CVE-2026-67588: Allocation of Resources Without Limits or Throttling

A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2.0, which fixes the issue...

Linux Distros Unpatched Vulnerability : CVE-2026-67589

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects...

wp2shell-Hestia-Scanner — Updated!

🛡️ wp2shell-Hestia-Scanner 🇬🇧 English | 🇬🇷 Ελληνικά Read-only WordPress security scanner for HestiaCP servers. Detects wp2shell compromise indicators across all hosted sites — with per-client email reports, core file diff, SHA256 webshell detection, risk scoring, and optional AI evaluation. ⚠️ Safe...

CVE-2017-20242 Keysight IxChariot Endpoint stack-based buffer overflow

Keysight IxChariot Endpoint before 9.5.102 contains a stack-based buffer overflow. An unauthenticated remote attacker can send a specially crafted packet to crash the endpoint or potentially execute arbitrary code...

CVE-2026-47781 pdm: Project-Controlled `.pdm-plugins` Content Executes Before CLI Parsing

PDM is a Python package and dependency manager. In versions up to and including 2.26.9, PDM automatically loads project-local plugins from a .pdm-plugins directory during initialization, allowing an attacker-controlled file in an untrusted repository checkout to execute arbitrary Python code befo...

CVE-2026-47781 pdm: Project-Controlled `.pdm-plugins` Content Executes Before CLI Parsing

PDM is a Python package and dependency manager. In versions up to and including 2.26.9, PDM automatically loads project-local plugins from a .pdm-plugins directory during initialization, allowing an attacker-controlled file in an untrusted repository checkout to execute arbitrary Python code befo...

django-codenerix (1.0.0), django-pre-post (1.0.0) +2 more potentially affected by CVE-2026-15307 via django (1.10.6)

django PYPI version 1.10.6 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-codenerix 1.0.0 - django-pre-post 1.0.0 - teamvault =0.7.0, =0.2.5, =0.3.0.dev14 Source cves: CVE-2026-15307 Source advisory:...

CVE-2026-47764 pdm: Path traversal in wheel installation via overridden write_to_fs

pdm is a Python package and dependency manager supporting the latest PEP standards. Versions prior to 2.27.0 are vulnerable to path traversal through writetofs. InstallDestination.writetofs in src/pdm/installers/installers.py overrides the base class to add symlink/hardlink support but replaces t...

CVE-2026-70471

Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to 3.1.3, Flowise injects $vars into the code execution sandbox without requiring variables:view, bypassing the permission-protected Variables API. Variables for the active workspace are fetche...

CVE-2026-47763

pdm is a Python package and dependency manager supporting the latest PEP standards. In versions prior to 2.27.0, pdm writes several project-local state or configuration files without symlink protection. If a malicious repository places those files as symlinks, local PDM operations can overwrite t...

django-codenerix (1.0.0), django-pre-post (1.0.0) +2 more potentially affected by CVE-2026-15830 via django (1.10.6)

django PYPI version 1.10.6 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-codenerix 1.0.0 - django-pre-post 1.0.0 - teamvault =0.7.0, =0.2.5, =0.3.0.dev14 Source cves: CVE-2026-15830 Source advisory:...

EUVD-2026-52745

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent in packages/components/nodes/agents/CSVAgent/CSVAgent.ts extracted attacker-controlled CSV data with file.split','.pop and interpolated it directly into executable Python as...

CVE-2026-14838 Session Token Exposure in URL Leading to Account Takeover in Bilin Software's HUMANIST Digital Human Resources

Use of GET request method with sensitive query strings vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Session Hijacking. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

CVE-2026-68744

A flaw was found in SSSD. The sssnssprotocolfillinitgr function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to...

CVE-2026-14848

The Paid Membership Subscriptions WordPress plugin, in versions prior to 3.0.8 , contains an improper access control vulnerability. The plugin fails to verify that a subscription being modified via the change-subscription checkout belongs to the current user. This allows any authenticated user wi...

Exploit for CVE-2026-66066

CVE-2026-66066 — KindaRails2Shell Rails Active Storage/libvips A...

CVE-2026-67861

An issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service via the UAClientgetRemoteDataTypes component...

PT-2026-67643

Name of the Vulnerable Software and Affected Versions SSSD affected versions not specified Description A flaw exists in the NSS responder where the sss nss protocol fill initgr function pre-allocates reply space for all group entries but fails to shrink the packet when groups are skipped. This...

PT-2026-67652

The Nested Pages WordPress plugin before 3.2.15 does not properly escape post titles before outputting them into HTML attributes on an administrative listing screen, allowing users with the Editor role or Contributor/Author when the Nested Pages WordPress plugin before 3.2.15 is enabled for the...

Important: python-pillow

Issue Overview: Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row width, causing pixel access such as...