EUVD-2026-50963

A path traversal vulnerability was found in the Wallpaper component of ADM. The vulnerability occurs because user-controlled wallpaper path input is not sufficiently validated before being used for file access. An authenticated attacker can exploit this issue to access or manipulate files outside...

DEBIAN-CVE-2026-62946

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to both 6.9.13-52 and 7.1.2-27, processing an extremely large JNX file on 32-bit platforms can cause an integer overflow, leading to a heap buffer over-write. This issue has been fixed...

EUVD-2026-50574

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to both 6.9.13-52 and 7.1.2-27, processing an extremely large JNX file on 32-bit platforms can cause an integer overflow, leading to a heap buffer over-write. This issue has been fixed...

CVE-2026-62946

ImageMagick (free/open-source image manipulation tool) has a CVE-2026-62946 affecting the JNX decoder on 32-bit builds. The issue is an integer overflow in the JNX decoder when processing extremely large JNX files, which can lead to a heap buffer over-write. The vulnerability affects builds prior...

CVE-2026-62946 ImageMagick: Integer Overflow in JNX decoder causes heap buffer over-write when processing extremly large files on 32-bit builds

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to both 6.9.13-52 and 7.1.2-27, processing an extremely large JNX file on 32-bit platforms can cause an integer overflow, leading to a heap buffer over-write. This issue has been fixed...

CVE-2026-62946

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to both 6.9.13-52 and 7.1.2-27, processing an extremely large JNX file on 32-bit platforms can cause an integer overflow, leading to a heap buffer over-write. This issue has been fixed...

PT-2026-66425

Name of the Vulnerable Software and Affected Versions Phoenix Contact CHARX SEC-3150 affected versions not specified Description A low-privileged remote attacker with operator access can upload arbitrary files through the REST endpoint used for firmware updates. This allows for the persistent...

PT-2026-66530

Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.4, all four media filters image, audio, video, document in banks accept untrusted user input as file paths via Pathvalue and pass them directly to openfile path, "rb" without any path sanitization,...

PT-2026-66598

Name of the Vulnerable Software and Affected Versions OpenClaw Dashboard version 3.0.0 Description A stored cross-site scripting issue exists where unauthenticated remote attackers can inject arbitrary HTML and script payloads. This occurs when a crafted username is submitted in a failed login PO...

CVE-2026-12942: Improper Limitation of a Pathname to a Restricted Directory

IBM Langflow OSS 1.0.0 through 1.10.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot " sequences /.. / to view arbitrary files on the system...

Gitea Code Execution

The vulnerability of the services/repository/files/patch.go file in the Git repository management system Gitea is related to improper code generation management. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code and gain unauthorized access to...

vim security update

9.1.083-9.0.1.el102.12 - Remove upstream references Orabug: 31197557 2:9.1.083-9.12 - RHEL-201113 CVE-2026-59856 vim: potential command execution in PHP omni-completion 2:9.1.083-9.11 - RHEL-203857 CVE-2026-59858 vim: arbitrary Ex command execution during C omni-completion 2:9.1.083-9.10 -...

PT-2026-66517

Name of the Vulnerable Software and Affected Versions Apache Kyuubi versions 1.7.0 through 1.11.1 Description Improper handling of REST batch multipart uploads allows a remote attacker to use path traversal sequences in the client-supplied filename. This can lead to the server writing controlled...

PT-2026-66487

Name of the Vulnerable Software and Affected Versions IBM App Connect Enterprise versions 13.0.1.0 through 13.0.7.2 IBM App Connect Enterprise versions 12.0.1.0 through 12.0.12.27 Description A remote attacker can perform directory traversal on the system. By sending a specially crafted URL reque...

PT-2026-66483

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 stores potentially sensitive information in log files that could be read by a local user...

PT-2026-66536

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.8.4 Description Broken access control issues in the file handling API allow unauthorized access to user files, breaking tenant isolation in multi-user deployments. The endpoint '/api/v1/files/images/fl...

PT-2026-66539

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.1 Description A directory traversal issue allows a remote attacker to view arbitrary files on the system. This is achieved by sending a specially crafted URL request containing dot-dot-slash /../...

PT-2026-66544

Name of the Vulnerable Software and Affected Versions Leantime version 3.6.2 Description An authenticated attacker can perform server-side request forgery SSRF and local file inclusion LFI by providing unsanitized filenames to the file get contents function within the Blueprints::import method...

PT-2026-66613

Name of the Vulnerable Software and Affected Versions ansible-collection-redhat-leapp affected versions not specified Description A flaw exists where an attacker with privileged write access to a managed node's Leapp report content can manipulate the data. When an operator executes a specific...

PT-2026-76105

ImageMagick before 7.1.2-26 and 6.9.13-x before 6.9.13-51 contains a policy bypass vulnerability in the -script operation due to missing security policy checks. This allows reading files from paths that are otherwise disallowed by the configured security policy...