Rocky Linux 9.6 [TuxCare] Security Update: buildah / buildah-tests Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792085312)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792085312 advisory. - Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due t...

CVE-2026-101960

An Out-of-bounds Write vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS Evolved on QFX5240, QFX5241 and QFX5250 configured for BGP global-load-balancing and more than 128 ecmp next-hops allows an attacker to cause an rpd crash...

CVE-2026-101960 Junos OS Evolved: QFX Series: A BGP peer causes an rpd crash when global load balancing is enabled

An Out-of-bounds Write vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS Evolved on QFX5240, QFX5241 and QFX5250 configured for BGP global-load-balancing and more than 128 ecmp next-hops allows an attacker to cause an rpd crash...

CVE-2026-101960

Juniper Networks Junos OS Evolved on QFX5240 , QFX5241 , and QFX5250 models contains an Out-of-bounds Write vulnerability (CWE-787) in the routing protocol daemon (rpd) . The issue occurs when the device is configured for BGP global-load-balancing and handles more than 128 ecmp next-hops . A mali...

EUVD-2026-101428

An Out-of-bounds Write vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS Evolved on QFX5240, QFX5241 and QFX5250 configured for BGP global-load-balancing and more than 128 ecmp next-hops allows an attacker to cause an rpd crash...

curl: CVE-2026-111481: server-set cookie still aborts cookie jar

Suggested CWE: CWE-1284: Improper Validation of Specified Quantity in Input H1 didn't let me chose this AI Disclaimer: I've written this report with the help of AI, please feel free to let me know if I made a mistake, I've read the final revision of this report a few times to ensure it was solid...

PT-2026-113955

The GUIX binary resource theme loader sizes its arena and populates it in two separate passes that traverse the resource file with independent cursor arithmetic. Because gx page header data size is never validated against the glyph data a page actually contains, the two passes can read different...

PT-2026-114113

Name of the Vulnerable Software and Affected Versions Praat versions prior to 7.0.03 Description An issue exists in the Model Loader component within the file external/whispercpp/whisper.cpp. Specifically, the whisper model load function is susceptible to an out-of-bounds write, which occurs when...

CVE-2026-101960: Out-of-bounds Write

An Out-of-bounds Write vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS Evolved on QFX5240, QFX5241 and QFX5250 configured for BGP global-load-balancing and more than 128 ecmp next-hops allows an attacker to cause an rpd crash...

PT-2026-113812

An Out-of-bounds Write vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS Evolved on QFX5240, QFX5241 and QFX5250 configured for BGP global-load-balancing and more than 128 ecmp next-hops allows an attacker to cause an rpd crash...

PT-2026-113627

Name of the Vulnerable Software and Affected Versions PO/MO Editor versions prior to 1.4.3 Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting. By manipulating the podata...

CVE-2026-83862

Use after free in Windows Network Load Balancing allows an unauthorized attacker to execute code over an adjacent network...

EUVD-2026-99392

Use after free in Windows Network Load Balancing allows an unauthorized attacker to execute code over a network...

CVE-2026-83862

A Use after free vulnerability exists in Windows Network Load Balancing , which allows an unauthorized attacker to achieve Remote Code Execution (RCE) over a network. This flaw is classified as a high-severity issue (CVSS 3.1 score of 8.8) and can be exploited over an adjacent network . While the...

CVE-2026-108385

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parseenum and EnumRepresentation.rendersymbols use each schema-controlled enum symbol as a...

CVE-2026-90269

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF subsystem. When a BPF program attempts to perform a load-acquire operation on certain untrusted pointers, the BPF verifier fails to apply necessary fault protection. This oversight can lead to a kernel panic if the dereferenced...

CVE-2026-109966 yt-dlp-web-ui through 4.0.0 Argument Injection via Service.Formats JSON-RPC Method

yt-dlp-web-ui through 4.0.0 contains an argument injection vulnerability that allows unauthenticated remote attackers to inject yt-dlp options by supplying a dash-prefixed url parameter to the Service.Formats JSON-RPC method. Attackers can send values like --load-info-json via /rpc/http or /rpc/w...

Windows Network Load Balancing Remote Code Execution Vulnerability

Use after free in Windows Network Load Balancing allows an unauthorized attacker to execute code over an adjacent network...

PT-2026-111207

A security flaw has been discovered in TinyLLaVA TinyLLaVA Factory up to 1abc6ac5e76a68d0fd087a071b56da968e69ca9b. The impacted element is the function load text config of the file tinyllava/model/configuration tinyllava.py of the component TinyLlavaConfig. Performing a manipulation of the argume...

PT-2026-111146

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Enterprise Portal affected versions not specified Description Insufficient input validation in a portal component allows an unauthenticated attacker to craft a malicious link. If a victim clicks this link, attacker-controlled...