PT-2026-76046

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, when writing an IPTC output file a malicious input file could cause an out of bounds read of a single byte. This issue has been patched in versions 6.9.13-47 an...

PT-2026-76365

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, A heap-buffer-overflow vulnerability exists in the PCL encode due to an undersized output buffer allocation. This vulnerability is fixed in 7.1.2-16 and 6.9.13-...

CVE-2026-67439 OliveTin: StartActionAndWait Endpoints Bypass `logs` Permission and Return Action Output

OliveTin gives safe and simple access to predefined shell commands from a web interface. Prior to 3000.17.0, the service/internal/api/api.go StartActionAndWait and StartActionByGetAndWait endpoints return full LogEntry output after execution without enforcing the logs permission, allowing a user...

CVE-2026-67439 OliveTin: StartActionAndWait Endpoints Bypass `logs` Permission and Return Action Output

OliveTin gives safe and simple access to predefined shell commands from a web interface. Prior to 3000.17.0, the service/internal/api/api.go StartActionAndWait and StartActionByGetAndWait endpoints return full LogEntry output after execution without enforcing the logs permission, allowing a user...

CVE-2026-67439

CVE-2026-67439 affects OliveTin prior to 3000.17.0. The StartActionAndWait and StartActionByGetAndWait endpoints in service/internal/api/api.go return full LogEntry output after execution without enforcing the logs permission, enabling a user with exec permission but logs:false to read action out...

CVE-2026-50642

A flaw was found in diff-so-fancy. The application does not properly sanitize non-SGR Select Graphic Rendition terminal control sequences, allowing other control characters and escape sequences to pass through. An attacker can embed malicious control sequences in filenames, diff metadata, or file...

CVE-2026-67429

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, image.download and related file-writing modules use caller-controlled outputdir instead of validatepathwithenvconfig and its FLYTOSANDBOXDIR confinement, allowing attacker-controlled response bytes to be...

CVE-2026-67429 Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules)

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, image.download and related file-writing modules use caller-controlled outputdir instead of validatepathwithenvconfig and its FLYTOSANDBOXDIR confinement, allowing attacker-controlled response bytes to be...

CVE-2026-67429

Flyto2 Core (execution kernel for automation/AI-agent workflows) contains an Arbitrary File Write vulnerability in image.download and related file-writing modules prior to version 2.26.6. The root cause is caller-controlled output_dir, which bypasses validate_path_with_env_config and FLYTO_SANDBO...

CVE-2026-67429 Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules)

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, image.download and related file-writing modules use caller-controlled outputdir instead of validatepathwithenvconfig and its FLYTOSANDBOXDIR confinement, allowing attacker-controlled response bytes to be...

CVE-2026-67429 Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules)

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, image.download and related file-writing modules use caller-controlled outputdir instead of validatepathwithenvconfig and its FLYTOSANDBOXDIR confinement, allowing attacker-controlled response bytes to be...

CVE-2026-64391

A flaw was found in ksmbd, the in-kernel Server Message Block SMB daemon. This vulnerability allows a remote attacker to bypass security restrictions by incorrectly handling credentials for Alternate Data Streams ADS input/output I/O operations. Instead of using the credentials established when t...

EUVD-2026-50405

In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Check length in pkeypckmo handler implementation Explicitly check the length of the target buffer in the pkeypckmo implementation of the keytoprotkey handler function. The handler function fails, if the generated outpu...

CVE-2026-64558 s390/pkey: Check length in pkey_pckmo handler implementation

In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Check length in pkeypckmo handler implementation Explicitly check the length of the target buffer in the pkeypckmo implementation of the keytoprotkey handler function. The handler function fails, if the generated outpu...

kernel: KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O

A flaw was found in the Kernel-based Virtual Machine KVM for x86. This vulnerability occurs when KVM incorrectly re-checks Level 1 L1 intercepts during the completion of userspace I/O emulation for a Level 2 L2 instruction. If the L1 or host userspace modifies I/O interception settings during thi...

CVE-2026-59947

A flaw was found in Composer, a dependency manager for the PHP language. When Composer is executed with the -vvv debug verbosity option, it can inadvertently expose sensitive credentials, such as a GitHub Personal Access Token, by printing them in the debug output. This occurs because certain...

CVE-2026-64428

A flaw was found in the Linux kernel's GPIO General Purpose Input/Output SCH controller. When the PREEMPTRT Preemptible Real-Time feature is enabled, a locking mechanism intended for sleeping contexts is incorrectly used within a non-sleepable interrupt setup path. This can lead to a system crash...

CVE-2026-50642

diff‑so‑fancy does not properly sanitize non‑SGR terminal control sequences before outputting diff data. The application only strips ANSI SGR sequences while allowing other control characters, including carriage return \r and escape sequences e.g., OSC, CSI, to pass through unsanitized. An attack...

CVE-2026-56390

GNU Bison improperly handles grammar‑defined output paths. Grammar directives such as %output and %header allow specifying file paths, which are accepted without restriction and override caller‑supplied output options. When processing attacker-supplied grammar, this behavior allows directing...

AZL-94136 CVE-2026-56390 affecting package bison for versions less than 3.8.2-2

GNU Bison improperly handles grammar‑defined output paths. Grammar directives such as %output and %header allow specifying file paths, which are accepted without restriction and override caller‑supplied output options. When processing attacker-supplied grammar, this behavior allows directing...