CVE-2026-105292 Chaterm before 0.12.1 Login CSRF via chaterm:// OAuth Callback

Chaterm before 0.12.1 contains a login cross-site request forgery vulnerability that allows remote attackers to inject login state by sending chaterm:// callbacks without OAuth state validation. Attackers can trigger a crafted callback with attacker-controlled userInfo from a web page, signing th...

zend-crypt

zend-crypt रिपॉज़िटरी 2019-12-31 को छोड़ दी गई यह रिपॉज़िटरी laminas/laminas-crypt में स्थानांतरित हो गई है। Zend\Crypt कुछ क्रिप्टोग्राफ़िक टूल का समर्थन प्रदान करता है। उपलब्ध कुछ सुविधाएँ हैं: सममित सिफर का उपयोग करके एन्क्रिप्ट-फिर-प्रमाणित करें प्रमाणीकरण चरण HMAC का उपयोग करके प्रदान किया...

CVE-2026-104712: Asymmetric Resource Consumption (Amplification)

Asymmetric resource consumption amplification vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal java.math.BigDecimal property that is then rendered through the Struts tag library, the framework can produce a response many orders of magnitude large...

The vulnerability of the client API library for the IMAP protocol, written in Ruby, arises from the lack of data cleansing measures at the management level. This allows attackers to execute arbitrary commands.

The vulnerability of the client API library for the IMAP protocol, written in Ruby, is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability can allow an attacker to execute arbitrary commands...

The vulnerability of the client API library for the IMAP protocol, written in Ruby, arises from incorrect filtering of input data. This allows attackers to trigger a service failure.

The vulnerability of the client API library for the IMAP protocol, written in Ruby, is related to incorrect filtering of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures...

The vulnerability of the client API library for the IMAP protocol, written in Ruby, arises from the lack of data cleansing measures at the management level. This allows attackers to execute arbitrary commands.

The vulnerability of the client API library for the IMAP protocol, written in Ruby, is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability can allow an attacker to execute arbitrary commands...

The vulnerability of the setuptools project’s packaging simplification library, related to improper handling of Unicode characters, allows attackers to compromise the confidentiality and integrity of protected information.

The vulnerability of the setuptools project’s packaging simplification library is related to incorrect handling of Unicode characters. Exploiting this vulnerability could allow an attacker to compromise the confidentiality and integrity of the protected information...

The vulnerabilities of the get_absolute_path() and validate_absolute_path() methods in the Tornado asynchronous networking library allow attackers to read arbitrary files.

The vulnerability of the getabsolutepath and validateabsolutepath methods in the Tornado asynchronous networking library is related to incorrect definition of links before accessing files. Exploiting this vulnerability allows an attacker to read arbitrary files remotely...

CVE-2026-105642: Improper Control of Generation of Code

Ghost is a Node.js content management system. From 6.56.0 until 6.67.0, an image processing library bundled with Ghost contained a vulnerability in its SVG handling. Any staff user, including Contributors, could create a bookmark card for an attacker-controlled website, resulting in arbitrary...

CVE-2026-85088

Improper Validation of Certificate with Host Mismatch in the C++ and D libraries of Apache Thrift. Both libraries install a default access manager for client sockets — TSSLSocketFactory does so in C++, and the accessManager property does so in D — which compares the peer certificate against the...

PT-2026-106134

Name of the Vulnerable Software and Affected Versions Apache Struts versions 2.5.14 through 2.5.33 Apache Struts versions 6.0.0 through 6.11.0 Apache Struts versions 7.0.0 through 7.3.0 Description An asymmetric resource consumption amplification issue exists when a request parameter is bound to ...

UBUNTU-CVE-2026-66020

virtio-gpu: disable blob scanouts on mapping cleanup...

OPENSUSE-SU-2026:12058-1 golang-github-prometheus-alertmanager-0.34.1-2.1 on GA media

These are all security issues fixed in the golang-github-prometheus-alertmanager-0.34.1-2.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:12056-1 distribution-registry-3.1.2-1.1 on GA media

These are all security issues fixed in the distribution-registry-3.1.2-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-106138

Name of the Vulnerable Software and Affected Versions Ghost versions 6.56.0 through 6.66.0 Description A vulnerability exists in the SVG handling of an image processing library bundled with the Ghost content management system. A staff user with Contributor permissions or higher can create a...

OPENSUSE-SU-2026:12061-1 nvidia-open-driver-G07-signed-check-595.104.02-2.1 on GA media

These are all security issues fixed in the nvidia-open-driver-G07-signed-check-595.104.02-2.1 package on the GA media of openSUSE Tumbleweed...

ALSA-2026:75680 Important: gd security update

GD is an open source code library for the dynamic creation of images by programmers. GD creates PNG, JPEG, GIF, WebP, XPM, BMP images, among other formats. Security Fixes: libgd: buffer overflow when processing specially crafted GIF file CVE-2026-9672 For more details about the security issues,...

CVE-2019-19203

CVE-2019-19203 Oniguruma 6.x में 6.9.4rc2 से पहले एक समस्या पाई गई। gb18030.c फ़ाइल में gb18030mbcenclen फ़ंक्शन में, एक UChar पॉइंटर को बिना यह जांचे कि वह मिलान किए गए स्ट्रिंग के अंत से आगे निकल गया है या नहीं, dereference किया जाता है। इससे हीप-आधारित बफर ओवर-रीड होता है। शोधकर्ता: मैनएनडी ऑफ...

MemoryModulePP

MemoryModulePP memorymodule:https://github.com/fancycode/MemoryModule मेमोरी से DLL लोड करने के लिए लाइब्रेरी memorymodule से संशोधित। एक्सेप्शन सपोर्ट...

Zero-Logon-Exploit

ZeroLogon एक्सप्लॉइट एक Python स्क्रिप्ट जो Zerologon CVE-2020-1472 का शोषण करने के लिए Impacket लाइब्रेरी का उपयोग करती है। यह Netlogon प्रमाणीकरण बाईपास करने का प्रयास करती है। स्क्रिप्ट वर्तमान में पासवर्ड को null मान में बदल देगी। जब एक डोमेन कंट्रोलर पैच किया जाता है, तो डिटेक्शन स्क्रिप्ट...