PT-2026-121750

Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.3, Part-DB-server sanitizes SVG files based solely on the user-controlled filename extension rather than actual file content type. An authenticated attacker can upload a malicious SVG with...

PT-2026-121836

VLC for Android before 3.7.2 contains a confused-deputy file overwrite vulnerability in FileUtils.getUri that trusts content URIs based only on the com.fsck.k9.attachmentprovider or gmail-ls authority. A co-installed app without permissions can declare these authorities and send a crafted VIEW...

PT-2026-122143

Kitodo.Production is a workflow management tool for mass digitization and is part of the Kitodo Digital Library Suite. Prior to version 3.9.2, org.kitodo.production.helper.XMLUtils exposes several XML parsing helpers that construct a JAXP parser with the default, non-secure configuration. The...

ROS-20261023-73-0123

The vulnerability of the HEIF and AVIF file encoding/decoding library lies in reading data from buffers beyond their acceptable limits. Exploiting this vulnerability could allow a malicious actor to cause service failures...

PT-2026-122435

Impact Fallow reads the Jest and Vitest configs of the repository that it analyzes. A Jest projects entry or a Vitest test.projects entry can name a path. Fallow followed such an entry to a config file and read that file, also when the file was outside the project root. These forms reached outsid...

PT-2026-122108

A mailbox quota-accounting vulnerability in Zimbra Collaboration Suite ZCS allows an authenticated user to consume another user’s mailbox quota by repeatedly sharing and revoking a document. Creation of the recipient’s shared-file record charges the document size to mailbox-wide usage. Revocation...

PT-2026-121753

Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated API users to bypass the configured maximum attachment file size by uploading attachments through the API using base64-encoded file data. The application enforces...

Linux Distros Unpatched Vulnerability : CVE-2026-114370

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the PathResourceManager component of the Undertow web server. This component is responsible for serving static files from the file system. T...

Linux Distros Unpatched Vulnerability : CVE-2026-114096

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkoutpaths=... that allows attackers to write arbitrary files by...

Linux Distros Unpatched Vulnerability : CVE-2025-60476

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap use-after-free in the gfodfac4cfgcleanlist function /odf/descriptors.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service Do...

Linux Distros Unpatched Vulnerability : CVE-2025-60487

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A segmentation violation in the gfisomgetesd function /isomedia/isomread.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS v...

PT-2026-122115

A cross-account authorization vulnerability in Zimbra Collaboration Suite ZCS allows an authenticated user to insert forged shared-file records into another user's mailbox through FileSharedWithMeRequest. The request bypasses delegated-account authorization and accepts attacker-selected file...

PT-2026-122223

A vulnerability was identified in UbiquitousLearning mllm up to 2.0.2. The affected element is the function load model of the file pymllm/mobile/convertor/ init .py of the component Convertor. The manipulation of the argument shard file leads to path traversal. The attack needs to be performed...

PT-2026-122204

Name of the Vulnerable Software and Affected Versions pypdf versions prior to 6.21.2 Description An attacker can craft a PDF file that repeatedly references the same nonexistent indirect object. When accessed, this causes relevant file parts, such as pages, to trigger repeated full-file recovery...

PT-2026-121888

pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. Prior to version 2.7.2, an incomplete path traversal fix in pghoard allows an attacker with write access to the backup object storage such as S3, GCS, or Azure to execute arbitrary file write...

UBUNTU-CVE-2026-114714

Fix unsafe use of a login name in SquirrelMail import file path...

Kakao buffer overflow vulnerability

Versions 0.1, 0.2, 0.3, and 0.4 of KAKAO contain a buffer error vulnerability. This vulnerability stems from improper handling of the hiddendim and classnum parameters in the khaiii::nn::Linear::open function within the JSON Config File Handler component, potentially leading to out-of-bounds read...

Linux Distros Unpatched Vulnerability : CVE-2026-114609

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fpdf2 is a PDF creation library for Python. Prior to 2.8.8, fpdf2's shared image loader automatically dereferences attacker-controlled HTTPS URLs and raw local...

Linux Distros Unpatched Vulnerability : CVE-2025-60480

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap buffer overflow in the gfodfac4cfgalternativeinfo function /odf/descriptors.c of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master allows attackers t...

Linux Distros Unpatched Vulnerability : CVE-2026-113719

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall.uninstallpreviousversion accepts existing seed-package...