CLEANSTART-2026-IG09233 Deserialization of untrusted data vulnerability in QOS

Security vulnerability affects the trino package. Deserialization of untrusted data vulnerability in QOS...

CLEANSTART-2026-HP74376 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

CVE-2026-54512 affects multiple packages. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. See references for individual vulnerability details...

CLEANSTART-2026-HT58355 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

CVE-2026-54513 affects multiple packages. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. See references for individual vulnerability details...

EUVD-2026-94652

The LatePoint - Appointment Booking & Reservation plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.6.9. This is due to the processstepcustomer function using isuserloggedin as the sole gate before merging POSTed customer data into an...

CVE-2026-17538

The LatePoint - Appointment Booking & Reservation plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.6.9. This is due to the processstepcustomer function using isuserloggedin as the sole gate before merging POSTed customer data into an...

PT-2026-107869

Name of the Vulnerable Software and Affected Versions NetBoard CRM demo platform affected versions not specified Description An issue exists in the '/module/auth/recovery.php' endpoint where the user-name POST parameter is susceptible to SQL injection. This allows for blind attacks using Boolean,...

PT-2026-108212

Name of the Vulnerable Software and Affected Versions Satel Netco Design versions prior to 2.1.7 Description A relative path traversal issue exists in the data import functionality. This allows an authenticated user with Viewer privileges to access file paths outside the intended directory and us...

PT-2026-108174

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection versions 12.0 through 12.2 Description A heap-based buffer overflow exists in the MongoDB protocol parser. A remote attacker can trigger memory corruption by sending a specially crafted MongoDB SCRAM username with ...

UBUNTU-CVE-2026-106066

A heap-based buffer overflow was found in GIMP’s raw data export plug-in. When exporting very large images, gmalloc sizing based on overflowing width height bytes-per-pixel can allocate far less memory than GEGL reads or writes during export, following integer overflow...

CVE-2026-106566

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, delegate symlink cleanup does not check the MAGICKSHREDPASSES environment variable, allowing a local privileged workflow to overwrite a file with random data. This issue is fixed in...

Linux Distros Unpatched Vulnerability : CVE-2026-107565

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in luksmeta. A local attacker with administrative privileges can cause data corruption when saving metadata to a Linux Unified Key Setup LUKS...

Linux Distros Unpatched Vulnerability : CVE-2026-107363

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keysto...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : Redis vulnerabilities (USN-8866-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8866-1 advisory. It was discovered that Redis did not properly manage memory when handling the TLS pending-data list. A remote attacker could...

CVE-2026-84272: Missing Authentication for Critical Function

IBM Guardium Data Protection 12.1 and 12.2.2 are vulnerable to missing authentication in the edge-controller component. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary container images and gain control of managed edge clusters...

PT-2026-108100

Name of the Vulnerable Software and Affected Versions generator-jhipster versions prior to 9.4.0 react-jhipster versions prior to 1.1.0 Description Applications generated by the platform can persist attacker-controlled Blob data and companion ContentType values, which are then returned through...

PT-2026-108225

Name of the Vulnerable Software and Affected Versions IBM Security Verify Access versions 10.0 through 10.0.9.2 IBM Verify Identity Access versions 11.0 through 11.0.3 Description An SQL injection flaw allows a remote authenticated attacker to modify data and cause a denial of service. SQL...

CVE-2026-107230

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 3.0.14, connection-pool partitioning still omits identity-defining fields for Kerberos, SPNEGO, NTLM, and authenticated proxy connections. Logins...

CVE-2026-106066

A heap-based buffer overflow was found in GIMP’s raw data export plug-in. When exporting very large images, gmalloc sizing based on overflowing width height bytes-per-pixel can allocate far less memory than GEGL reads or writes during export, following integer overflow...

PT-2026-108175

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection versions 12.0 through 12.1 Description A heap-based buffer overflow exists in the S-TAP TrafficTap TDS login reassembly functionality. An unauthenticated remote attacker can send crafted TDS login fragments that...

CVE-2026-107363

In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token. An authenticated user with a valid token for one project may substitute another project's UUID to enumerate, inspect, create, o...