Astra Linux – Vulnerability in CGal

There are multiple code execution vulnerabilities in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted, malformed file can lead to an out-of-bounds read and type confusion, which may result in code execution. An attacker can provide malicious input to trigger a...

Astra Linux – Vulnerability in CGal

There are multiple code execution vulnerabilities in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could result in code execution. An attacker can provide malicious input to trigger...

Astra Linux – Vulnerability in imagemagick

A NULL pointer dereference flaw was discovered in ImageMagick in versions prior to 7.0.10-31, in the ReadSVGImage function in coders/svg.c. This issue arises from not checking the return value from libxml2’s xmlCreatePushParserCtxt function and directly using that value, resulting in a crash and...

Astra Linux – Vulnerability in Wireshark

In Wireshark versions 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13, the VMS TCPIP trace file parser crashes. This issue allows for denial of service through malicious capture files...

Astra Linux – Vulnerability in Wireshark

The NetScreen file parser crashes in Wireshark versions 4.0.0 to 4.0.10 and 3.6.0 to 3.6.18. This issue allows for denial of service through malicious capture files...

Security Bulletin: IBM MQ .NET client is vulnerable to XML external entity injection (CVE-2026-12667)

Summary IBM MQ has addressed an XML external entity XXE vulnerability in the IBM MQ .NET client's RFH2 message parser Vulnerability Details CVEID:CVE-2026-12667 DESCRIPTION: IBM MQ could allow an authenticated attacker to read files from a vulnerable .NET client or cause limited denial of service...

Security Bulletin: IBM MQ Managed File Transfer is vulnerable to XML external entity injection (CVE-2026-13287)

Summary IBM MQ has addressed an XML external entity XXE vulnerability in the Managed File Transfer monitor result parser Vulnerability Details CVEID:CVE-2026-13287 DESCRIPTION: IBM MQ is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could...

Security Bulletin: IBM MQ Managed File Transfer is vulnerable to XML external entity injection (CVE-2026-13285)

Summary IBM MQ has addressed an XML external entity XXE vulnerability in the Managed File Transfer template parser Vulnerability Details CVEID:CVE-2026-13285 DESCRIPTION: IBM MQ is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit...

Exploit for CVE-2026-85706

CVE-2026-85706 — GitLab Unauthenticated Arbitrary File Read...

CLSA-2026-1789376231 TuxCare security update for fast-xml-parser (1 CVE)

TuxCare rebuilt fast-xml-parser to address 1 CVE. Fixed in 4.5.1-tuxcare.2...

CVE-2026-90783

A flaw was found in MKVToolNix. An attacker can exploit this vulnerability by crafting a malicious AVI Audio Video Interleave file. When the mkvmerge tool processes this file, an integer wraparound in the bundled avilib library's ODML OpenDML superindex parser leads to an undersized memory...

Important: python-mistune

Issue Overview: Mistune is a Python Markdown parser with renderers and plugins. Versions 3.3.0 through 3.3.2 are vulnerable to DoS through deeply nested tokens. HTML rendering creates deeply nested emphasis tokens from consecutive asterisk characters, and recursive rendering in...

CVE-2026-86349: Inefficient Algorithmic Complexity

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.8, 10.11.x = 10.11.22 fail to limit the nesting depth in the server-side Markdown parser which allows an authenticated attacker to cause a denial of service CPU resource exhaustion via a crafted post containing deeply nested...

CVE-2026-90714: Improper Restriction of Operations within the Bounds of a Memory Buffer

A weakness has been identified in marcobambini Gravity up to 0.9.7. The impacted element is an unknown function of the file src/utils/gravityjson.c of the component JSON parser. This manipulation causes memory corruption. The attack is possible to be carried out remotely. The exploit has been mad...

PT-2026-91177

Name of the Vulnerable Software and Affected Versions marcobambini Gravity versions prior to 0.9.8 Description A weakness in the JSON parser component, specifically within an unknown function in the src/utils/gravity json.c file, allows for remote memory corruption. Memory corruption occurs when ...

Amazon Linux 2 : mod_auth_openidc (ALAS-2026-3920)

The version of modauthopenidc installed on the remote host is prior to 1.8.8-7. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3920 advisory. modauthopenidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements...

Amazon Linux 2023 : mod_auth_openidc (ALAS2023-2026-2155)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2155 advisory. modauthopenidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an...

CVE-2026-90816: Improper Resource Shutdown or Release

A vulnerability was found in FFmpeg 8.0.x. This affects the function parseplaylist of the file libavformat/hlsproto.c of the component Duration Parser. Performing a manipulation of the argument duration/targetduration results in denial of service. The attack is possible to be carried out remotely...

PT-2026-91200

A vulnerability was detected in marcobambini Gravity up to 0.9.7. This impacts the function parse number expression of the file src/compiler/gravity parser.c of the component Number Parser. Performing a manipulation results in out-of-bounds read. It is possible to initiate the attack remotely. Th...

CVE-2026-54334: Out-of-bounds Write

UEFI Firmware Parser parses BIOS, Intel ME, and UEFI firmware structures including volumes, file systems, and files. Prior to 1.14, ReadCLen in uefifirmware/compression/Tiano/Decompress.c reads Number from GetBitsSd, CBIT with CBIT = 9 and can obtain 511 entries for the 510-element Sd-mCLen heap...