CVE-2026-59198

A flaw was found in Pillow, a Python imaging library. When saving a mode 1 image with TGA RLE compression, the TGA RLE encoder reads beyond its allocated memory buffer. This out-of-bounds read allows adjacent process heap memory to be copied into the generated TGA file, potentially leading to...

Linux Distros Unpatched Vulnerability : CVE-2026-59205

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pillow is a Python imaging library. Prior to 12.3.0, Pillow's ImageCms.ImageCmsTransform.applyim, imOut API can trigger controlled native heap corruption when t...

perl-Archive-Tar security update

3.02-512.1 - Fix CVE-2026-42496: validate symlink and hardlink targets in secure extract mode - Resolves: RHEL-181651...

PT-2026-60510

A potential out-of-bounds write vulnerability could allow a local privileged attacker to modify power management settings in System Management Mode...

PT-2026-60511

A potential vulnerability could allow a local privileged attacker to disclose the address of protected System Management Mode memory...

CVE-2026-10587: Out-of-bounds Write

A potential out-of-bounds write vulnerability could allow a local privileged attacker to modify power management settings in System Management Mode...

CVE-2026-10589: Out-of-bounds Write

A potential out of bounds write vulnerability could allow a local privileged attacker to execute code in System Management Mode...

CVE-2026-10588: Exposure of Sensitive System Information to an Unauthorized Control Sphere

A potential vulnerability could allow a local privileged attacker to disclose the address of protected System Management Mode memory...

PT-2026-60456

stoatchat versions before 0.7.8 fail to enforce account creation restrictions including invite-only mode, email verification, captcha, and shield verification. Attackers can create unlimited accounts with unverified email addresses, increasing denial-of-service risk and compromising service...

PT-2026-60676

When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled. The dataplane authentication token is sent over this unverified connection Impact An on-path attacker can intercept the dataplane...

PT-2026-60512

A potential out of bounds write vulnerability could allow a local privileged attacker to execute code in System Management Mode...

PT-2026-60560

Name of the Vulnerable Software and Affected Versions Argo Workflows versions prior to 3.7.15 Argo Workflows versions prior to 4.0.6 Description An incomplete allow-list implementation in the ValidateUserOverrides and SanitizeUserWorkflowSpec functions within workflow/util/merge.go allows for the...

PT-2026-60686

Name of the Vulnerable Software and Affected Versions Envoy Gateway affected versions not specified Description When operating in GatewayNamespaceMode provider.kubernetes.deploy.type=GatewayNamespace, the xDS gRPC server lacks a UnaryInterceptor, leaving Fetch endpoints unauthenticated...

CVE-2026-12409: Cross-Site Request Forgery (CSRF)

The Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.3.6. This is due to missing or incorrect nonce validation on the ulpbadminajax function. Thi...

PT-2026-60652

Impact When Envoy Gateway runs in GatewayNamespaceMode provider.kubernetes.deploy.type=GatewayNamespace, the xDS gRPC server is configured with a StreamInterceptor for JWT authentication but no UnaryInterceptor. The go-control-plane xDS server exposes both streaming and unary Fetch RPC methods fo...

ROS-20260716-73-0072

The vulnerability of the Overview Mode function in Google Chrome browser is related to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

openSUSE 16 Security Update : libxml2 (openSUSE-SU-2026:21317-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21317-1 advisory. This update for libxml2 fixes the following issues - CVE-2026-6732: crafted XSD-validated document can cause a denial of service bsc1262719. -...

Improper Authorization

n8n-mcp is vulnerable to Improper Authorization. The vulnerability is due to insufficient tenant isolation in multi-tenant HTTP mode, which allows an authenticated tenant to access locally stored workflow version backups outside of its assigned tenant scope...

CVE-2026-55608

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to 2.57.4, multi-tenant HTTP mode with ENABLEMULTITENANT=true could allow an authenticated tenant to access default-scope workflowversions backups instead of being confined to...

CVE-2026-54052

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to 2.56.1, in HTTP mode with multi-tenancy enabled through ENABLEMULTITENANT=true, n8n-mcp's local workflow version history backups were not isolated per tenant, allowing an...