glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list"

A flaw was found in GLib. An off-by-one error can occur in the gkeyfilegetlocalestringlist function in the gkeyfile.c file when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundar...

RHEL 8 : mingw-glib2 (RHSA-2026:49512)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:49512 advisory. GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in...

ALSA-2026:49512 Important: mingw-glib2 security update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fixes: glib: GLib: Buffer underflow...

VulnCheck KEV: CVE-2026-3836

A local, unprivileged attacker can exploit a path traversal flaw in the D-Bus locale configuration, crashing dnf5daemon-server via a crafted string. This can lead to a DoS with a core dump...

CVE-2026-54659

Pagy is agnostic pagination in plain Ruby. From 43.0.0 until 43.5.6, Pagy::I18n.locale= in gem/lib/pagy/modules/i18n/i18n.rb stored locale values verbatim and later used them as .yml path components, allowing untrusted params:locale values with absolute paths or ../ sequences to create a file...

CVE-2026-54659

Pagy is agnostic pagination in plain Ruby. From 43.0.0 until 43.5.6, Pagy::I18n.locale= in gem/lib/pagy/modules/i18n/i18n.rb stored locale values verbatim and later used them as .yml path components, allowing untrusted params:locale values with absolute paths or ../ sequences to create a file...

CVE-2026-54659 Pagy I18n locale option is not validated before being used in a file path

Pagy is agnostic pagination in plain Ruby. From 43.0.0 until 43.5.6, Pagy::I18n.locale= in gem/lib/pagy/modules/i18n/i18n.rb stored locale values verbatim and later used them as .yml path components, allowing untrusted params:locale values with absolute paths or ../ sequences to create a file...

CVE-2026-54659 Pagy I18n locale option is not validated before being used in a file path

Pagy is agnostic pagination in plain Ruby. From 43.0.0 until 43.5.6, Pagy::I18n.locale= in gem/lib/pagy/modules/i18n/i18n.rb stored locale values verbatim and later used them as .yml path components, allowing untrusted params:locale values with absolute paths or ../ sequences to create a file...

CVE-2026-54659 Pagy I18n locale option is not validated before being used in a file path

Pagy is agnostic pagination in plain Ruby. From 43.0.0 until 43.5.6, Pagy::I18n.locale= in gem/lib/pagy/modules/i18n/i18n.rb stored locale values verbatim and later used them as .yml path components, allowing untrusted params:locale values with absolute paths or ../ sequences to create a file...

CVE-2026-54659

Pagy is agnostic pagination in plain Ruby. From 43.0.0 until 43.5.6, Pagy::I18n.locale= in gem/lib/pagy/modules/i18n/i18n.rb stored locale values verbatim and later used them as .yml path components, allowing untrusted params:locale values with absolute paths or ../ sequences to create a file...

EUVD-2026-50088

Pagy is agnostic pagination in plain Ruby. From 43.0.0 until 43.5.6, Pagy::I18n.locale= in gem/lib/pagy/modules/i18n/i18n.rb stored locale values verbatim and later used them as .yml path components, allowing untrusted params:locale values with absolute paths or ../ sequences to create a file...

CVE-2026-54659

Pagy (Ruby gem) contains a vulnerability in the I18n locale handling prior to 43.5.6: Pagy::I18n.locale= stores locale values verbatim and later uses them as .yml path components, enabling untrusted params[:locale] values with absolute paths or ../ sequences to probe file existence/readability of...

CVE-2026-54659

Pagy is agnostic pagination in plain Ruby. From 43.0.0 until 43.5.6, Pagy::I18n.locale= in gem/lib/pagy/modules/i18n/i18n.rb stored locale values verbatim and later used them as .yml path components, allowing untrusted params:locale values with absolute paths or ../ sequences to create a file...

Pagy I18n locale option is not validated before being used in a file path

Summary Pagy::I18n.locale= did not validate its argument before using it as a path component to load the matching dictionary file .yml. An application that assigns untrusted input to the locale — e.g. the common pattern Pagy::I18n.locale = params:locale — let that input influence which file Pagy...

GHSA-2XMW-F8J8-WFXC Pagy I18n locale option is not validated before being used in a file path

Summary Pagy::I18n.locale= did not validate its argument before using it as a path component to load the matching dictionary file .yml. An application that assigns untrusted input to the locale — e.g. the common pattern Pagy::I18n.locale = params:locale — let that input influence which file Pagy...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the locale process. An attacker can determine the existence or readability of arbitrary .yml files and cause server-side reading of attacker-chosen files into the process by supplying crafted input that manipulat...

Security update for glib2

This update for glib2 fixes the following issues: CVE-2026-58010: error during gvstupleisnormal alignment validation could cause a 1-byte out-of-bounds read bsc1270009. CVE-2026-58011: invalid GDateTime in gdatetimegetymd could trigger a 2-byte out-of-bounds read bsc1270010. CVE-2026-58012: raw...

SUSE-SU-2026:3341-1 Security update for glib2

This update for glib2 fixes the following issues: - CVE-2026-58010: error during gvstupleisnormal alignment validation could cause a 1-byte out-of-bounds read bsc1270009. - CVE-2026-58011: invalid GDateTime in gdatetimegetymd could trigger a 2-byte out-of-bounds read bsc1270010. - CVE-2026-58012:...

Pagy I18n locale option is not validated before being used in a file path

Summary Pagy::I18n.locale= did not validate its argument before using it as a path component to load the matching dictionary file .yml. An application that assigns untrusted input to the locale — e.g. the common pattern Pagy::I18n.locale = params:locale — let that input influence which file Pagy...

PT-2026-65621

Name of the Vulnerable Software and Affected Versions Pagy versions 43.0.0 through 43.5.5 Description In the Pagy::I18n.locale= setter within gem/lib/pagy/modules/i18n/i18n.rb, locale values are stored verbatim and subsequently used as path components to load YAML dictionary files. When an...