Important: perl-DBI

Issue Overview: A critical arbitrary code execution vulnerability CWE-94 found in the DBD::DBM database driver, which is a core component shipped within the Perl DBI Database Interface module. The flaw exists because the dbmtype and dbmmldbm handle attributes pass user-influenced input directly...

Important: python-pymongo

Issue Overview: A flaw was found in pymongo. An integer overflow exists in the bundled native extension for Binary JSON BSON document encoding when processing an unusually large amount of data. An unprivileged attacker who can submit oversized data to an application for encoding can trigger an...

PT-2026-110956

Name of the Vulnerable Software and Affected Versions IBM Power Systems Firmware versions FW1060.00 through FW1060.81 Description A flaw exists in the service processor mailbox interface. An attacker with authenticated service-level access to the Flexible Service Processor FSP can send a speciall...

CVE-2026-96262: Stack-based Buffer Overflow

IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to overflow host firmware runtime attribute storage, allowi...

PT-2026-110957

Name of the Vulnerable Software and Affected Versions IBM Power Systems Firmware versions FW1120.00 through FW1120.01 IBM Power Systems Firmware versions FW1110.00 through FW1110.31 IBM Power Systems Firmware versions FW1060.00 through FW1060.81 Description A buffer overflow exists in the host...

CVE-2026-96264: Stack-based Buffer Overflow

IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to overflow host firmware runtime attribute storage, allowi...

CVE-2026-96263: Stack-based Buffer Overflow

IBM Power Systems Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability in the host firmware boot process image validation path. An attacker with service access to the service processor can supply a maliciously crafted co...

PT-2026-110725

Name of the Vulnerable Software and Affected Versions Craft CMS versions 4.0.0 through 4.18.6 Craft CMS versions 5.0.0 through 5.10.13 Description Authenticated control panel users with the performUpdates permission or Updates-utility access can execute arbitrary code. The issue occurs because th...

PT-2026-110450

Name of the Vulnerable Software and Affected Versions libsamsungtts.so versions prior to SMR Oct-2026 Release 1 Description An out-of-bounds write exists in the libsamsungtts.so library, which allows local attackers to execute arbitrary code. An out-of-bounds write occurs when a program writes da...

PT-2026-110448

Name of the Vulnerable Software and Affected Versions WSM service versions prior to SMR Oct-2026 Release 1 Description A use after free issue exists in the WSM service. This flaw allows local attackers to potentially execute arbitrary code with system privileges. Use after free is a memory...

Important: emacs

Issue Overview: A flaw was found in GNU Emacs. This vulnerability, a memory corruption issue, occurs when Emacs processes specially crafted SVG Scalable Vector Graphics CSS Cascading Style Sheets data. A local user could exploit this by convincing a victim to open a malicious SVG file, which may...

Substance 3D Sampler Buffer Overflow RCE

The vulnerability of the Substance 3D Sampler software for creating textures and materials for 3D models involves writing beyond the buffer boundaries. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

Important: rpm

Issue Overview: A flaw was found in rpmbuild. When rpmbuild processes a crafted tarball in tarball mode, a specially designed tar member name can lead to macro injection. This vulnerability allows a remote attacker to execute arbitrary code on the system by convincing a user to build a malicious...

CVE-2026-109308: Improper Control of Generation of Code

Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 passes the raw 'updates' request parameter in AppController::actionCacheUpdates to UpdatesModel without Component::cleanseConfig, allowing behavior and event-handler injection. Authenticated control panel users with the performUpdates...

AlmaLinux 9.6 [TuxCare] Security Update: gimp / gimp-devel / gimp-devel-tools / gimp-libs Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1791479721)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791479721 advisory. - GIMP DDS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers t...

ALSA-2026:80498 Important: flatpak security update

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fixes: flatpak: Flatpak: Arbitrary code execution via missing symlink protection CVE-2026-90616 flatpak: flatpak: Arbitrary write access as root via extra-data extraction CVE-2026-96275...

Rocky Linux 10.2 [CIQ] Security Update: dovecot / dovecot-debuginfo / dovecot-debugsource / dovecot-devel / etc Multiple Vulnerabilities (crlsa-2026_79371)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202679371 advisory. dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters CVE-2026-42391 dovecot: Dovecot: Authentication bypass via incorrect...

Important: flatpak security update

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fixes: flatpak: Flatpak: Arbitrary code execution via missing symlink protection CVE-2026-90616 flatpak: flatpak: Arbitrary write access as root via extra-data extraction CVE-2026-96275...

Important: pcre2 security update

The pcre2 package contains a new generation of the Perl Compatible Regular Expression libraries for implementing regular expression pattern matching using the same syntax and semantics as Perl. Security Fixes: pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular...

Important: pcre2 security update

The pcre2 package contains a new generation of the Perl Compatible Regular Expression libraries for implementing regular expression pattern matching using the same syntax and semantics as Perl. Security Fixes: pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular...