GO-2026-5033 Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent

For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used...

CVE-2026-30691

Cross-Site Scripting XSS vulnerability in @cyntler/react-doc-viewer v1.17.1 allows remote attackers to execute arbitrary JavaScript via a crafted .txt file. The TXTRenderer component fails to sanitize file content and explicitly casts raw data as a ReactNode...

openbabel:fuzz_empty_write: Bad-cast to OBSetData from OpenBabel::OBPairData in OpenBabel::GhemicalFormat::WriteMolecule

Project: https://github.com/openbabel/openbabel.git Detailed Report: https://oss-fuzz.com/testcase?key=4935099673280512 Project: openbabel Fuzzing Engine: libFuzzer Fuzz Target: fuzzemptywrite Job Type: libfuzzerubsanopenbabel Platform Id: linux Crash Type: Bad-cast Crash Address: 0x5657d089e940...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: iouring/memmap: The nrpages value is cast to sizet before shifting. If the allocated size exceeds UINTMAX, it is necessary to cast the mr-nrpages value to sizet to prevent an overflow. In practice, this isn’t a major issue, as th...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: mlx5: Fixed a leak in skb during fifo resync and push operations. During the ptp resync operation, SKBs were popped from the fifo, but they were never freed either by napiconsume or by devkfreeskbany. Added a call to...

PT-2026-48761

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 149.0.7827.115 Description A use after free issue in Cast allows an attacker on the local network segment to potentially perform a sandbox escape by sending malicious network traffic. Use after free is a memory...

Cast component Google Chrome Code Execution

The vulnerability of the Cast component in Google Chrome browser relates to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

PT-2026-54390

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.47 Description Insufficient validation of untrusted input in Cast allows a remote attacker who has compromised the renderer process to perform privilege escalation via a crafted HTML page...

PT-2026-54217

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.47 Description An uninitialized use in the Cast component allows an attacker on the local network segment to obtain potentially sensitive information from process memory by sending malicious network...

PT-2026-54368

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.47 Description A use after free issue exists in the Cast component. A remote attacker who has already compromised the renderer process can potentially achieve a sandbox escape by using a specially...

Secure (Multiple) Key-Cast over Networks: Multiple Eavesdropping Nodes

We study the secure multiple key-cast problem over noiseless networks under node-based eavesdroppers, where one or more source nodes participate in the generation of distinct secret keys to be shared among designated terminal subsets, while an eavesdropper observing up to $\ell$ nodes, including...

django-cast (0.2.33) potentially affected by CVE-2026-44200 via wagtail (6.1.0rc2)

wagtail PYPI version 6.1.0rc2 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - django-cast 0.2.33 Source cves: CVE-2026-44200 Source advisory: OSV:PYSEC-2026-149...

django-cast (0.2.33) potentially affected by CVE-2026-44198 via wagtail (6.1.0rc2)

wagtail PYPI version 6.1.0rc2 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - django-cast 0.2.33 Source cves: CVE-2026-44198 Source advisory: OSV:PYSEC-2026-147...

django-cast (0.2.33) potentially affected by CVE-2026-44201 via wagtail (6.1.0rc2)

wagtail PYPI version 6.1.0rc2 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - django-cast 0.2.33 Source cves: CVE-2026-44201 Source advisory: OSV:PYSEC-2026-150...

django-cast (0.2.33) potentially affected by CVE-2026-44199 via wagtail (6.1.0rc2)

wagtail PYPI version 6.1.0rc2 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - django-cast 0.2.33 Source cves: CVE-2026-44199 Source advisory: OSV:PYSEC-2026-148...

django-cast (0.2.33) potentially affected by CVE-2026-44197 via wagtail (6.1.0rc2)

wagtail PYPI version 6.1.0rc2 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - django-cast 0.2.33 Source cves: CVE-2026-44197 Source advisory: OSV:PYSEC-2026-146...

Unity Linux 20.1060e / 20.1070e Security Update: ImageMagick (UTSA-2026-017598)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017598 advisory. There are 4 places in HistogramCompare in MagickCore/histogram.c where an integer overflow is possible during simple math calculations. This occurs in the rgb values...

CVE-2026-41682 pupnp: Port truncation via atoi() cast in parse_uri() allows SSRF port confusion

pupnp is an SDK for development of UPnP device and control point applications. Prior to version 1.18.5, pupnp is vulnerable to SRRF port confusion due to port truncation via atoi cast in parseuri. This issue has been patched in version 1.18.5...

CVE-2026-41682

CVE-2026-41682 affects pupnp (UPnP SDK); prior to 1.18.5 it is vulnerable to SRRF/port-confusion from port truncation caused by atoi() in parse_uri(). Patch available in pupnp 1.18.5. CVSS 4.0 base score 6.9 (MEDIUM).

CVE-2026-41682 pupnp: Port truncation via atoi() cast in parse_uri() allows SSRF port confusion

pupnp is an SDK for development of UPnP device and control point applications. Prior to version 1.18.5, pupnp is vulnerable to SRRF port confusion due to port truncation via atoi cast in parseuri. This issue has been patched in version 1.18.5...