CVE-2026-43900

DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents. Prior to v1.0.4-beta.1, a Cross-Site Scripting XSS vulnerability exists due to a discrepancy between the backend validation layer and the frontend browser rendering engine. The SVGSanitizer...

CVE-2026-43899 DeepChat: Incomplete Fix for CVE-2025-55733 leads to Remote Code Execution via Markdown Links bypassing `isValidExternalUrl`

DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents. Prior to v1.0.4-beta.1, An incomplete mitigation for CVE-2025-55733 leaves DeepChat vulnerable to an arbitrary protocol execution bypass RCE. While the patch correctly restricted...

Ubuntu 16.04 LTS : ITK vulnerabilities (USN-8235-1)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8235-1 advisory. It was discovered that Expat, vendored in ITK incorrectly handled certain files. An attacker could possibly use this issue to cause a crash or execute...

CVE-2026-43968: Improper Neutralization of CRLF Sequences

Improper Neutralization of CRLF Sequences 'CRLF Injection' vulnerability in ninenines cowlib allows SSE event splitting and injection via unvalidated field values. cowsse:event/1 in cowlib guards the id and event fields against \n but not against bare \r, and the internal prefixlines/2 function...

Debian dla-4579 : python-authlib-doc - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4579 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4579-1 [email protected]...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS : CiviCRM vulnerability (USN-8242-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8242-1 advisory. Takuya Aramaki discovered that Smarty, vendored in CiviCRM, did not properly escape JavaScript code. An attacker could possibl...

CVE-2026-43969: Improper Neutralization of CRLF Sequences

Improper Neutralization of CRLF Sequences 'CRLF Injection' vulnerability in ninenines cowlib allows HTTP request splitting and cookie smuggling via unvalidated cookie name and value fields. cowcookie:cookie/1 in cowlib builds a client-side Cookie: request header from a list of name-value pairs...

PT-2026-55279

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=511056140 Crash type: Global-buffer-overflow READ 1 Crash state: txt2sd fuzz mdns xht.cc...

CVE-2025-47913 affecting package buildah for versions less than 1.43.1-1

CVE-2025-47913 affecting package buildah for versions less than 1.43.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2025-66037 affecting package opensc for versions less than 0.27.1-1

CVE-2025-66037 affecting package opensc for versions less than 0.27.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-40528 affecting package opensc for versions less than 0.27.0-1

CVE-2026-40528 affecting package opensc for versions less than 0.27.0-1. A patched version of the package is available...

CVE-2025-13763 affecting package opensc for versions less than 0.27.1-1

CVE-2025-13763 affecting package opensc for versions less than 0.27.1-1. A patched version of the package is available...

CVE-2026-35201 affecting package rubygem-rdiscount for versions less than 2.2.7.4-1

CVE-2026-35201 affecting package rubygem-rdiscount for versions less than 2.2.7.4-1. An upgraded version of the package is available that resolves this issue...

CVE-2025-66215 affecting package opensc for versions less than 0.27.1-1

CVE-2025-66215 affecting package opensc for versions less than 0.27.1-1. An upgraded version of the package is available that resolves this issue...

Amazon Linux 2 : runc, --advisory ALAS2ECS-2026-114 (ALASECS-2026-114)

The version of runc installed on the remote host is prior to 1.3.4-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2026-114 advisory. Arithmetic over induction variables in loops were not correctly checked for underflow or overflow in the Go compiler...

CVE-2026-41887

Flarum is open-source forum software. Prior to versions 1.8.16 and 2.0.0-rc.1, Flarum's patch for CVE-2023-27577 restricted the @import and data-uri LESS features in the customless setting, but the same restriction was never applied to other settings registered as LESS config variables for exampl...

CVE-2026-41887 Flarum: Path traversal in LESS parser via theme color settings (incomplete fix for CVE-2023-27577)

Flarum is open-source forum software. Prior to versions 1.8.16 and 2.0.0-rc.1, Flarum's patch for CVE-2023-27577 restricted the @import and data-uri LESS features in the customless setting, but the same restriction was never applied to other settings registered as LESS config variables for exampl...

[SECURITY] [DSA 6253-1] linux security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6253-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 08, 2026 https://www.debian.org/security/faq -...

Flarum 路径遍历漏洞

Flarum is an open-source forum software developed by Flarum for building communities. Versions of Flarum prior to 1.8.16 and 2.0.0-rc.1 contained a path traversal vulnerability. This vulnerability stemmed from the lack of restrictions on the values of LESS configuration variables, which could lea...

CVE-2026-42793: Allocation of Resources Without Limits or Throttling

Allocation of Resources Without Limits or Throttling vulnerability in absinthe-graphql absinthe allows unauthenticated denial of service via atom table exhaustion when parsing attacker-controlled GraphQL SDL. Multiple Blueprint.Draft.convert/2 implementations in Absinthe's SDL language modules ca...