CVE-2026-73620 GitPython before 3.1.57 Arbitrary File Overwrite and Read

GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout and TagReference.create, allowing attackers to pass unsafe options via kwargs. Attackers can use --prefix to overwrite arbitrary files with repository content or -F to read arbitrary files returned in-band...

JLSEC-2026-1300

Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted XLS file to the getstring function in xlstool.c:411...

JLSEC-2026-1299

Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted XLS file to the getstring function in xlstool.c:395...

CVE-2026-16455

In Teltonika Networks RUTOS devices running versions 7.07.1 through 7.24.1 and TSWOS devices running versions 1.03 through 1.10, a vulnerability exists whereby a lower privileged user can escalate privileges to administrative level due to unsafe calls to an execl function...

CVE-2026-59506

: Missing Authentication for Critical Function vulnerability in Priority Portal Generator addon to Priority ERP developed by Soft Solutions. This issue affects Portal Generator addon to Priority ERP developed by Soft Solutions: All versions without Priwall v3...

CVE-2026-59506

CWE-306: Missing Authentication for Critical Function...

CVE-2026-59506 Priority – CWE-306: Missing Authentication for Critical Function

: Missing Authentication for Critical Function vulnerability in Priority Portal Generator addon to Priority ERP developed by Soft Solutions. This issue affects Portal Generator addon to Priority ERP developed by Soft Solutions: All versions without Priwall v3...

CVE-2026-59506

Technical details are provided only in the Initial Description (CWE-306, CVSS 3.1, CRITICAL) and no connected documents contain further technical specifics for CVE-2026-59506.

EUVD-2026-57773

CWE-306: Missing Authentication for Critical Function...

CVE-2026-59506 Priority – CWE-306: Missing Authentication for Critical Function

: Missing Authentication for Critical Function vulnerability in Priority Portal Generator addon to Priority ERP developed by Soft Solutions. This issue affects Portal Generator addon to Priority ERP developed by Soft Solutions: All versions without Priwall v3...

python-idna: idna: Denial of Service via specially crafted long inputs

A flaw was found in the idna library, which handles Internationalized Domain Names in Python applications. A remote attacker could exploit this vulnerability by sending specially crafted, excessively long inputs to the library's encoding function. This could cause the system to consume significan...

python-idna: idna: Denial of Service via specially crafted long inputs

A flaw was found in the idna library, which handles Internationalized Domain Names in Python applications. A remote attacker could exploit this vulnerability by sending specially crafted, excessively long inputs to the library's encoding function. This could cause the system to consume significan...

PT-2026-71656

Name of the Vulnerable Software and Affected Versions rsync versions 3.0.1 through 3.4.x Description An out-of-bounds write exists in the read args function. A malicious sender can corrupt adjacent heap memory by providing a crafted argument list. This occurs when the argument count fills the arg...

RHEL 8 : dracut (RHSA-2026:54575)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:54575 advisory. The dracut packages contain an event-driven initial RAM file system initramfs generator infrastructure based on the udev device manager. The virtual...

MiracleLinux 9 : glibc-2.34-274.el9_8 (AXSA:2026-1527:10)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1527:10 advisory. glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings CVE-2026-5928 glibc: glibc:...

RHEL 10 : dracut (RHSA-2026:54576)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:54576 advisory. The dracut packages contain an event-driven initial RAM file system initramfs generator infrastructure based on the udev device manager. The virtua...

RHEL 9 : dracut (RHSA-2026:54571)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:54571 advisory. The dracut packages contain an event-driven initial RAM file system initramfs generator infrastructure based on the udev device manager. The virtual...

CVE-2026-16455: Improper Neutralization of CRLF Sequences

In Teltonika Networks RUTOS devices running versions 7.07.1 through 7.24.1 and TSWOS devices running versions 1.03 through 1.10, a vulnerability exists whereby a lower privileged user can escalate privileges to administrative level due to unsafe calls to an execl function...

PT-2026-71416

CWE-306: Missing Authentication for Critical Function...

CVE-2026-73649: Improper Control of Generation of Code

Velocity.js is a JavaScript implementation of the Apache Velocity template engine. Prior to 2.1.7, the earlier fix for CVE-2026-44966 filtered constructor, proto, and prototype only in the set assignment handler in src/compile/set.ts, while property-read expressions in src/compile/references.ts...