PT-2026-65538

OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers. From 0.5.5 to 1.1.5, OAuth::Consumertoken request parses the raw Location header of a 300 to 399 redirect returned by the OAuth server and follows the redirect recursively, which can mutate the consumer's...

EUVD-2026-49858

schreibfaul1 ESP32-audioI2S 3.4.5 has a buffer overflow vulnerability in the MP3Decoder::UnpackSFMPEG1 function due to missing input validation on attacker-controlled MP3 metadata...

CVE-2026-51252

The connected records identify a concrete issue: ESP32-audioI2S 3.4.5 contains a buffer overflow in MP3Decoder::UnpackSFMPEG1 caused by missing input validation on attacker-controlled MP3 metadata. This is a vulnerability in the MP3 decoding path; exploitation details are not provided in the docu...

CVE-2026-59933: Uncontrolled Resource Consumption

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the OLE reader follows sector chains from attacker-controlled XLS/OLE...

CVE-2026-59931: Server-Side Request Forgery (SSRF)

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the WEBSERVICE domain whitelist can be bypassed via an HTTP redirect SSRF...

CVE-2026-49447: Improper Authentication

Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. In 0.22.18, GET /cosmos/api/constellation/public-devices discloses Constellation device metadata to a requester that supplies any non-empty Authorization heade...

MGASA-2026-0302 Updated libyang packages fix a security vulnerability

The updated packages fix a security vulnerability: Heap Use-After-Free Write in XML Metadata Parsing. CVE-2026-41401...

Updated libyang packages fix a security vulnerability

The updated packages fix a security vulnerability: Heap Use-After-Free Write in XML Metadata Parsing. CVE-2026-41401...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a Server-Side Request Forgery (SSRF) in LangChain [CVE-2026-41481]

Summary IBM Watson Speech Services Cartridge is vulnerable to a Server-Side Request Forgery SSRF in LangChain, due to a failure to revalidate to redirect targets, allowing a URL pointing to an attacker-controlled server to potentially redirect to internal, localhost, or cloud metadata endpoints,...

CVE-2026-65922

An authorization weakness in JFrog Artifactory internal metadata handling could allow a user with limited repository access to write to restricted internal metadata areas under specific conditions. Successful abuse is limited to integrity and availability impact at a low level; confidentiality is...

preflight v0.20.0

Preflight.sh Preflight.sh is a command-line tool that scans your codebase for launch readiness. Identifies missing configuration, integration issues, security concerns, SEO metadata gaps, and other common mistakes before you deploy to production. Don't embarrass yourself in production. Just run t...

CVE-2026-65922 Potential unauthorized modification of Artifactory internal metadata

An authorization weakness in JFrog Artifactory internal metadata handling could allow a user with limited repository access to write to restricted internal metadata areas under specific conditions. Successful abuse is limited to integrity and availability impact at a low level; confidentiality is...

CVE-2026-65922

An authorization weakness in JFrog Artifactory internal metadata handling could allow a user with limited repository access to write to restricted internal metadata areas under specific conditions. Successful abuse is limited to integrity and availability impact at a low level; confidentiality is...

CVE-2026-65922 Potential unauthorized modification of Artifactory internal metadata

An authorization weakness in JFrog Artifactory internal metadata handling could allow a user with limited repository access to write to restricted internal metadata areas under specific conditions. Successful abuse is limited to integrity and availability impact at a low level; confidentiality is...

CVE-2026-65922

Technical details for CVE-2026-65922 are not publicly provided in the supplied documents; monitor for updates.

EUVD-2026-49583

An authorization weakness in JFrog Artifactory internal metadata handling could allow a user with limited repository access to write to restricted internal metadata areas under specific conditions. Successful abuse is limited to integrity and availability impact at a low level; confidentiality is...

GO-2026-6062 Gitea: Private Repository Metadata Remains Accessible After Access Revocation in gitea.dev

Gitea: Private Repository Metadata Remains Accessible After Access Revocation in gitea.dev...

GO-2026-6079 Gitea: OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation) in gitea.dev

Gitea: OAuth token introspection returns metadata of tokens issued to other clients RFC 7662 section 4 violation in gitea.dev...

Security Bulletin: Multiple vulnerabilities in IBM MQ Agent images

Summary Multiple vulnerabilities were addressed in IBM MQ Agent images Vulnerability Details CVEID:CVE-2025-13151 DESCRIPTION: Stack-based buffer overflow in libtasn1 version: v4.20.0. The function fails to validate the size of input data resulting in a buffer overflow in asn1expendoctetstring...

CVE-2026-64490

A flaw was found in the Linux kernel's ALSA virtio sound driver. A malicious or buggy virtio device can provide invalid control metadata, such as an unknown control type or an oversized value count. The driver's control handling trusts this unvalidated metadata, leading to out-of-bounds access wh...