postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin

A flaw was found in PostgreSQL. Missing authorization in PostgreSQL's logical decoding feature allows a non-superuser with REPLICATION privilege to load arbitrary files. This can lead to arbitrary code execution as the operating system account running the server...

AlmaLinux 9.6 [TuxCare] Security Update: osbuild-composer / osbuild-composer-core / osbuild-composer-tests / etc (ALMALINUX9.6:CLSA-2026:1790266264)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790266264 advisory. - Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router...

Rocky Linux 9.6 [TuxCare] Security Update: osbuild-composer / osbuild-composer-core / osbuild-composer-tests / etc (ALMALINUX9.6:CLSA-2026:1790266264)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790266264 advisory. - Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router...

CVE-2026-93903: Double Decoding of the Same Data

LiteSpeed Web Server LSWS before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case."...

PT-2026-103276

Name of the Vulnerable Software and Affected Versions LiteSpeed Web Server LSWS versions prior to 6.3.7 build 1 Description LiteSpeed Web Server LSWS mishandles internal redirect URL validation in a specific corner case. This issue involves double decoding of the same data, which can lead to...

PT-2026-102972

Name of the Vulnerable Software and Affected Versions Handlebars.java versions prior to 4.5.5 Description An issue allows directory traversal when using a Spring MVC application with a file: template prefix and a request-derived view name. In certain versions, template locations are validated as...

CVE-2026-102555

A heap buffer overflow exists in libsoup within the soup_uri_decode_data_uri() function. The vulnerability occurs because the function incorrectly treats base64 data-URI payloads as NUL-terminated strings when invoking g_base64_decode_inplace() . If a percent-decoded payload contains embedded NUL...

Security Bulletin: Automation Assets in IBM Cloud Pak for Integration is vulnerable to multiple vulnerabilities in fast-uri.

Summary Automation Assets in IBM Cloud Pak for Integration is vulnerable to multiple vulnerabilities in fast-uri. CVE-2026-75899, CVE-2026-75931, CVE-2026-75975, CVE-2026-76172 The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-75899 DESCRIPTION: fast-uri is a URI parse...

CVE-2026-97579

A flaw was found in the Linux kernel's MediaTek video codec driver. An out-of-bounds write occurs during AV1 video decoding because tile information from the video stream is copied into fixed-size internal memory without proper bounds checking. A local user could exploit this flaw by submitting...

CVE-2026-97575

A flaw was found in the Linux kernel's Video4Linux2 V4L2 subsystem. The stateless AV1 video decoding interface fails to properly validate tile dimensions in frame control requests. A local attacker can exploit this vulnerability by submitting a specially crafted frame configuration with excessive...

Important: libheif

Issue Overview: Incomplete fix for GHSA-73p7-m7gg-w2jv leaves libheif 1.23.1 vulnerable to an out-of-bounds read NOTE: https://github.com/strukturag/libheif/security/advisories/GHSA-hh47-fhqr-cj2r CVE-2026-84450 Incomplete fix for GHSA-73p7-m7gg-w2jv leaves libheif 1.23.1 vulnerable to an...

SUSE CVE-2026-59980

hpack is an HTTP/2 Header Encoding for Python. Prior to version 4.2.0, unbounded variable integer decoding can cause run-away computation on malformed input leading to On^2 runtime, effectively blocking further processing with large enough unsanitized input. A fix is available in python-hyper/hpa...

CVE-2026-102269

A flaw was found in PyJWT. When decoding JSON Web Token JWT signature segments, the library accepts characters outside the standard Base64URL encoding format. A remote attacker can exploit this issue by appending extra characters to a valid token signature, creating an alternate token...

DEBIAN-CVE-2026-102269

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT signature segment is affected because signature segment decoding accepts characters outside the canonical Base64URL representation. This occurs when non-Base64URL characters are appended to a valid compact JWS...

CVE-2026-102269

The PyJWT Python library (prior to version 2.14.0 ) is vulnerable to a signature segment decoding issue. The library incorrectly accepts characters outside the canonical Base64URL representation, allowing non-Base64URL characters to be appended to a valid compact JWS signature segment. Because ba...

postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin

A flaw was found in PostgreSQL. Missing authorization in PostgreSQL's logical decoding feature allows a non-superuser with REPLICATION privilege to load arbitrary files. This can lead to arbitrary code execution as the operating system account running the server...

postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin

A flaw was found in PostgreSQL. Missing authorization in PostgreSQL's logical decoding feature allows a non-superuser with REPLICATION privilege to load arbitrary files. This can lead to arbitrary code execution as the operating system account running the server...

postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin

A flaw was found in PostgreSQL. Missing authorization in PostgreSQL's logical decoding feature allows a non-superuser with REPLICATION privilege to load arbitrary files. This can lead to arbitrary code execution as the operating system account running the server...

postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin

A flaw was found in PostgreSQL. Missing authorization in PostgreSQL's logical decoding feature allows a non-superuser with REPLICATION privilege to load arbitrary files. This can lead to arbitrary code execution as the operating system account running the server...

postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin

A flaw was found in PostgreSQL. Missing authorization in PostgreSQL's logical decoding feature allows a non-superuser with REPLICATION privilege to load arbitrary files. This can lead to arbitrary code execution as the operating system account running the server...