PT-2026-121753

Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated API users to bypass the configured maximum attachment file size by uploading attachments through the API using base64-encoded file data. The application enforces...

Linux Distros Unpatched Vulnerability : CVE-2026-114096

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkoutpaths=... that allows attackers to write arbitrary files by...

Linux Distros Unpatched Vulnerability : CVE-2025-60480

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap buffer overflow in the gfodfac4cfgalternativeinfo function /odf/descriptors.c of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master allows attackers t...

Linux Distros Unpatched Vulnerability : CVE-2026-114140

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. From 5.4.0 until 7.17.2, ExtractOutputPreprocess...

Curl 7.20.0 < 8.23.0 Local File Overwrite

The version of curl installed on the remote host is 7.20.0 prior to 8.23.0. It is, therefore, affected by a file overwrite vulnerability: - When invoked with --remote-header-name -J, curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response...

Linux Distros Unpatched Vulnerability : CVE-2026-99052

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - selinux: preserve NATIVELABELS on already-initialized sb in setmntopts When an NFSv4 filesystem exported with securitylabel is mounted a second time, sgetfc...

CentOS Linux 7 [TuxCare] Security Update: gstreamer1-plugins-base / gstreamer1-plugins-base-devel / etc (CENTOS7:CLSA-2026:1790603589)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1790603589 advisory. - GStreamer OGG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execu...

Linux Distros Unpatched Vulnerability : CVE-2025-60487

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A segmentation violation in the gfisomgetesd function /isomedia/isomread.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS v...

SUSE CVE-2026-92205

BusyBox libarchive Symlink Directory Traversal Arbitrary File Creation Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of BusyBox. User interaction is required to exploit this vulnerability in that the target must visit a malicious pag...

SUSE CVE-2026-114094

Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a malicious repository with a tree entry named 'C:' that bypasses NTFS validation and writes files outside the worktree to achieve remote code...

SUSE CVE-2026-114140

The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. From 5.4.0 until 7.17.2, ExtractOutputPreprocessor in nbconvert/preprocessors/extractoutput.py joins the attacker-controlled cell output metadata filename to outputfilesdir without...

SUSE CVE-2026-115207

A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, absolute file paths in patch headers a...

CVE-2026-113872

A flaw was found in multer. A remote attacker could cause a Denial of Service DoS by sending and abruptly aborting a file upload request when an asynchronous file filter is configured. When the aborted request's pending filter callback finishes, it triggers an unhandled stream error, leading to a...

CVE-2026-115424

A flaw was found in the OpenShift client oc. When extracting container image layers with oc image extract, the application fails to properly sanitize symbolic and hard link targets pointing to absolute paths or to sibling directories of the extraction destination. An attacker who supplies a...

Security Bulletin: IBM Sterling B2B Integrator and IBM Sterling File Gateway affected by Exposure of Sensitive Information in Logs Vulnerability (CVE-2026-12737)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed this security vulnerability Vulnerability Details CVEID:CVE-2026-12737 DESCRIPTION: IBM Sterling B2B Integrator and IBM Sterling File Gateway stores potentially sensitive information in log files that could be read b...

Security Bulletin: A Security Vulnerability in Apache FreeMarker affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-84939)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed this security vulnerability Vulnerability Details CVEID:CVE-2026-84939 DESCRIPTION: Path traversal vulnerability in Apache FreeMarker template loading mechanism, if the attacker can specify an arbitrary malformed...

Security Bulletin: Multiple Security Vulnerabilities in Jackson affect IBM Sterling B2B Integrator and IBM Sterling File Gateway

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed these security vulnerabilities Vulnerability Details CVEID:CVE-2026-54512 DESCRIPTION: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0...

Security Bulletin: Multiple Security Vulnerabilities in Netty affect IBM Sterling B2B Integrator and IBM Sterling File Gateway

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed these security vulnerabilities Vulnerability Details CVEID:CVE-2026-59919 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty'...

AZL-111095 CVE-2026-114583 affecting package tensorflow 2.16.1-11

tarfile.tarfilter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall with filter="tar" to write files...

DEBIAN-CVE-2026-114583

tarfile.tarfilter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall with filter="tar" to write files...