PYSEC-2026-3494 Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images

Summary Pillow's TGA RLE encoder reads past its row buffer when saving a mode "1" image. Adjacent process heap bytes can be copied into the generated TGA file. The bug is reachable through the public save API: python im.saveout, format="TGA", compression="tgarle" Older affected Pillow versions us...

mariadb-connector-c security update

An update is available for mariadb-connector-c. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The MariaDB Native Client library C driver is used to connect...

golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input

A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 Unicode Transformation Format - 8-bit bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of...

Vim < 9.2.0725 Out-of-bounds Write (GHSA-m3hf-xcm3-xhm2)

The version of Vim installed on the remote host is prior to 9.2.0725. It is, therefore, affected by a vulnerability as referenced in the GHSA-m3hf-xcm3-xhm2 advisory. - Vim's single-byte branch of spellsoundfoldsal in src/spell.c translates a word through a spell file's SAL sound-folding rules in...

Incorrect Implementation of Authentication Algorithm

Overview Affected versions of this package are vulnerable to Incorrect Implementation of Authentication Algorithm due to lossy ISO-8859-1 encoding in the digest hash computation. An attacker can log in as a user with a non-Latin-1 password by supplying a collision password that replaces each...

Incorrect Implementation of Authentication Algorithm

Overview Affected versions of this package are vulnerable to Incorrect Implementation of Authentication Algorithm due to lossy ISO-8859-1 encoding in the digest hash computation. An attacker can log in as a user with a non-Latin-1 password by supplying a collision password that replaces each...

Incorrect Implementation of Authentication Algorithm

Overview Affected versions of this package are vulnerable to Incorrect Implementation of Authentication Algorithm due to lossy ISO-8859-1 encoding in the digest hash computation. An attacker can log in as a user with a non-Latin-1 password by supplying a collision password that replaces each...

GHSA-2FVJ-HGJ9-J2GR Eclipse Jetty Digest Authentication: ISO-8859-1 lossy encoding allows authentication bypass via character substitution

Summary The DigestAuthentication.apply method in Jetty's HTTP client uses getBytesStandardCharsets.ISO88591 at three locations lines 171, 179, 196 to compute Digest auth response hashes. ISO-8859-1 silently replaces any character above U+00FF Chinese, Japanese, Cyrillic, Arabic, Emoji, etc. with...

Netty: [Bzip2Decoder] Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang

The Bzip2Decoder handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the event-loop thread in an infinite loop. The vulnerability exists in the run-length encoding RLE state machine within...

GHSA-558V-64GR-WGG4 Netty: [Bzip2Decoder] Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang

The Bzip2Decoder handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the event-loop thread in an infinite loop. The vulnerability exists in the run-length encoding RLE state machine within...

GHSA-Q4F6-JM68-57WW Netty: [HttpContentEncoder] Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service

Impact HttpContentEncoder the superclass of the production handler HttpContentCompressor maintains a per-channel ArrayDeque named acceptEncodingQueue that accumulates attacker-controlled data without any size limit. The queue is filled on the I/O thread for every inbound HTTP request and drained...

Netty: [HttpContentEncoder] Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service

Impact HttpContentEncoder the superclass of the production handler HttpContentCompressor maintains a per-channel ArrayDeque named acceptEncodingQueue that accumulates attacker-controlled data without any size limit. The queue is filled on the I/O thread for every inbound HTTP request and drained...

CVE-2026-50659

A flaw was found in .NET. An authorized attacker can exploit this vulnerability by leveraging improper encoding or escaping of output. This allows the attacker to perform spoofing over a network, potentially deceiving users or systems into believing they are interacting with a trusted entity...

EUVD-2026-47643

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a credential exposure vulnerability: when configured with a Google Service Account key, the full PEM private key was mistakenly placed in the JWT header's kid field intended only for a key identifier. Because JWT headers are Base64-encoded...

PT-2026-63549

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.136.Final Netty versions prior to 4.2.16.Final Description The Bzip2Decoder handler in the compression codec pipeline is susceptible to a denial-of-service attack. A malformed bzip2 stream can trigger an infinite lo...

ALSA-2026:43505 Important: mariadb-connector-c security update

The MariaDB Native Client library C driver is used to connect applications developed in C/C++ to MariaDB and MySQL databases. Security Fixes: mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysqlrealescapestring CVE-2026-44172 For more details...

PT-2026-63547

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.136.Final Netty versions prior to 4.2.16.Final Description HttpContentEncoder the superclass of the production handler HttpContentCompressor maintains a per-channel ArrayDeque named acceptEncodingQueue that...

libaom: libaom: remote code execution via SVC layer context handling with attacker-controlled frames

A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation. Insufficient bounds validation in the AV1 encoder's SVC Scalable Video Coding layer ID control allows an attacker to supply crafted video frame pixels that overlap with internal encoder layer contex...

CVE-2026-47390

Summary: CVE-2026-47390 describes an SSRF protection bypass in PraisonAI’s spider_tools where the URL host validation only blocks exact literal hosts like localhost/127.0.0.1 and fails to resolve DNS or handle non-dotted loopback encodings. This allows attacker-controlled URLs with alternate loop...

glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings

A flaw was found in glibc GNU C Library. When the ungetwc function is called on a file stream using wide characters with specific overlapping single-byte and multi-byte encodings, it may attempt to read data outside of its allocated buffer. This can lead to the unintentional disclosure of sensiti...