Apache Tomcat Code Execution

The vulnerability of the Apache Tomcat application server is related to the lack of mechanisms for encoding or shielding output data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PT-2026-61203

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the iSCSI target component of the Linux kernel where the chap server compute hash function fails to validate the length of the CHAP R parameter before performing a...

GLPI Output Encoding Code Execution

The vulnerability of the GLPI system for requests, incidents, and inventory management is related to the lack of mechanisms for encoding or filtering output data. Exploiting this vulnerability allows a malicious actor to execute arbitrary codes remotely...

GLPI Output Encoding Code Execution

The vulnerability of the GLPI system for requests, incidents, and inventory management is related to the lack of mechanisms for encoding or shielding output data. Exploiting this vulnerability allows a malicious actor to execute arbitrary codes remotely...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: resteasy (UTSA-2026-016757)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016757 advisory. A cross-site scripting XSS flaw was found in RESTEasy in versions before 3.11.1.Final and before 4.5.3.Final, where it did not properly handle URL encoding when the...

CVE-2026-25607: Weak Encoding for Password

Use of a weak password encoding algorithm in STER software allows the value of the password to be guessed after analyzing how passwords with known values are encoded. This issue was fixed in version 9.5...

Off-by-one Error

Overview Magick.NET-Q8-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Improper Encoding or Escaping of Output

Overview Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output in the htmltomarkdown, markdowntohtml, and inlinecss filters due to incorrect declaration of output safety. An attacker can inject unescaped HTML or script content by supplying specially crafted...

GHSA-VR9V-27GG-QGX4 Umbraco.Cms: XSS/HTML Injection in Umbraco Backoffice confirmation dialog

Impact Authenticated users are able to inject HTML vulnerability into an input field, which is rendered in the confirmation dialog without proper output encoding. Patches This issue has been patched in 17.4.0...

Cross-site Scripting (XSS)

Overview @umbraco-cms/backoffice is a This package contains the types for the Umbraco Backoffice. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the confirmation dialog element. An attacker can execute arbitrary scripts in the context of the affected application ...

audio-opus-bsd (>=0.1.0, <=0.1.2), audiopus (>=0.1.0, <=0.3.0-rc.0) +12 more potentially affected by unknown CVE via audiopus_sys (>=0.1.8, <=0.2.2)

audiopussys CARGO version =0.1.8, =0.1.0, =0.1.0, =0.4.0, =0.0.1, =0.3.0, =0.1.32, =0.0.12, =0.9.0, =0.9.3 - zoog 0.2.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0150...

Security update for php8

This update for php8 fixes the following issues CVE-2025-14179: improper handling of NULL bytes by the PDO Firebird driver when preparing SQL queries can lead to SQL injection bsc1264778. CVE-2026-6722: use-after-free in SOAP using Apache map can lead to remote code execution bsc1264776...

PT-2026-44133

Name of the Vulnerable Software and Affected Versions Symfony versions prior to 5.4.31 Description The parse function in SymfonyComponentHtmlSanitizerTextSanitizerUrlSanitizer utilized by UrlSanitizer::sanitize and any HtmlSanitizer configuration permitting links or media fails to filter Unicode...

PT-2026-45157

Name of the Vulnerable Software and Affected Versions Twig affected versions not specified Description The TwigProfilerDumperHtmlDumper component fails to escape the output of Profile::getTemplate and Profile::getName when writing to HTML. If an attacker can control the template name—which may...

PT-2026-42647

Impact Authenticated users are able to inject HTML vulnerability into an input field, which is rendered in the confirmation dialog without proper output encoding. Patches This issue has been patched in 17.4.0...

Security Bulletin: Security Vulnerabilities affect IBM Voice Gateway

Summary Security Vulnerabilities affect IBM Voice Gateway. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-44288 DESCRIPTION: protobufjs compiles protobuf definitions into JavaScript JS functions. Prior to 7.5.6 and 8.0.2, protobufjs includes a minimal UTF-8 decoder...

ANT-2026-HN9XZXJ9 · freerdp · heap

heap-buffer-overflow critical CVE-2026-45700 GHSA-mpxh-8fq3-x8mh GHSA-mvpx-xj7r-3p3r GHSA-p6r2-4hgm-m6ff Severity Claude critical · Security research firm critical revised; sealed as medium · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Media: MediTech; vcodec: Fix for use-after-free in the encoder release path. The fopsvcodecrelease function frees the context structure ctx without first canceling any pending or ongoing operations in ctx-encodework. This creates...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: - riscv: ftrace: Fixed a panic caused by preemption being disabled. In RISCV, we need to use an AUIPC + JALR pair to encode an immediate jump, creating a jump to an address beyond 4K. This may cause errors if we want to enable...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: nfsd: fixed the NULL dereference in nfs3svcencodegetaclres In error cases, the dentry may be NULL. Before 20798dfe249a, the encoder also checked dentry and dreallyispositivedentry, but I think that was unnecessary—a zero status...