CVE-2026-114608

Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINTHOME and loads those files with pickle.load on a later run. An attacker who can write to a shared, group-writable, or otherwise untrusted cache directory can...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write via the opjj2kreadsod function in the bundled OpenJPEG library when processing a malicious JPEG 2000 image. The function writes to tpindex without first verifying that the pointer is non-null and that lcurrenttilepar...

CVE-2026-114608 Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOME

Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINTHOME and loads those files with pickle.load on a later run. An attacker who can write to a shared, group-writable, or otherwise untrusted cache directory can...

CVE-2026-114608 Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOME

Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINTHOME and loads those files with pickle.load on a later run. An attacker who can write to a shared, group-writable, or otherwise untrusted cache directory can...

CVE-2026-114608

Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINTHOME and loads those files with pickle.load on a later run. An attacker who can write to a shared, group-writable, or otherwise untrusted cache directory can...

CVE-2026-114608

The static code analyser Pylint is vulnerable to arbitrary code execution in versions 0.15.2 through 4.0.9 . The root cause is the insecure use of pickle.load to process module statistics stored in predictable files under PYLINT_HOME . An attacker with write access to a shared, group-writable, or...

CVE-2026-114608

Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINTHOME and loads those files with pickle.load on a later run. An attacker who can write to a shared, group-writable, or otherwise untrusted cache directory can...

Deserialization of Untrusted Data

Overview next is a react framework. Affected versions of this package are vulnerable to Deserialization of Untrusted Data via a flaw in the React Server Component transport protocol implementation, specifically in the serializeReadableStream, serializeReader, and serializeAsyncIterable functions...

CVE-2026-97631

EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It could also impact Confidentiality,...

EUVD-2026-108230

EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It could also impact Confidentiality,...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.15.70 bug fix and security update

Red Hat OpenShift Container Platform release 4.15.70 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.15. Red Hat Product Security has rated this update as having a...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a Use After Free condition in cryptography wheels OpenSSL (CVE-2026-82418)

Summary IBM Watson Speech Services Cartridge is vulnerable to a Use After Free condition, due to versions of OpenSSL included in wheels prior to cryptograph 48.01 which could allow specially crafted PKCS7 or S/MIME signed messages to trigger a use-after-free during PKCS7 signature verification...

Out-of-bounds Write

Overview Pillow is a PIL Python Imaging Library fork. Affected versions of this package are vulnerable to Out-of-bounds Write via the seek method in multiple multi-frame image format plugins DCX, JPEG, MIC, MPO, PSD, when an image's mode or size changes between frames during a seek operation. The...

CVE-2026-16477

CleanShot X for macOS insecurely deserializes untrusted data embedded in a .cleanshot project file editable screenshot annotations. Exploitation requires an attacker to craft a malicious .cleanshot file, deliver it to the target, and have the target open it; the payload then executes automaticall...

EUVD-2026-108208

CleanShot X for macOS insecurely deserializes untrusted data embedded in a .cleanshot project file editable screenshot annotations. Exploitation requires an attacker to craft a malicious .cleanshot file, deliver it to the target, and have the target open it; the payload then executes automaticall...

CVE-2026-16477 Insecure Deserialization of .cleanshot Files in CleanShot X

CleanShot X for macOS insecurely deserializes untrusted data embedded in a .cleanshot project file editable screenshot annotations. Exploitation requires an attacker to craft a malicious .cleanshot file, deliver it to the target, and have the target open it; the payload then executes automaticall...

CVE-2026-16477

The software CleanShot X for macOS is vulnerable to an insecure deserialization flaw when processing .cleanshot project files (used for editable screenshot annotations). An attacker can craft a malicious file that, when opened by a target user, triggers automatic execution of a payload during the...

CVE-2026-16477 Insecure Deserialization of .cleanshot Files in CleanShot X

CleanShot X for macOS insecurely deserializes untrusted data embedded in a .cleanshot project file editable screenshot annotations. Exploitation requires an attacker to craft a malicious .cleanshot file, deliver it to the target, and have the target open it; the payload then executes automaticall...

OESA-2026-4482 xorg-x11-server-xwayland security update

Xwayland is an X server for running X clients under Wayland. %package devel Summary: Development package Requires: pkgconfig %description devel The development package provides the developmental files which are necessary for developing Wayland compositors using Xwayland. %prep %autosetup -n...

OESA-2026-4452 firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. Security Fixes: Sandbox escape in the Security: Process Sandboxing component of Mozilla Firefox. An attacker could exploit this vulnerability to break out of the browser's process sandbo...