PT-2026-65210

Name of the Vulnerable Software and Affected Versions Safari versions prior to 26.6 iOS versions prior to 26.6 iPadOS versions prior to 26.6 macOS Tahoe versions prior to 26.6 tvOS versions prior to 26.6 visionOS versions prior to 26.6 watchOS versions prior to 26.6 Description An access issue...

CVE-2026-51564

An issue in the redirect parameter in Milk admin =0.9.8 allows remote attackers to redirect users to arbitrary external URLs via a crafted request...

CVE-2026-51564

Milk admin ≤0.9.8 is affected by an open redirect via the redirect parameter. A crafted request can redirect users to arbitrary external URLs. Root cause: improper handling of the redirect parameter in Milk admin. Impact: potential user redirection with network access implications; CVSS v3.1 base...

PT-2026-64993

Integer Underflow Wrap or Wraparound vulnerability in erlang otp erlang/otp erts modules, erlang otp erts erts modules allows Forced Integer Overflow, Excessive Allocation. This vulnerability is associated with program files erts/emulator/beam/external.c, emulator/beam/external.c. The BIT BINARY...

PT-2026-64874

Name of the Vulnerable Software and Affected Versions ZTE File Manager affected versions not specified Description The zte.com.cn.filer/zte.com.cn.filer.FilePreViewActivity activity is intended to preview compressed files. Third-party applications can launch this activity and provide arbitrary fi...

Erlang/OTP -- heap corruption decoding invalidly encoded large tuples

The Erlang/OTP team reports: Fixed heap corruption when an invalidly encoded tuple with an arity of 2^31 or larger is decoded from Erlang's External Term Format binarytoterm...

CVE-2026-57990

Files or directories accessible to external parties in Microsoft Edge Chromium-based allows an unauthorized attacker to disclose information over a network...

EUVD-2026-49059

Files or directories accessible to external parties in Microsoft Edge Chromium-based allows an unauthorized attacker to disclose information over a network...

CVE-2026-17459 perwendel spark SparkJava ExternalResourceHandler.jav staticFiles.externalLocation symlink

A vulnerability was determined in perwendel spark up to 2.9.4. This vulnerability affects the function staticFiles.externalLocation of the file src/main/java/spark/resource/ExternalResourceHandler.jav of the component SparkJava. Executing a manipulation can lead to symlink following. It is possib...

CVE-2026-17459

CVE-2026-17459 affects SparkJava (up to 2.9.4), specifically the ExternalResourceHandler.java function staticFiles.externalLocation. The vulnerability enables symlink following via manipulations of the externalLocation path, with a remote attack surface. Exploitation is described as Proof-of-Conc...

CVE-2026-17459 perwendel spark SparkJava ExternalResourceHandler.jav staticFiles.externalLocation symlink

A vulnerability was determined in perwendel spark up to 2.9.4. This vulnerability affects the function staticFiles.externalLocation of the file src/main/java/spark/resource/ExternalResourceHandler.jav of the component SparkJava. Executing a manipulation can lead to symlink following. It is possib...

PT-2026-64819

Name of the Vulnerable Software and Affected Versions Microsoft Edge Chromium-based affected versions not specified Description An issue exists where files or directories are accessible to external parties, allowing an unauthorized attacker to disclose information over a network. Recommendations ...

PT-2026-64810

Name of the Vulnerable Software and Affected Versions perwendel spark versions prior to 2.9.5 Description A flaw in the SparkJava component allows remote attackers to trigger symlink following. This occurs within the staticFiles.externalLocation function located in the...

GHSA-GCJH-H69Q-9W9G vulnerabilities

Vulnerabilities for packages: hubble-ui, kube-state-metrics, cluster-api, k3s, cloud-provider-azure, openbao, metallb, azure-service-operator, kwok, istio, gatekeeper, kube-metrics-adapter, grafana, kyverno, rancher-system-agent, node-feature-discovery, cloud-provider-gcp-cloud-controller-manager...

XML External Entity (XXE) Injection

Netty is vulnerable to XML External Entity XXE Injection. The vulnerability is due to the XmlDecoder using an AsyncXMLInputFactory with default security settings, leaving DTD and external entity processing enabled. This allows an attacker to send specially crafted XML containing a DOCTYPE...

Open Redirect

@astrojs/node is vulnerable to Open Redirect. The vulnerability is due to improper validation of request paths beginning with /\ when trailingSlash: 'always' is enabled, which allows an attacker to craft a URL that redirects users to an external malicious site...

Linux Distros Unpatched Vulnerability : CVE-2026-56817

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through...

EUVD-2026-44937

Microsoft Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref...

ImageMagick: Policy Bypass in APNG encoder and delegates due to a missing check

Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path...

GHSA-V3J6-27VC-7PW2 ImageMagick: Policy Bypass in APNG encoder and delegates due to a missing check

Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path...