CVE-2026-17510

Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in printattribute via a zero length BMPSTRING attribute. printattribute sizes the destination buffer for a BMPSTRING attribute from its declared byte length with Renewattribute, length, char. A zero length...

CVE-2026-17510 Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in print_attribute via a zero length BMPSTRING attribute

Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in printattribute via a zero length BMPSTRING attribute. printattribute sizes the destination buffer for a BMPSTRING attribute from its declared byte length with Renewattribute, length, char. A zero length...

CVE-2026-17510

Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in printattribute via a zero length BMPSTRING attribute. printattribute sizes the destination buffer for a BMPSTRING attribute from its declared byte length with Renewattribute, length, char. A zero length...

CVE-2026-19350: Missing Authorization

A vulnerability has been found in Dolibarr ERP up to 23.0.3. Affected is the function fail of the file htdocs/takepos/invoice.php of the component TakePOS Module. Such manipulation leads to missing authorization. The attack may be performed from remote. The name of the patch is...

PT-2026-76564

Name of the Vulnerable Software and Affected Versions WeeChat versions 4.3.0 through 4.9.0 Description The relay module contains a flaw in the WebSocket permessage-deflate decompression function relay websocket inflate which lacks an upper bound on output size. An authenticated relay user can...

python: Fix of CVE-2026-11972

CVE-2026-11972: fix an unbounded loop CPU DoS in the tarfile module when a member header in a streaming-mode archive mode="r|" declares a huge size, by breaking out of the Stream.seek read loop at EOF...

CVE-2026-19282

The CVE describes a local command-injection risk in the andreahaku llm_memory_mcp project, affecting the auto.capture function in src/autolearn/GitHooksManager.ts. The root cause is a manipulation of the argument hash, enabling injection, with exploitation restricted to local access. No product v...

[SECURITY] Fedora 43 Update: perl-Devel-Cover-1.51-4.fc43

This module provides code coverage metrics for Perl. Code coverage metrics describe how thoroughly tests exercise code. By using Devel::Cover you can discover areas of code not exercised by your tests and determine which tests to create to increase coverage. Code coverage can be considered as an...

CVE-2026-17435 File::Rotate::Simple versions before 0.4.0 for Perl create the target of dangling symlinks when rotating files

File::Rotate::Simple versions before 0.4.0 for Perl create the target of dangling symlinks when rotating files. When the file to be rotated is a symbolic link to a missing file, and the touch option is enabled, then the rotate method assumes that the file is absent since the existence check is...

kernel: selinux: fix overlayfs mmap() and mprotect() access checks

A flaw was found in the Linux kernel's SELinux security module when handling overlayfs. The existing security model for overlayfs does not properly enforce access controls for mmap and mprotect operations. This oversight could allow a local attacker to bypass intended security policies, potential...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal in the construction of HTTP request URLs due to unescaped variable path components. An attacker can manipulate the URL to access unintended API endpoints or resources by supplying specially crafted repository or...

MAL-2026-13616 Malicious code in hardhat-cap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3d9de53c9b5916edf45f9055ecdb2fbdd0752cfe7779f37c7d294a16788faf8 The package is published as hardhat-cap but its README, LICENSE, index.d.ts, and lib/proto.js / lib/tools.js are a verbatim copy of the pino logger,...

Security Bulletin:Improper Chain of Trust in Erlang OTP's pubkey_cert Module Allows Certificate Forgery

Summary Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP publickey pubkeycert module allows a non-CA certificate to be accepted as an intermediate issuer, enabling certificate chain forgery. In lib/publickey/src/pubkeycert.erl, pubkeycert:validateextensions/7...

Security Bulletin:Predictable Numbers/Identifiers Vulnerability in Erlang/OTP Kernel inet_res & inet_db Modules: DNS Cache Poisoning Risk

Summary Generation of Predictable Numbers or Identifiers vulnerability in Erlang/OTP kernel inetres, inetdb modules allows DNS Cache Poisoning. The built-in DNS resolver inetres uses a sequential, process-global 16-bit transaction ID for UDP queries and does not implement source port randomizatio...

kernel: xen/privcmd: fix double free via VMA splitting

A flaw was found in the Linux kernel's xen/privcmd module. A local user could exploit this by performing a partial unmapping of a privcmd memory region. This action causes a Virtual Memory Area VMA to split, leading to duplicated internal memory pointers. As a result, the same memory can be freed...

OESA-2026-3240 perl-YAML security update

The YAML.pm module implements a YAML Loader and Dumper based on the YAML 1.0 specification. http://www.yaml.org/spec/ YAML is a generic data serialization language that is optimized for human readability.It can be used to express the data structures of most modern programming languages. Including...

Node.js Module axios < 0.33.0 / 1.x < 1.18.0 Prototype Pollution

The version of the axios Node.js module installed on the remote host is prior to 0.33.0 or 1.x prior to 1.18.0. It is, therefore, affected by multiple vulnerabilities: - axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has...

SUSE SLES15: apache2-mod_php8 / php8 / php8-bcmath / php8-bz2 / php8-calendar / etc (SUSE-SU-2026:3513-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3513-1 advisory. - CVE-2026-7260: circular symbolic links in phar archives can lead to unbounded recursion and cause C stack exhaustion bsc1273077. ...

kernel security, bug fix, and enhancement update

6.12.0-211.44.1 - Add new Oracle Linux Driver Signing key 1 certificate Orabug: 37985782 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list...

SUSE SLES15: rsyslog / rsyslog-module-gssapi / rsyslog-module-gtls / etc (SUSE-SU-2026:3518-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3518-1 advisory. - CVE-2026-61548: crafted RFC 5424 messages to mmpstrucdata can lead to a stack overwrite bsc1272414. - input sequence during oversize-frame...