CVE-2026-19002: Buffer Copy without Checking Size of Input

A missing bounds check when parsing stored procedure parameter metadata in the MongoDB BI Connector ODBC Driver can result in an out-of-bounds write in the client application process. Triggering this issue requires control over the server the driver connects to, or the ability to respond in its...

CVE-2026-19001: Integer Overflow or Wraparound

The MongoDB BI Connector ODBC Driver may write outside the bounds of a fixed-size buffer when an application supplies an unusually long catalog, schema, or object name to a metadata retrieval function. This may result in memory corruption within the calling application's process, leading to...

CVE-2026-66380: Missing Authorization

An authenticated user without repository read permission may access private OCI referrer metadata under specific conditions...

CVE-2026-66379: Missing Authorization

An authenticated user may view private Puppet module metadata without repository read access...

CVE-2026-66378: Missing Authorization

An authenticated user without repository read permission may access private NuGet metadata under specific conditions...

CVE-2026-73290: Incorrect Authorization

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, an anonymous ListObjectVersions request in rustfs/src/storage/access.rs that lacks a direct bucket-policy grant falls back to an s3:ListBucket check and returns before the policyallowed path applies...

CVE-2026-69106: Improper Input Validation

A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consumers to retrieve untrusted content...

PT-2026-76563

Name of the Vulnerable Software and Affected Versions compliance-trestle versions prior to 4.0.4 Description An incomplete allowlist in the URLSecurityValidator within trestle/core/remote/security.py allows Server-Side Request Forgery SSRF via the HTTPSFetcher and SFTPFetcher remote-fetch paths...

PT-2026-71104

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An authenticated user who lacks repository read permissions can access private OCI Open Container Initiative referrer metadata under specific conditions. OCI...

PT-2026-71091

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-rc.1, RustFS Object Lock enforcement in crates/ecstore/src/bucket/object lock/objectlock sys.rs lets check object lock for deletion, delete prefix, and lifecycle and scanner sweeps treat ConfigNotFound, unreadable...

PT-2026-71099

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A low-privilege authenticated user can permanently delete protected internal metadata across multiple repositories under specific conditions. Recommendations At...

CVE-2026-73432: Server-Side Request Forgery (SSRF)

Vulnerability-Lookup contains a server-side request forgery SSRF vulnerability in the remote-instance synchronization functionality. Remote instance addresses were validated only for basic URL syntax before being stored, while the synchronization worker later dereferenced these addresses using...

PT-2026-71232

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description An information disclosure issue exists in the /api/notebook/getNotebookInfo endpoint. The system fails to perform proper authorization checks, allowing users with read-only roles or anonymous readers ...

CVE-2026-66375: Missing Authorization

A low-privilege authenticated user may permanently remove protected internal metadata across repositories under specific conditions...

Linux Distros Unpatched Vulnerability : CVE-2026-68384

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: drm/xe/vf: Fix VF CCS attach/detach race with in-flight BO moves xebomove attaches VF CCS...

Linux Distros Unpatched Vulnerability : CVE-2026-71261

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drlibs drwav.h all versions through current master contains an integer overflow in W64 CUE chunk metadata parsing. In drwavmetadataprocesschunk, a stage-1...

PT-2026-71135

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An authenticated user who lacks repository read permissions may be able to access package metadata under specific conditions. Recommendations At the moment, ther...

PT-2026-70960

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/vmwgfx component where the vmw surface metadata::array size field, which is provided by userspace, is not properly validated against specific limits based on t...

DEBIAN-CVE-2026-73248

calibre is an e-book manager. Prior to 9.12.0, calibre processes attacker-controlled compositetemplate metadata from a malicious EPUB, OPF, PDF, or similar file through program: and a nested template call whose formatter does not inherit allowpythontemplates=False, allowing a nested python:...

CVE-2026-73247

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0, Kestra's core/src/main/java/io/kestra/core/runners/pebble/functions/HttpFunction.java passes the user-controlled http uri argument to URI.create and the server-side HTTP client without restricting private, loopback, or...