CVE-2026-19245

A flaw has been found in HKUDS nanobot up to 0.2.1. The impacted element is the function ExecTool.preparecommand of the file nanobot/agent/tools/shell.py of the component Login-shell Environment Handler. Executing a manipulation can lead to information disclosure. The attack requires local access...

CVE-2026-19245

CVE-2026-19245 affects HKUDS nanobot

Use of Uninitialized Resource

Overview Affected versions of this package are vulnerable to Use of Uninitialized Resource via the screenpressodecodeframe function in libavcodec/screenpresso.c. An attacker can recover sensitive heap contents by supplying a crafted SPV1 packet whose zlib payload decompresses to fewer bytes than ...

kernel: net: openvswitch: reject oversized nested action attrs

A flaw was found in Open vSwitch in the Linux kernel. Improper handling of oversized nested action attributes can lead to a truncated length field, which could be exploited by a local attacker to alter kernel memory. This alteration might result in the disclosure of sensitive information or a loc...

Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

GHSA-F23P-VX2J-J53R Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure

Summary memo from hono/jsx retains the result of a server-side render and reuses it for later renders with comparator-equal props. Request-scoped values read inside the component take no part in that comparison, so a response can contain HTML rendered for another user's request. Details Component...

Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure

Summary memo from hono/jsx retains the result of a server-side render and reuses it for later renders with comparator-equal props. Request-scoped values read inside the component take no part in that comparison, so a response can contain HTML rendered for another user's request. Details Component...

NPM: Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure

NPM: Hono: memo retains SSR output across requests, leading to cross-user data disclosure vulnerability discovered by ? in WordPress Npm hono versions = 3.8.0, 4.12.34...

CVE-2026-71850 Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure

Hono is a Web application framework that provides support for any JavaScript runtime. From 3.8.0 to 4.12.33, memo from hono/jsx retains the result of a server side render and reuses it for later renders with comparator equal props, and request scoped values read inside the component take no part ...

CVE-2026-70561 TestLink 1.9.20 and prior Authenticated IDOR via attachmentdownload.php

TestLink 1.9.20 and prior contains an insecure direct object reference vulnerability that allows any authenticated user, including low-privilege guest accounts, to read arbitrary attachments by supplying an integer attachment ID to the attachmentdownload.php handler without any project or role...

CVE-2026-19082

Imager versions from 0.4502 before 1.034 for Perl may expose adjacent heap bytes via strlen over-read from zero-count ASCII EXIF entries in copystringtags. copystringtags computes an ASCII EXIF tag's length as entry-size - 1 to strip the trailing NUL. A zero-count ASCII entry sets entry-size to 0...

EUVD-2026-54565

WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires...

EUVD-2026-54564

A vulnerability was determined in SourceCodester Online Clothing Store. Affected by this issue is some unknown functionality of the file /notes/ of the component Dreamweaver Metadata Files. Executing a manipulation can lead to file and directory information exposure. The attack can be launched...

CVE-2026-19229

The CVE-2026-19229 entry concerns SourceCodester Online Clothing Store. Affects an issue in the "/_notes/" component handling Dreamweaver Metadata Files where manipulation of that area can disclose file and directory information. The vulnerability is exploitable remotely, and the exploit has been...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal in the construction of HTTP request URLs due to unescaped variable path components. An attacker can manipulate the URL to access unintended API endpoints or resources by supplying specially crafted repository or...

Use of Uninitialized Resource

Overview Affected versions of this package are vulnerable to Use of Uninitialized Resource via the rsccdecodeframe path in libavcodec/rscc.c. An attacker can disclose heap memory contents by supplying a crafted RSCC video file whose compressed tile decompresses to fewer bytes than the tile geomet...

[SECURITY] [DSA 6417-1] libheif security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6417-1 [email protected] https://www.debian.org/security/ Aron Xu August 08, 2026 https://www.debian.org/security/faq -...

SUSE CVE-2026-70629

FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder libavcodec/rscc.c that allows attackers to disclose heap memory contents by supplying a crafted video file with a compressed tile that decompresses fewer bytes...

SUSE CVE-2026-70631

FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c. An attacker who can cause FFmpeg to decode a crafted TIFF file can supply a valid Deflate-compressed strip that terminates...

SUSE CVE-2026-70634

TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read in the Dictionary compression reverse row iterator tsl/src/compression/algorithms/dictionary.c. The forward path validates the decoded index; the reverse path uses an assertion compiled out of release builds,...