerability in the processstaroffice function that sizes a variable-length stack array from attacker-controlled OLE2 stream data. Attackers can craft malicious StarOffice documents that allocate up to 4 MB on the stack, causing...

EUVD-2026-78168

Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression filtering. Attackers can inject expressions beginning with that are stored and later evaluated in the full Spring context when a mail task uses variable-backed...

PT-2026-91773

GNU libextractor before 1.15 contains a stack-based buffer overflow vulnerability in the process star office function that sizes a variable-length stack array from attacker-controlled OLE2 stream data. Attackers can craft malicious StarOffice documents that allocate up to 4 MB on the stack, causi...

perl:5.32 security update

perl 4:5.32.1-475 - Fixes: CVE-2026-13221 - Don't create a trie that would overflow - Resolves: RHEL-247945 4:5.32.1-474 - Resolves: RHEL-153834 - Fix CVE-2025-40909 - Clone dirhandles without fchdir 4:5.32.1-473 - Fix CVE-2023-47038 - Added perl-autouse and perl-ExtUtils-MM-Utils to perl...

PT-2026-93173

@zereight/mcp-gitlab exposes its Streamable HTTP MCP endpoint without an effective Host or Origin allowlist. A malicious web page can use DNS rebinding to route browser requests to a victim's local MCP listener while preserving an attacker-controlled Host and Origin. The server accepts those...

Fedora 45 : python-configargparse (2026-d40fc39b57)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-d40fc39b57 advisory. Update to 1.7.7. Version 1.7.6 is a security fix for GHSA-6m27-337c-jcgf. Config file or environment variable can trigger writing out a config file,...

Linux Distros Unpatched Vulnerability : CVE-2026-91752

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GNU libextractor before 1.15 contains a stack-based buffer overflow vulnerability in the processstaroffice function that sizes a variable-length stack array fro...

PT-2026-93171

Server-Side Request Forgery via X-GitLab-API-URL Header Allows Credential Theft Affected - Repository: zereight/gitlab-mcp - Affected versions: All versions through commit 74a8c83 - Patched versions: None at time of report Severity High. CVSS v3.1 8.5 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N Descripti...

Fedora 44 : python-configargparse (2026-e3b2220f12)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-e3b2220f12 advisory. Update to 1.7.7. Version 1.7.6 is a security fix for GHSA-6m27-337c-jcgf. Config file or environment variable can trigger writing out a config file,...

kern

kern: a fast, rootless sandbox and virtual resource runtime. Run any workload in a real container, including an agent's tool-call or LLM-generated code. A real, kernel-enforced container in 3.5 ms, out of one static binary with no daemon. 0 RAM at rest · no daemon, no socket, nothing to start · o...

CVE-2026-91145

Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression filtering. Attackers can inject expressions beginning with that are stored and later evaluated in the full Spring context when a mail task uses variable-backed...

mxc

Microsoft eXecution Container MXC MXC is a sandboxed code execution system for running untrusted code model output, plugins, tools on Windows, Linux, and macOS. It provides multiple containment backends — from OS-native process sandboxes to full VMs — behind a unified JSON configuration schema an...

CVE-2026-91145 Activiti through 7.1.0.M6 Expression Injection via Mail Task

Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression filtering. Attackers can inject expressions beginning with that are stored and later evaluated in the full Spring context when a mail task uses variable-backed...

CVE-2026-91145

Activiti through 7.1.0.M6 contains an expression injection vulnerability in its mail task handling. The root cause is a failure to validate hash-brace (#{}) deferred expressions in process variables, allowing an attacker to bypass expression filtering. Injected expressions are stored and later ev...

CVE-2026-91145 Activiti through 7.1.0.M6 Expression Injection via Mail Task

Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression filtering. Attackers can inject expressions beginning with that are stored and later evaluated in the full Spring context when a mail task uses variable-backed...

CVE-2026-91145 Activiti through 7.1.0.M6 Expression Injection via Mail Task

Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression filtering. Attackers can inject expressions beginning with that are stored and later evaluated in the full Spring context when a mail task uses variable-backed...

CVE-2026-3891

CVE-2026-3891 — Pix for WooCommerce 認証なしファイルアップロード RCE Nonce リーク → certificatecrtpath アップロード → コード実行 概要 CVE-2026-3891 は、Pix for WooCommerce WordPress プラグイン（linknacional 製）バージョン ≤ 1.5.0 における、CVSS 9.8 の重大度を持つ認証なし の任意ファイルアップロード脆弱性です。 lknpixforwoocommercec6savesettings AJAX ハンドラーには、以下の問題があります： 1...

Gixy-Next v0.7.1

Gixy-Next: NGINX Configuration Security Scanner for Security Audits Overview Gixy-Next Gixy is an open-source NGINX configuration security scanner and hardening tool that statically analyzes your nginx.conf to detect security misconfigurations, hardening gaps, and common performance pitfalls befo...

rsync: rsync < 3.5.0 Command Injection via Multiple Code Paths

A command injection vulnerability in rsync allows remote attackers to execute arbitrary commands by supplying shell metacharacters or newlines in unsanitized inputs, such as hostnames or hostspecs. This impacts multiple vectors—including the RSYNCCONNECTPROG variable, daemon hooks, rsync-ssl, and...

rsync: rsync < 3.5.0 Command Injection via Multiple Code Paths

A command injection vulnerability in rsync allows remote attackers to execute arbitrary commands by supplying shell metacharacters or newlines in unsanitized inputs, such as hostnames or hostspecs. This impacts multiple vectors—including the RSYNCCONNECTPROG variable, daemon hooks, rsync-ssl, and...