PT-2026-114807

An external control of system or configuration setting vulnerability has been reported to affect QuRouter. If a local attacker gains an administrator account, they can then exploit the vulnerability to modify data on the system. We have already fixed the vulnerability in the following version:...

PT-2026-115115

Name of the Vulnerable Software and Affected Versions bandit versions 0.6.0 through 1.12.x Description An unauthenticated remote attacker can set conn.host and conn.port to values that violate the RFC 3986 host grammar by using the authority of an HTTP/1 absolute-form or authority-form request...

CVE-2026-50619: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability has been reported to affect Qsirch. If exploited, the vulnerability could allow remote attackers to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsirch 7.0.3.0 and later...

CVE-2026-39997: Missing Authentication for Critical Function

A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to gain access to the system. We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.22 and...

CVE-2023-32198: Improper Certificate Validation

A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle MitM attack against services using Steve...

UBUNTU-CVE-2026-109149

A weakness has been identified in beautifier js-beautify up to 1.15.1/2.0.3. The affected element is an unknown function. Executing a manipulation can lead to uncontrolled memory allocation. The attack may be launched remotely. The vendor was contacted early about this disclosure but did not...

UBUNTU-CVE-2026-109968

A flaw was found in the clevis PKCS11 pin. The clevis-pkcs11-afunix-socket-unlock daemon logs LUKS disk encryption passphrases in plaintext to a log file. The log file is created without restrictive permissions, making it world-readable under the default process umask. A local attacker can read t...

CVE-2026-58100: Concurrent Execution using Shared Resource with Improper Synchronization

kqueueforkcopyknote indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check. Because the child's table is copied before knotes are transferred, a concurrent thread in the parent could grow the parent's table and register knotes with file...

CVE-2026-78850

Matomo v.5.11.2 is vulnerable to a Blind Server-Side Request Forgery (SSRF) (CWE-918) in the SiteContentDetector / SitesManager component. The issue arises because the application allows an authenticated site administrator to configure a main_url that points to an internal address. The system per...

CVE-2026-110917: Improper Restriction of Operations within the Bounds of a Memory Buffer

Memory corruption in SVG in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. Chromium security severity: High...

Oracle Linux 7 : gstreamer1-plugins-base (ELSA-2026-69866)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-69866 advisory. - Backport fix for CVE-2026-18297 Orabug: 40057731 - Security update for CVE-2026-2921 Orabug: 39199326 Tenable has extracted the preceding description block...

EUVD-2026-102185

An issue in Matomo v.5.11.2 allows a remote attacker to obtain sensitive information via the SiteContentDetector / SitesManager component...

Encoded but Exposed: Language Embeddings Can Reveal More Than They Should in Recommender Systems

Language embeddings are increasingly used in recommenders to represent item content, but their privacy risks remain poorly understood. We study whether item embeddings can reveal item identities when an adversary has access to auxiliary item text from external sources. We show that a simple...

PT-2026-115367

Name of the Vulnerable Software and Affected Versions Terragrunt versions prior to 1.1.1 Description The terragrunt catalog command clones repositories into a temporary directory using a deterministic path based on a base64 sha1 hash of the repository URL. A local attacker with write access to th...

X.Org Server XKB XkbSetMap Request Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows local attackers to disclose sensitive information on affected installations of X.Org Server. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling...

PT-2026-115333

A potential improper authorization vulnerability was reported in Lenovo Baiying PC Client, distributed exclusively in the Chinese market, that could allow a local authenticated user to execute arbitrary code with elevated privileges...

CVE-2026-110807

A weakness has been identified in sgl-project SGLang up to 0.5.19. Affected by this vulnerability is an unknown functionality of the file python/sglang/srt/managers/iostruct.py of the component generate Endpoint. This manipulation of the argument sessionparams causes denial of service. The attack...

CVE-2026-110807 sgl-project SGLang generate Endpoint io_struct.py denial of service

A weakness has been identified in sgl-project SGLang up to 0.5.19. Affected by this vulnerability is an unknown functionality of the file python/sglang/srt/managers/iostruct.py of the component generate Endpoint. This manipulation of the argument sessionparams causes denial of service. The attack...

CVE-2026-110807 sgl-project SGLang generate Endpoint io_struct.py denial of service

A weakness has been identified in sgl-project SGLang up to 0.5.19. Affected by this vulnerability is an unknown functionality of the file python/sglang/srt/managers/iostruct.py of the component generate Endpoint. This manipulation of the argument sessionparams causes denial of service. The attack...

CVE-2026-110698

A security vulnerability has been detected in Praat up to 7.0.02. Affected is the function whispermodelload of the file external/whispercpp/whisper.cpp of the component Model Loader. The manipulation of the argument ndims leads to out-of-bounds write. The attack can be initiated remotely. The...