ROS-20261023-73-0125

The vulnerability of the Boxstts::getsampleduration function in the HEIF and AVIF file encoding/decoding library involves executing a loop with an unreachable exit condition. Exploiting this vulnerability could allow a malicious actor to cause service failures...

Fortinet FortiSIEM 7.5.0 Path Traversal

Fortinet FortiSIEM version 7.5.0 contains a path traversal flaw in phQueryMaster that allows unauthenticated arbitrary file writes and execution of unauthorized code or commands via specially crafted packets. https://packetstorm.news/download/237290...

Linux Distros Unpatched Vulnerability : CVE-2025-55654

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A use-after-free in the gffilterpidgetpacket function filtercore/filterpid.c of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service DoS via supplying...

PT-2026-121833

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. In versions 1.0.8.6 and prior, the nextRestore and nextBackup functions in the backup controller accept a file GET parameter and concatenate it directly to DIR BACKUP without calling...

Linux Distros Unpatched Vulnerability : CVE-2026-115504

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2 in getcols.c that trusts attacker-controlled heap descriptor lengths for...

Linux Distros Unpatched Vulnerability : CVE-2026-114140

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. From 5.4.0 until 7.17.2, ExtractOutputPreprocess...

Linux Distros Unpatched Vulnerability : CVE-2025-60482

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap use-after-free in the gfodfac4cfgcleanlist function /odf/descriptors.c of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master allows attackers to cause...

Linux Distros Unpatched Vulnerability : CVE-2026-113681

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains an integer overflow in cineon::Codec::Read that undersizes the...

Linux Distros Unpatched Vulnerability : CVE-2025-60489

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A NULL pointer dereference in the dasherinserttimelineentry function /filters/dasher.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of...

Linux Distros Unpatched Vulnerability : CVE-2026-115378

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability in sftpRecursivePullFile that allows a malicious...

ROS-20261023-73-0123

The vulnerability of the HEIF and AVIF file encoding/decoding library lies in reading data from buffers beyond their acceptable limits. Exploiting this vulnerability could allow a malicious actor to cause service failures...

Red Hat: CVE-2026-55888: xdg-desktop-portal: xdg-desktop-portal: Unauthorized host file access via unvalidated FileChooser filenames

XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileChooser.SaveFiles method to gain arbitrary file access to non-existing files on the host limited to files the user has access to. The FileChooser.SaveFiles method takes...

CVE-2025-30052: Authentication Bypass by Spoofing

The rsyncd service of the CGM CLININET is vulnerable to Authentication Bypass via IP spoofing. Access is granted based solely on the client's source IP address. An attacker able to spoof an allowed IP address, can bypass this check and gain the ability to edit files on the affected system. The...

PT-2026-121804

The rsyncd service of the CGM CLININET is vulnerable to Authentication Bypass via IP spoofing. Access is granted based solely on the client's source IP address. An attacker able to spoof an allowed IP address, can bypass this check and gain the ability to edit files on the affected system. The...

CGM CLININET authorization issue vulnerability

CGM CLININET versions 2026.MS3 and earlier contain an authorization issue vulnerability. This vulnerability arises because the rsyncd service grants access solely based on the client’s source IP address, making it susceptible to IP spoofing attacks that bypass authentication checks. Attackers can...

Linux Distros Unpatched Vulnerability : CVE-2025-60478

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A use-after-free in the gffilterpacketdestroy function /filtercore/filterpck.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service D...

Linux Distros Unpatched Vulnerability : CVE-2025-60479

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A NULL pointer dereference in the StatSFVec2f function /scenemanager/scenestats.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Servic...

Linux Distros Unpatched Vulnerability : CVE-2026-98974

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xfs: fix exchange-range-to-eof file size exchange Norbert Szetei posted a patch containing an incomplete description of a bug in XFSIOCEXCHANGERANGE's TOEOF fla...

PT-2026-122435

Impact Fallow reads the Jest and Vitest configs of the repository that it analyzes. A Jest projects entry or a Vitest test.projects entry can name a path. Fallow followed such an entry to a config file and read that file, also when the file was outside the project root. These forms reached outsid...

Linux Distros Unpatched Vulnerability : CVE-2025-60480

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap buffer overflow in the gfodfac4cfgalternativeinfo function /odf/descriptors.c of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master allows attackers t...