Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-007548)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007548 advisory. In the Linux kernel, the following vulnerability has been resolved: posix-timers: Ensure timer ID search-loop limit is valid posixtimeradd tries to allocate a posix...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-007561)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007561 advisory. In the Linux kernel, the following vulnerability has been resolved: ext4: fix bugon in estreesearch caused by bad quota inode We got a issue as fllows:...

CVE-2026-35603: Untrusted Search Path

Claude Code is an agentic coding tool. In versions prior to 2.1.75 on Windows, Claude Code loaded the system-wide default configuration from C:\ProgramData\ClaudeCode\managed-settings.json without validating directory ownership or access permissions. Because the ProgramData directory is writable ...

PT-2026-33412

A vulnerability has been found in Mobatek MobaXterm Home Edition up to 26.1. This affects an unknown part in the library msimg32.dll. The manipulation leads to uncontrolled search path. An attack has to be approached locally. The attack is considered to have high complexity. It is indicated that...

Mobatek MobaXterm security vulnerabilities

Mobatek MobaXterm is a terminal software developed by the French company Mobatek. It integrates an enhanced terminal, X servers, and Unix command sets GNU/Cygwin. The Mobatek MobaXterm Home Edition 26.1 and earlier versions have security vulnerabilities. These vulnerabilities stem from an unknown...

CVE-2026-6421: Uncontrolled Search Path Element

A vulnerability has been found in Mobatek MobaXterm Home Edition up to 26.1. This affects an unknown part in the library msimg32.dll. The manipulation leads to uncontrolled search path. An attack has to be approached locally. The attack is considered to have high complexity. It is indicated that...

PT-2026-33401

The Form Maker by 10Web plugin for WordPress is vulnerable to SQL Injection via the 'ip search', 'startdate', 'enddate', 'username search', and 'useremail search' parameters in all versions up to, and including, 1.15.40. This is due to the WDW FM Library::validate data method calling stripslashes...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-007516)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007516 advisory. In the Linux kernel, the following vulnerability has been resolved: ext4: fix bugon in estreesearch caused by bad boot loader inode We got a issue as fllows:...

CVE-2026-40459: Improper Neutralization of Special Elements used in an LDAP Query

PAC4J is vulnerable to LDAP Injection in multiple methods. A low-privileged remote attacker can inject crafted LDAP syntax into ID-based search parameters, potentially resulting in unauthorized LDAP queries and arbitrary directory operations. This issue was fixed in PAC4J versions 4.5.10, 5.7.10...

PT-2026-33452

Name of the Vulnerable Software and Affected Versions pac4j versions prior to 4.5.10 pac4j versions prior to 5.7.10 pac4j versions prior to 6.4.1 Description LDAP Injection is possible in multiple methods. A low-privileged remote attacker can inject crafted LDAP syntax into ID-based search...

Giskard security vulnerabilities

Giskard is an open-source evaluation and testing framework for artificial intelligence systems developed by Giskard. Versions of Giskard prior to 1.0.2b1 contained security vulnerabilities. These vulnerabilities stemmed from the direct passing of user-provided regular expressions to the re.search...

OpenHarness security vulnerabilities

OpenHarness is a lightweight development and runtime framework for Data Intelligence Lab@HKU, open-source in nature. OpenHarness has a security vulnerability, which stems from the lack of target address validation in the webFetch and webSearch tools. This vulnerability may lead to server-side...

[SECURITY] Fedora 44 Update: plasma-milou-6.6.4-1.fc44

A dedicated KDE search application built on top of Baloo...

[SECURITY] Fedora 44 Update: kf6-baloo-6.25.0-1.fc44

A Tier 3 KDE Frameworks 6 module that provides indexing and search functional ity...

document-qa-engine (>=0.5.1, <=0.6.0), kapso (>=0.1.0, <=0.1.5) +4 more potentially affected by CVE-2026-41488 via langchain-openai (0.3.18)

langchain-openai PYPI version 0.3.18 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-openai and may be impacted: - document-qa-engine =0.5.1, =0.1.0, =0.1.1, =1.0.0, =1.0.1, =1.0.6 - veee 0.0.3 Source cves: CVE-2026-41488 Source advisory:...

browser-use (>=0.2.6, <=0.3.2), langchain-search-django (>=0.1.0, <=0.7.0) +1 more potentially affected by CVE-2026-41488 via langchain-openai (0.3.21)

langchain-openai PYPI version 0.3.21 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-openai and may be impacted: - browser-use =0.2.6, =0.1.0, =0.7.0 - re-browser-use 0.3.2 Source cves: CVE-2026-41488 Source advisory: OSV:GHSA-R7W7-9XR2-QQ2R...

bisheng-langchain (>=0.3.4, <=0.3.7.1), bsrag-langchain (0.3.8.0) +1 more potentially affected by CVE-2026-41488 via langchain-openai (0.1.5)

langchain-openai PYPI version 0.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-openai and may be impacted: - bisheng-langchain =0.3.4, =0.1.4, =0.1.7 Source cves: CVE-2026-41488 Source advisory: OSV:GHSA-R7W7-9XR2-QQ2R...

calibreweb (0.6.25), cewler (>=1.3.0, <=1.3.1) +8 more potentially affected by CVE-2026-41314 via pypdf (5.4.0)

pypdf PYPI version 5.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - calibreweb 0.6.25 - cewler =1.3.0, =1.1.2, =1.1.0, =1.2.0, =2025.3.0, =0.2.2, =28.3.2, =29.1.2 - ten8t 0.0.22 Source cves: CVE-2026-41314 Source...

Malicious code in genosys (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2fb27cde30ea3d834e3160e37c203a1f8a271435cf92316a990766c5b8b9791c The campaign is built from a benign-like package e.g. genosys and the malicious dependency e.g. pynosist. The dependency uses a PTH file to trigger malicious...

Researchers Say Fiverr Left User Files Open to Google Search

Private Fiverr user documents, including tax records and IDs, were reportedly found in Google search results due to a storage configuration issue. Read more about the findings and the company’s response to the data exposure...