tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing

A flaw was found in Apache Tomcat. An off-by-one error in the RewriteValve's N flag processing causes rewrite rules to restart at the second rule instead of the first. This vulnerability may allow an attacker to bypass intended access controls...

tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing

A flaw was found in Apache Tomcat. An off-by-one error in the RewriteValve's N flag processing causes rewrite rules to restart at the second rule instead of the first. This vulnerability may allow an attacker to bypass intended access controls...

CVE-2026-105241

A flaw was found in Apache log4net. An attacker who can supply data that is recorded in system logs can submit unencodable Unicode characters, triggering an encoding error in the SmtpPickupDirAppender component. When this failure occurs, the application discards all buffered log messages in the...

kernel: smb: client: fix OOB reads parsing symlink error response

A flaw was found in the Linux kernel's Server Message Block SMB client. A remote, untrusted server could send a specially crafted symlink error response, leading to an out-of-bounds read vulnerability. This could result in the disclosure of sensitive information from the kernel's memory to a loca...

EUVD-2026-94048

In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled...

PT-2026-107576

Gophish through 0.12.1 contains stored and reflected cross-site scripting vulnerabilities that allow attackers to inject script by returning malicious SMTP server error messages. Attackers controlling or intercepting a sending profile's SMTP server can execute script when administrators view...

CVE-2026-107272: Improper Neutralization of Input During Web Page Generation

Gophish through 0.12.1 contains stored and reflected cross-site scripting vulnerabilities that allow attackers to inject script by returning malicious SMTP server error messages. Attackers controlling or intercepting a sending profile's SMTP server can execute script when administrators view...

SUSE SLES15 Security Update : kernel (Live Patch 58 for SUSE Linux Enterprise 15 SP4) (SUSE-SU-2026:4531-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4531-1 advisory. This update for the SUSE Linux Enterprise Kernel 5.14.21-150400.24.235 fixes various security issues: The following security issues were fixed:...

PT-2026-107648

Name of the Vulnerable Software and Affected Versions Nickname profile affected versions not specified Description An issue exists where the Nickname profile can experience a panic due to an out-of-bounds slice error. This occurs when the system attempts to transform specially crafted input into ...

ROS-20261007-73-0338

The vulnerability in the kernel-lt is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-107554

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 6.9.13-56 ImageMagick versions prior to 7.1.2-31 Description A crafted local call to the 'GetVirtualPixels' API can trigger an integer calculation error, leading to a heap buffer overflow. This occurs when the...

Linux Distros Unpatched Vulnerability : CVE-2026-56851

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer. CVE-2026-56851 Note that Nessu...

PT-2026-107557

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.2-31 Description A client connected to the distributed pixel cache server can send crafted pixel data that triggers an integer-size calculation error and a heap buffer overwrite, resulting in a server crash. A...

CVE-2026-106567: Unsigned to Signed Conversion Error

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted PSD file can trigger an integer-conversion error in the PSD decoder on 32-bit builds, causing an infinite loop and denial of service. This issue is fixed in...

Apache Ratis 3.3.1 Java Deserialization

Summary Apache Ratis is a highly customizable Raft protocol implementation in Java. Raft is a easily understandable consensus algorithm to manage replicated state. Apache Ratis could be used in any Java application where state should be replicated between multiple instances. Description Apache...

PT-2026-107550

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.2-32 ImageMagick versions prior to 6.9.13-57 Description A crafted PSD file can trigger an integer-conversion error in the PSD decoder on 32-bit builds. This error leads to an infinite loop, resulting in a...

Linux Distros Unpatched Vulnerability : CVE-2026-106571

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 6.9.13-56 and 7.1.2-31, a crafted local call to the...

Linux Distros Unpatched Vulnerability : CVE-2026-106567

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted PSD file can trigger a...

Linux Distros Unpatched Vulnerability : CVE-2026-106574

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a client connected to the distributed pixel...

The vulnerability of the Grant Table, which is used by Xen hypervisors, allows a perpetrator to disclose protected information or cause service failures.

The vulnerability of the Grant Table of the Xen hypervisor is related to synchronization errors when using a common resource. Exploiting this vulnerability can allow an attacker to disclose protected information or cause service failures...