PT-2026-44399

Name of the Vulnerable Software and Affected Versions pypdf versions prior to 6.12.1 Description An attacker can craft a PDF file that causes excessive memory consumption during the parsing of large XMP metadata, which may contain numerous unnecessary elements. Recommendations Update to version...

Trend Micro Apex One Privilege Escalation

The vulnerability of the Trend Micro Apex One antivirus software agent is related to a data source verification error. Exploiting this vulnerability can allow attackers to increase their privileges...

Trend Micro Apex One Privilege Escalation

The vulnerability of the Trend Micro Apex One antivirus software agent is related to synchronization errors when using a shared resource “Race Situation”. Exploiting this vulnerability can allow an attacker to increase their privileges...

Trend Micro Apex One Privilege Escalation

The vulnerability of the Trend Micro Apex One antivirus software agent is related to a data source verification error. Exploiting this vulnerability can allow attackers to increase their privileges...

Trend Micro Apex One Privilege Escalation

The vulnerability of the Trend Micro Apex One antivirus software agent is related to a data source verification error. Exploiting this vulnerability can allow attackers to increase their privileges...

Trend Micro Apex One Privilege Escalation

The vulnerability of the Trend Micro Apex One antivirus software agent is related to a data source verification error. Exploiting this vulnerability can allow attackers to increase their privileges...

Trend Micro Apex One Privilege Escalation

The vulnerability of the Trend Micro Apex One antivirus software agent is related to a data source verification error. Exploiting this vulnerability can allow attackers to increase their privileges...

Trend Micro Apex One Privilege Escalation

The vulnerability of the Trend Micro Apex One antivirus software agent is related to a data source verification error. Exploiting this vulnerability can allow attackers to increase their privileges...

Fedora 44 : nginx / nginx-mod-brotli / nginx-mod-fancyindex / etc (2026-da68d7bf53)

The remote Fedora 44 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-da68d7bf53 advisory. nginx-mod-headers-more: - Rebuild for 1.30.2 nginx-mod-vts: - Rebuild for 1.30.2 nginx-mod-fancyindex: - Rebuild for 1.30.2 nginx-mod-brotli: - Rebuild for...

PT-2026-44389

Name of the Vulnerable Software and Affected Versions TinyMCE versions 6.8.0 through 7.0.x Description An XSS Cross-Site Scripting issue exists due to improper SVG namespace scope handling within the sanitizer. An attacker can use a crafted payload with nested elements to bypass attribute...

DEBIAN-CVE-2026-44660

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.12.1, when ujson.dump writes to a file-like object and the write operation raises an exception, the serialized JSON string object is not decremented, leaking memory. Each failed write operatio...

CVE-2026-44660

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.12.1, when ujson.dump writes to a file-like object and the write operation raises an exception, the serialized JSON string object is not decremented, leaking memory. Each failed write operatio...

CVE-2026-44660 UltraJSON: Memory Leak in ujson.dump() on Write Failure

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.12.1, when ujson.dump writes to a file-like object and the write operation raises an exception, the serialized JSON string object is not decremented, leaking memory. Each failed write operatio...

CVE-2026-44660

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.12.1, when ujson.dump writes to a file-like object and the write operation raises an exception, the serialized JSON string object is not decremented, leaking memory. Each failed write operatio...

CVE-2026-44660 UltraJSON: Memory Leak in ujson.dump() on Write Failure

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.12.1, when ujson.dump writes to a file-like object and the write operation raises an exception, the serialized JSON string object is not decremented, leaking memory. Each failed write operatio...

CVE-2026-44833

Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an open redirect vulnerability in Snipe-IT allows attackers to redirect users to malicious sites via unvalidated HTTP Referer header stored in session variable. This vulnerability is fixed in 8.4.1...

CVE-2026-44831

Snipe-IT is an IT asset/license management system. Prior to 8.4.1, users with component view access could be impacted by an unescaped notes column, resulting in cross-site scripting XSS. This vulnerability is fixed in 8.4.1...

CVE-2026-47272

pam_usb for Linux allows local authentication bypass before version 0.9.0 due to pusb_pad_compare() only checking the user-side pad (~/.pamusb/device.pad) and not requiring the system-side pad on the USB device to be present. A local user can delete or obscure their own device.pad to bypass the U...

CVE-2026-48064 pam_usb: PAM_RHOST check skipped when deny_remote=false allows XDMCP authentication bypass

pamusb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.1, when a PAM service is configured with denyremote=false in pamusb commonly done for display managers such as gdm-password or lightdm to bypass process/TTY heuristics for local sessions, the PAMRHOST...

CVE-2026-44724

systeminformation is a System and OS information library for node.js. From 4.17.0 to 5.31.5, on Linux, systeminformation is vulnerable to command injection in networkInterfaces when an active NetworkManager connection profile name contains shell metacharacters. The vulnerable value is obtained...