CVE-2026-88053

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Classify::ReadIntTemplates in src/classify/intproto.cpp reads NumClassPruners, NumClasses, and NumProtoSets from the TESSDATAINTTEMP component of a crafted .traineddata file and uses those values as loop bounds without validati...

UBUNTU-CVE-2026-88053

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Classify::ReadIntTemplates in src/classify/intproto.cpp reads NumClassPruners, NumClasses, and NumProtoSets from the TESSDATAINTTEMP component of a crafted .traineddata file and uses those values as loop bounds without validati...

CVE-2026-88051

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, the callback form of GenericVector::read in src/ccutil/genericvector.h reads the independent int32 fields reserved and sizeused from a .traineddata model without a cap or an invariant check. reservereserved allocates the backin...

CVE-2026-88049

creationtimestamp| type| source ---|---|--- 2026-09-10 18:05:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/4snaaeueunf7v 2026-09-15 09:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mvkd7nokwu24...

CVE-2026-88027

creationtimestamp| type| source ---|---|--- 2026-09-10 18:02:46+00:00| seen| https://bsky.app/profile/suriq.io/post/3mv6n5a5fd42j 2026-09-11 12:45:09+00:00| seen| https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-mongodb-4 2026-09-14 14:00:21+00:00| seen|...

CVE-2026-85228

creationtimestamp| type| source ---|---|--- 2026-09-10 18:00:56+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mv6mzwzcxb2k 2026-09-11 05:50:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv7uo3diay24...

We've got one word for it, and it's usually the wrong one

Welcome to this week's edition of the Threat Source newsletter. Ask anybody in this industry what the work does to the health of the people who do it and you get one word back: burnout. It's a fine word, in and of itself. It's easy to reach for, understandable to everyone… and it's the wrong one,...

CVE-2026-88050

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, RecodedCharID::DeSerialize in src/ccutil/unicharcompress.h validates length but accepts negative code values from a crafted .traineddata recoder component. UnicharCompress::ComputeCodeRange in src/ccutil/unicharcompress.cpp can...

CVE-2026-88937

creationtimestamp| type| source ---|---|--- 2026-09-10 17:10:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/achufej3w2s5g 2026-09-11 05:30:09+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv7tkel43c2y...

CVE-2026-80351

creationtimestamp| type| source ---|---|--- 2026-09-10 17:00:11+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv6jndegk32p 2026-09-15 05:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mvju4tql6g2r...

CVE-2026-88868

creationtimestamp| type| source ---|---|--- 2026-09-10 14:40:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv6bstzdrx2b 2026-09-10 16:07:58+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mv6gpws3p425...

CVE-2026-88867

creationtimestamp| type| source ---|---|--- 2026-09-10 14:40:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv6bsrhhbr2y 2026-09-10 16:07:47+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mv6gpnjiyh22...

CVE-2026-88877

creationtimestamp| type| source ---|---|--- 2026-09-10 13:50:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv66zhoooq22 2026-09-10 16:08:16+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mv6gqixwi22j 2026-09-15 06:37:07+00:00| seen|...

CVE-2026-88888

A flaw was found in Renovate. Attackers can exploit a command injection vulnerability in the Mix manager by injecting shell metacharacters through malicious package names when processing private dependencies with unescaped organization parameters. This allows for the execution of arbitrary comman...

DEBIAN-CVE-2026-88859

A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to a...

CVE-2026-88859

A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to a...

CVE-2026-87803

creationtimestamp| type| source ---|---|--- 2026-09-10 11:45:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/5m6nq6fpltjui...

CVE-2026-88859

CVE-2026-88859 is a flaw in the Evolution email client where a remote attacker can send a crafted HTML email containing a spoofed vCard control . When the victim clicks it, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to an iframe's source , res...

CVE-2026-88859 Evolution: evolution: javascript execution via spoofed vcard control bypasses mail script-markup restriction

A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to a...

EUVD-2026-75397

A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to a...