Linux Distros Unpatched Vulnerability : CVE-2026-115504

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2 in getcols.c that trusts attacker-controlled heap descriptor lengths for...

ROS-20261023-73-0125

The vulnerability of the Boxstts::getsampleduration function in the HEIF and AVIF file encoding/decoding library involves executing a loop with an unreachable exit condition. Exploiting this vulnerability could allow a malicious actor to cause service failures...

Fortinet FortiSIEM 7.5.0 Path Traversal

Fortinet FortiSIEM version 7.5.0 contains a path traversal flaw in phQueryMaster that allows unauthenticated arbitrary file writes and execution of unauthorized code or commands via specially crafted packets. https://packetstorm.news/download/237290...

Linux Distros Unpatched Vulnerability : CVE-2026-114098

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop that allows attackers to write arbitrary files outside the worktree...

Linux Distros Unpatched Vulnerability : CVE-2026-113681

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains an integer overflow in cineon::Codec::Read that undersizes the...

PT-2026-122223

A vulnerability was identified in UbiquitousLearning mllm up to 2.0.2. The affected element is the function load model of the file pymllm/mobile/convertor/ init .py of the component Convertor. The manipulation of the argument shard file leads to path traversal. The attack needs to be performed...

Linux Distros Unpatched Vulnerability : CVE-2026-113719

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall.uninstallpreviousversion accepts existing seed-package...

Linux Distros Unpatched Vulnerability : CVE-2026-113356

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText that passes draft file contents to unserialize without...

Linux Distros Unpatched Vulnerability : CVE-2025-60492

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A stack overflow in the gfbifsdecnode function /bifs/fielddecode.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via...

Kakao buffer overflow vulnerability

Versions 0.1, 0.2, 0.3, and 0.4 of KAKAO contain a buffer error vulnerability. This vulnerability stems from improper handling of the hiddendim and classnum parameters in the khaiii::nn::Linear::open function within the JSON Config File Handler component, potentially leading to out-of-bounds read...

PT-2026-122435

Impact Fallow reads the Jest and Vitest configs of the repository that it analyzes. A Jest projects entry or a Vitest test.projects entry can name a path. Fallow followed such an entry to a config file and read that file, also when the file was outside the project root. These forms reached outsid...

PT-2026-135097

Security vulnerability affects the rundeck package. The ftp and scp tasks of Apache Ant can download files from a remote server...

PT-2026-122204

Name of the Vulnerable Software and Affected Versions pypdf versions prior to 6.21.2 Description An attacker can craft a PDF file that repeatedly references the same nonexistent indirect object. When accessed, this causes relevant file parts, such as pages, to trigger repeated full-file recovery...

Apple container security vulnerability

Versions of the Apple container prior to 1.5.0 contain a security vulnerability. This vulnerability allows attackers to write to the container’s file system and insert an exec credential plugin into /etc/kubernetes/admin.conf. When kubectl runs on the host, it executes this plugin as a macOS user...

Mervin Praison PraisonAI path traversal vulnerability

Versions Mervin Praison PraisonAI from 2.6.0 up to 4.6.59 contain a security vulnerability. This vulnerability arises because the template loader accepts GitHub template URIs containing a “ref” parameter. It fails to normalize user-specified template paths and “refs”, nor does it verify whether t...

PT-2026-122235

A security flaw has been discovered in Kakao khaiii up to 0.4. The impacted element is the function khaiii::nn::Linear::open of the file src/main/cpp/khaiii/nn/Linear.cpp of the component JSON Config File Handler. The manipulation of the argument hidden dim/class num results in out-of-bounds read...

Aiven Open PGHoard path traversal vulnerability

Versions of Aiven Open PGHoard prior to 2.7.2 contain a path traversal vulnerability. This flaw stems from incomplete path traversal fixes; attackers with write permissions to the backup object storage can exploit path traversal sequences within specially crafted incremental backup lists. They ca...

PT-2026-122115

A cross-account authorization vulnerability in Zimbra Collaboration Suite ZCS allows an authenticated user to insert forged shared-file records into another user's mailbox through FileSharedWithMeRequest. The request bypasses delegated-account authorization and accepts attacker-selected file...

Part-DB arbitrary file upload vulnerability

Versions prior to Part-DB 2.12.1 contain an arbitrary file upload vulnerability. This vulnerability arises because the attachment upload handler stores uploaded files using client-supplied file extensions; however, the extension blacklist does not include “phar”. As a result, uploaded .phar files...

PT-2026-121753

Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated API users to bypass the configured maximum attachment file size by uploading attachments through the API using base64-encoded file data. The application enforces...