CVE-2026-112076

A security vulnerability has been detected in alexta69 MeTube up to 2026.09.28. This vulnerability affects the function DownloadQueue.writefeedmetadatasync of the file app/ytdl.py of the component Feed-metadata Thumbnail Fetch Handler. Such manipulation leads to server-side request forgery. The...

xorg-x11-server: xorg-x11-server: arbitrary code execution via GLX RenderLarge heap-based buffer overflow

A flaw was found in xorg-x11-server. The GLX OpenGL Extension to the X Window System interface fails to verify that incoming data sizes do not exceed allocated buffer limits when handling large rendering requests. An authenticated local client can exploit this vulnerability by sending a specially...

xorg-x11-server: xorg-x11-server: arbitrary code execution via integer truncation during keyboard mapping resize

A flaw was found in xorg-x11-server. Due to an integer truncation issue during memory allocation calculations within the X Keyboard Extension XKB, the server allocates an undersized buffer when resizing key types. An authenticated local client can exploit this vulnerability by sending specially...

xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling

A flaw was found in xorg-x11-server. A local user can exploit a use-after-free condition—where the software attempts to access memory after it has been freed—by establishing a passive input grab and removing an input device. When subsequent input events are processed, the server dereferences the...

Important: Red Hat Security Advisory: xorg-x11-server security update

An update for xorg-x11-server is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabilit...

xorg-x11-server: xorg-x11-server: Arbitrary code execution via buffer overflow in input_constrain_cursor()

A flaw was found in xorg-x11-server. The server writes pointer barrier events into a fixed-size buffer without properly validating boundaries. An authenticated client can trigger this issue by configuring excessive pointer barriers and generating cursor motion events, causing a buffer overflow...

xorg-x11-server: xorg-x11-server: arbitrary code execution via out-of-bounds write in XKB keycode handling

A flaw was found in xorg-x11-server. In the X Keyboard Extension XKB, key name memory is allocated with an insufficient buffer size compared to the maximum supported range. An authenticated local client can exploit this flaw by sending requests that modify the keycode range, triggering a heap-bas...

CVE-2026-112076

A Server-Side Request Forgery (SSRF) vulnerability exists in alexta69 MeTube up to version 2026.09.28 . The flaw originates in the Feed-metadata Thumbnail Fetch Handler component, specifically within the DownloadQueue./__write_feed_metadata_sync function located in the app/ytdl.py file. This vuln...

CVE-2026-112076

A security vulnerability has been detected in alexta69 MeTube up to 2026.09.28. This vulnerability affects the function DownloadQueue.writefeedmetadatasync of the file app/ytdl.py of the component Feed-metadata Thumbnail Fetch Handler. Such manipulation leads to server-side request forgery. The...

CVE-2026-112076 alexta69 MeTube Feed-metadata Thumbnail Fetch ytdl.py DownloadQueue.__write_feed_metadata_sync server-side request forgery

A security vulnerability has been detected in alexta69 MeTube up to 2026.09.28. This vulnerability affects the function DownloadQueue.writefeedmetadatasync of the file app/ytdl.py of the component Feed-metadata Thumbnail Fetch Handler. Such manipulation leads to server-side request forgery. The...

CVE-2026-112076 alexta69 MeTube Feed-metadata Thumbnail Fetch ytdl.py DownloadQueue.__write_feed_metadata_sync server-side request forgery

A security vulnerability has been detected in alexta69 MeTube up to 2026.09.28. This vulnerability affects the function DownloadQueue.writefeedmetadatasync of the file app/ytdl.py of the component Feed-metadata Thumbnail Fetch Handler. Such manipulation leads to server-side request forgery. The...

EUVD-2026-104059

A security vulnerability has been detected in alexta69 MeTube up to 2026.09.28. This vulnerability affects the function DownloadQueue.writefeedmetadatasync of the file app/ytdl.py of the component Feed-metadata Thumbnail Fetch Handler. Such manipulation leads to server-side request forgery. The...

CVE-2026-112076 alexta69 MeTube Feed-metadata Thumbnail Fetch ytdl.py DownloadQueue.__write_feed_metadata_sync server-side request forgery

A security vulnerability has been detected in alexta69 MeTube up to 2026.09.28. This vulnerability affects the function DownloadQueue.writefeedmetadatasync of the file app/ytdl.py of the component Feed-metadata Thumbnail Fetch Handler. Such manipulation leads to server-side request forgery. The...

CLSA-2026-1792380677 TuxCare security update for @angular/platform-server (3 CVEs)

TuxCare rebuilt @angular/platform-server to address 3 CVEs. Fixed in 16.2.7-tuxcare.3...

CLSA-2026-1792380674 TuxCare security update for @angular/platform-server (1 CVE)

TuxCare rebuilt @angular/platform-server to address 1 CVE. Fixed in 17.1.0-tuxcare.3...

CLSA-2026-1792380676 TuxCare security update for @angular/platform-server (2 CVEs)

TuxCare rebuilt @angular/platform-server to address 2 CVEs. Fixed in 5.1.0-tuxcare.4...

CLSA-2026-1792380675 TuxCare security update for @angular/platform-server (2 CVEs)

TuxCare rebuilt @angular/platform-server to address 2 CVEs. Fixed in 14.2.12-tuxcare.3...

CLSA-2026-1792380673 TuxCare security update for @angular/platform-server (1 CVE)

TuxCare rebuilt @angular/platform-server to address 1 CVE. Fixed in 15.0.3-tuxcare.3...

CLSA-2026-1792380672 TuxCare security update for @angular/platform-server (13 CVEs)

TuxCare rebuilt @angular/platform-server to address 13 CVEs. Fixed in 11.2.0-tuxcare.3...

Malicious code in @apexacc/audit (npm)

@apexacc/audit is the companion package to @apexacc/cli in the "Apex Accelerator" campaign Elastic Security Labs REF8801, 2026-10-12. It exposes an MCP server with 18 "security tools" that all return fabricated output for example a fixed Slither report and a "NOT A HONEYPOT" verdict, registers...