PT-2026-121855

In the Linux kernel, the following vulnerability has been resolved: ima: return error early if file xattr cannot be changed During early boot, the filesystem is read-only and any changes to xattrs are not allowed. This fails in case of ext4 because changing xattr starts an ext4 transaction which...

Pypdf resource management error vulnerability

Versions of pypdf prior to 6.21.2 contain a resource management error vulnerability. This vulnerability stems from incomplete handling of duplicate malformed cross-reference entries; even when recovery caching is available, each recovery attempt triggers a full reload of the PDF stream. As a...

Twisted resource management error vulnerability

Versions of Twisted prior to 26.10.0rc1 contain a resource management error vulnerability. This vulnerability arises because when processing authenticated SEARCH commands, twisted.mail.imap4.IMAP4Server passes a negative literal size to parseNestedParens. As a result, the parser’s cursor moves...

Mervin Praison PraisonAI input validation error vulnerability

A security vulnerability exists in Mervin Praison PraisonAI versions 4.5.2 through 4.6.59. This vulnerability stems from improper handling of DiscordApproval approval logic; it fails to associate approval messages with requests. Any user capable of accessing a configured Discord channel can appro...

Qt resource management error vulnerability

Qt has a resource management error vulnerability stemming from HTTP/2 client support allowing post-free reuse. This may cause client applications running on malicious or compromised HTTP/2 servers to crash, thereby affecting availability...

Mervin Praison PraisonAI processing logic error vulnerability

A security vulnerability exists in Mervin Praison PraisonAI versions from 4.5.87 up to and including 4.6.59. This vulnerability arises because the recipe.runstream stream execution path fails to perform checks on dangerous tools, allowing recipes declared as executecommand to bypass restrictions ...

Amazon AWS MCP Server input validation error vulnerability

The Amazon AWS MCP Server contains an input validation error vulnerability. This vulnerability stems from an incomplete whitelist of disallowed inputs within the Python code validator in the runscript tool, potentially allowing authenticated remote users to execute arbitrary code within their...

Eclipse KeyPont - GOSE input validation error vulnerability

Eclipse KeyPont – Versions 0.9.0 through 0.13.0-rc1 and versions prior to 1.0.0-rc1 contain an input validation error vulnerability. This vulnerability arises because the JweDirectDecryptorBlock.Decrypt function reads a 64-bit plaintext length from protected header fields of thalesaad without...

Intranda goobi-viewer-core input validation error vulnerability

A security vulnerability exists in Intranda Goobi Viewer Core versions from 4.11.0 up to and including version 26.05. This vulnerability arises because multiple Jakarta WebSocket endpoints fail to verify that associated Http Sessions belong to logged-in users, nor do they validate the Origin head...

Zimbra Collaboration Suite input validation error vulnerability

Zimbra Collaboration Suite ZCS versions 10.1.20 and earlier contain an input validation error vulnerability. This vulnerability stems from improper validation of the emailAddress input in the data source test functionality. It allows authenticated regular users to inject CR/LF sequences into SMTP...

Eclipse KeyPont - GOSE input validation error vulnerability

Eclipse KeyPont – Versions 0.7.5 through 0.13.0-rc1 and versions prior to 1.0.0-rc4 contain an input validation error vulnerability. This vulnerability arises because JwksTrustStore.Get assigns parsed keys to named return values when refreshing the JWKS cache. When a requested key does not exist,...

PT-2026-135631

This update for haproxy fixes the following issue: - h1-htx: report an error on a too long chunk-size line bsc1285046. Changes for haproxy: - Otel Update to version 2.3.0+git2.b031728: DOC: otel: added a security policy to the repository MINOR: otel: test: added a test with an optional upstream...

RHEL 7 : php (RHSA-2026:88693)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:88693 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: fatal error handling retains stale reques...

Google Agent Development Kit for Java input validation error vulnerability

A security vulnerability exists in Google Agent Development Kit for Java versions 0.1.0 through 1.13.0 and 0.3.0 through 1.13.0. This vulnerability stems from a lack of source validation in the WebSocket handling used by ADK Web, coupled with overly permissive cross-origin policies. The /runlive...

RHEL 8 : php:7.4 (RHSA-2026:88532)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:88532 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: OOM bailout during request parsi...

PT-2026-122447

Impact Origin validation error in Microsoft Authentication Library MSAL for Node.js allows an unauthorized attacker to disclose information over a network. This affects the auth code flow. Patches Version 7.1.0 and higher are patched. Workarounds Ensure you pass in only the auth code to to...

The-40-Thieves obsidian-tc resource management error vulnerability

Versions 1.0.1 through 1.31.4 of The-40-Thieves obsidian-tc contain a security vulnerability. This vulnerability arises because createentity, linkentities, renameentity, unlinkentities, and deleteentity fail to properly preserve ownership of notes when re-generating memory notes via the path...

OLo Uni-CLI input validation error vulnerability

A security vulnerability exists in OLo Uni-CLI versions prior to 0.225.2. This vulnerability arises because when old JSON-RPC-over-HTTP MCP transmissions are exposed to the loopback address, the browser Origin header is not validated prior to routing requests. As a result, malicious web pages can...

Zephyr Project Zephyr buffer error vulnerability

Versions Zephyr 4.0.0 through 4.4.2 contain a buffer error vulnerability. This vulnerability arises because the RTIO stream completion callback adxl345processfifosamplescb in drivers/sensor/adi/adxl345/adxl345stream.c fails to write data within the actual buffer size limits. Instead, it queues 6...

OpenWRT odhcpd buffer error vulnerability

OpenWRT odhcpd versions prior to 25.12 contain a buffer error vulnerability. This vulnerability arises because the DHCPv6 IA response handler writes data beyond the end of a fixed 512-byte stack buffer named pdbuf when a single DHCPv6 REQUEST contains sufficient IA options. There are two distinct...