Apple MacOS: CVE-2026-84604: OS X update for OpenBSM

A stack buffer overflow was addressed through improved input validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. Processing a maliciously crafted audit file may corrupt process memory...

PT-2026-125505

Name of the Vulnerable Software and Affected Versions Pixar Animation Studio OpenUSD affected versions not specified Description A flaw in the parsing of USDC and USDZ files allows remote attackers to execute arbitrary code. The issue occurs because the software fails to validate the existence of...

UBUNTU-CVE-2026-115722

RPly through 1.1.4 contains an improper array index validation vulnerability in plyreadheaderproperty that accepts list as a list property's length or value type. Attackers can supply a crafted PLY file that makes plyreadlistproperty call an out-of-bounds handler, crashing ASCII parsing or...

PT-2026-125261

An integer overflow was addressed with improved bounds checking. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted video file may lead to unexpected system termination...

Apple iOS security vulnerabilities

A security vulnerability exists in Apple iOS versions prior to 26.7.2, Apple iPadOS versions prior to 26.7.2, Apple iOS versions prior to 27.2, and Apple iPadOS versions prior to 27.2. This vulnerability stems from path handling issues, potentially allowing attackers with physical access to read...

UBUNTU-CVE-2026-115378

Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability in sftpRecursivePullFile that allows a malicious incus-agent to escape the target directory during incus file pull -r. Attackers with root in a virtual machine can return duplicate entrie...

UBUNTU-CVE-2026-115375

Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a path traversal vulnerability that allows clients able to create instances to write files on the host. The flaw stems from unvalidated dependent custom volume names in instance backup index.yaml files. Attackers can import a crafted instan...

PT-2026-123409

Name of the Vulnerable Software and Affected Versions zip versions prior to 9.0.5 Description In the zip library for Rust, ZipArchive treats Central Directory File Header filenames as authoritative, whereas ZipStreamReader extracts using Local File Header filenames without reconciling duplicate...

SiteIsolation Component DoS

The vulnerability in the SiteIsolation component of Google Chrome and Microsoft Edge web browsers is related to improper authorization. Exploiting this vulnerability enables a remote attacker to cause a denial of service by using a specially crafted file...

Google Chrome Microsoft Edge DoS

The vulnerability in the File Input component of Google Chrome and Microsoft Edge web browsers is related to insecure privilege management. Exploitation of this vulnerability may allow a remote attacker to cause a denial of service by using a specially crafted HTML page...

Safe Browsing Protected Information Access

The vulnerability in the Safe Browsing component of Google Chrome and Microsoft Edge is related to insufficient validation of input protected information. Exploitation of this vulnerability may allow a remote attacker to gain access to protected information via a malicious file...

VulnCheck KEV: CVE-2025-26986

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in StylemixThemes Pearl - Corporate Business pearl allows PHP Local File Inclusion.This issue affects Pearl - Corporate Business: from n/a through 3.4.8...

Oracle Linux 9 : python3.9 (ELSA-2026-89742)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-89742 advisory. - CVE-2026-19553 python3.9: python: Certificate verification bypass via missing serverhostname validation in SSLContext.wrapbio Resolves: RHEL-274143 ...

Important: lrzsz security, bug fix, and enhancement update

Lrzsz consisting of lrz and lsz is a cosmetically modified zmodem/ymodem/xmodem package built from the public-domain version of the rzsz package. Lrzsz was created to provide a working GNU copylefted Zmodem solution for Linux systems. Security Fixes: lrzsz: lrzsz: Arbitrary file overwrite via...

Important: podman security update

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fixes: podman: Arbitrary file write when importing OCI archive CVE-2025-11395 net/http: golang:...

Pixar Animation Studio OpenUSD Crate File Parsing Double Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Pixar Animation Studio OpenUSD. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within th...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via formatters/raw.php, which fetches a user-supplied URL using file without validating the target host. An unauthenticated attacker can supply an internal URL as the raw inclusion target, causing the...

CVE-2026-116168

SiYuan before 3.8.7 contains a path traversal vulnerability in the MCP asset tool because validateAssetUploadPaths relies on an incomplete sensitive-path blacklist that omits .env and other secret files. Authenticated attackers driving the MCP asset upload action can copy such local files into th...

EUVD-2026-109429

SiYuan before 3.8.7 contains a path traversal vulnerability in the MCP asset tool because validateAssetUploadPaths relies on an incomplete sensitive-path blacklist that omits .env and other secret files. Authenticated attackers driving the MCP asset upload action can copy such local files into th...

CVE-2026-116168

SiYuan versions prior to v3.8.7 are vulnerable to a path traversal flaw within the MCP asset tool . The root cause is that the validateAssetUploadPaths function relies on an incomplete sensitive-path blacklist, which fails to exclude files such as .env and other secrets. This allows authenticated...