PT-2026-123308

Name of the Vulnerable Software and Affected Versions Mautic versions 7.0.0 through 7.2.1 Description An unrestricted file upload issue exists in the campaign import feature. When processing a campaign archive, the application copies bundled asset files into a publicly accessible media directory...

PT-2026-125506

WWBN AVideo before 29.5.0 contains a local file inclusion vulnerability that allows unauthenticated attackers to include PHP files outside the locale directory via a crafted Accept-Language header. Attackers can use overlapping traversal sequences like ....// to bypass single-pass removal in...

PT-2026-125312

An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. Processing a maliciously crafted file may lead to heap corruption...

PT-2026-125147

A race condition was addressed with additional validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to modify protected parts of the file system...

UBUNTU-CVE-2026-115207

A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, absolute file paths in patch headers a...

PT-2026-125377

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27.2. An app may be able to modify protected parts of the file system...

PT-2026-125461

The issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted video file may lead to...

PT-2026-125449

A buffer overflow was addressed with improved size validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted audio file may lead to memory corrupti...

PT-2026-125222

A race condition was addressed with improved handling of symbolic links. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to modify protected parts of the file system...

ALSA-2026:89859 Important: flatpak security update

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fixes: flatpak: flatpak: Arbitrary file deletion in root context via path traversal in deploy directory export/bin CVE-2026-97023 flatpak: flatpak: Arbitrary write in root context via pat...

PT-2026-125179

A path handling issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to modify protected parts of the file system...

RHEL 9 : lrzsz (RHSA-2026:89755)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:89755 advisory. Lrzsz consisting of lrz and lsz is a cosmetically modified zmodem/ymodem/xmodem package built from the public-domain version of the rzsz...

PT-2026-123431

Name of the Vulnerable Software and Affected Versions zip versions 7.2.0 through 8.x Description The ZipArchive::extract and ZipArchive::extract unwrapped root dir functions use safe prepare path and simplified components to validate symbolic link targets using lexical prefix comparison instead o...

zip-rs zip input validation error vulnerability

A security vulnerability exists in zip-rs versions prior to 9.0.5. This vulnerability stems from ZipArchive in src/read/stream.rs treating the filename of central directory file headers as authoritative; however, ZipStreamReader extracts these filenames locally without coordinating with repeated...

Apache Camel input validation error vulnerability

Security vulnerabilities exist in Apache Camel versions 4.0.0 through 4.18.5 and 4.19.0 through 4.22.2. These stem from the XQueryBuilder in camel-saxon, which uses the default Saxon Configuration to parse stream-based Source message bodies. No restrictions are placed on DOCTYPE declarations or...

Apple macOS security vulnerabilities

A security vulnerability exists in Apple macOS versions prior to Golden Gate 27.2, macOS Sequoia prior to 15.8.2, and macOS Tahoe prior to 26.7.2. This vulnerability stems from a race condition in symbol link handling, which may allow applications to modify protected portions of the file system...

Qualcomm Snapdragon Primary Bootloader Memory Corruption

Qualcomm Snapdragon Primary Bootloader contains a write-what-where condition while processing a crafted ELF file. This proof of concept provides read-only Sahara/EDL reconnaissance, including identity, memory, PBL, and fuse reads...

Apple MacOS: CVE-2026-112473: OS X update for Screen Sharing Server

An authorization issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An attacker with the legacy VNC password for Screen Sharing may be able to copy files to the Mac...

CentOS Linux 6 [TuxCare] Security Update: rsync Multiple Vulnerabilities (CENTOS6:CLSA-2026:1792767553)

The CentOS Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1792767553 advisory. - rsync before 3.5.0 contains a time-of-check to time-of-use TOCTOU race condition vulnerability in the rrsync restricted shell wrapper...

Google Chrome Microsoft Edge DoS

The vulnerability in the Save to Drive component of Google Chrome and Microsoft Edge is related to insufficient validation of user-supplied protected information. Exploitation of this vulnerability may allow a remote attacker to trigger a denial-of-service condition by sending a specially crafted...