PT-2026-65027

Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code locally...

PT-2026-65016

Improper encoding or escaping of output in .NET allows an authorized attacker to perform spoofing over a network...

PT-2026-65007

Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network...

PT-2026-65032

Improper encoding or escaping of output in .NET allows an authorized attacker to perform spoofing over a network...

Missing Release of Memory after Effective Lifetime

Overview Magick.NET-Q16-HDRI-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package a...

GO-2026-5435 Helm Chart extraction output directory collapse via Chart.yaml name dot-segment in helm.sh/helm

Helm Chart extraction output directory collapse via Chart.yaml name dot-segment in helm.sh/helm...

EUVD-2026-47871

@fastify/static vulnerable to route guard bypass via path traversal...

@fastify/static vulnerable to route guard bypass via path traversal

Impact @fastify/static is vulnerable to a bypass of route-based middleware and guards via non-leading .. and %2E%2E path segments. find-my-way does not normalize .. when matching routes, so a request such as /foo/../deep/secret.txt matches the static plugin's catch-all instead of the guarded...

Integer Overflow or Wraparound

Overview Magick.NET-Q16-HDRI-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Out-of-bounds Write

Overview Magick.NET-Q16-HDRI-AnyCPU is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package...

Out-of-bounds Write

Overview Magick.NET-Q16-OpenMP-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package...

MAL-2026-11047 Malicious code in karpatkey (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b434ae7cf6afb9ce18a54757c03069983e404db695d959bd29aa628864b8349c On import karpatkey, the top-level karpatkey/init.py spawns a daemon background thread that walks the installer's home directory and collects SSH...

CVE-2026-66141

Exim before 4.99.5 allows .forward privilege escalation because forcecommand for a pipe transport is mishandled...

RHSA-2026:41900 Red Hat Security Advisory: .NET 10.0 security, bug fix, and enhancement update

Bulletin has no description...

RHSA-2026:41898 Red Hat Security Advisory: .NET 10.0 security, bug fix, and enhancement update

Bulletin has no description...

RHSA-2026:41897 Red Hat Security Advisory: .NET 10.0 security, bug fix, and enhancement update

Bulletin has no description...

RHSA-2026:41894 Red Hat Security Advisory: .NET 8.0 security, bug fix, and enhancement update

Bulletin has no description...

CVE-2026-15074

@fastify/static up to and including version 10.1.0 fails to reject dot-dot path segments in request pathnames before the file-resolution stage. This is a bypass of the earlier fix for CVE-2026-6414, which only covered encoded forward slashes. Because the underlying send library normalizes dot...

CVE-2026-15074

@fastify/static up to and including version 10.1.0 fails to reject dot-dot path segments in request pathnames before the file-resolution stage. This is a bypass of the earlier fix for CVE-2026-6414, which only covered encoded forward slashes. Because the underlying send library normalizes dot...

CVE-2026-15074

The CVE-2026-15074 issue affects @fastify/static up to and including version 10.1.0, which fails to reject dot-dot path segments in request pathnames before file resolution. This bypasses the earlier fix for CVE-2026-6414 (encoded slashes only) because the underlying send library normalizes dot s...