CVE-2026-97735

ITFlow before 26.08 allows SVG attachments in the ticket email parser cron/ticketemailparser.php for email messages that may arrive over SMTP from arbitrary senders...

CVE-2026-97735

Versions of ITFlow before 26.08 are vulnerable to a flaw in the ticket email parser (cron/ticket_email_parser.php). The software allows SVG attachments in email messages arriving over SMTP from arbitrary senders. This vulnerability could allow an attacker to process malicious SVG files, potential...

CVE-2026-97735

ITFlow before 26.08 allows SVG attachments in the ticket email parser cron/ticketemailparser.php for email messages that may arrive over SMTP from arbitrary senders...

GitLab CE/EE - Remote Code Execution

GitLab CE/EE starting from 11.9 does not properly validate image files that were passed to a file parser, resulting in a remote command execution vulnerability. This template attempts to passively identify vulnerable versions of GitLab without the need for an exploit by matching unique hashes for...

OESA-2026-4060 nodejs-js-yaml security update

This is an implementation of YAML YAML Ain't Markup Language, a human friendly data serialization language. It started as PyYAML port, and was completely rewritten from scratch. Now it's very fast, and supports the 1.2 spec. Security Fixes: js-yaml is a JavaScript YAML parser and dumper. From 3.0...

PT-2026-98867

Name of the Vulnerable Software and Affected Versions Gnumeric affected versions not specified Description A heap use-after-free flaw exists where the XML parser can dereference a freed sheet-object component. This occurs when a user opens a specially crafted workbook containing a malformed...

PT-2026-98350

Name of the Vulnerable Software and Affected Versions ITFlow versions prior to 26.08 Description The ticket email parser, located at the endpoint 'cron/ticket email parser.php', allows SVG attachments in email messages received via SMTP from arbitrary senders. Recommendations Update to version...

Linux Distros Unpatched Vulnerability : CVE-2026-59990

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nesting without a depth limit, allowing a...

Linux Distros Unpatched Vulnerability : CVE-2026-61814

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks...

The vulnerability of the SCRAM (Salted Challenge Response Authentication Mechanism) mechanism in the PostgreSQL PgBouncer connection pool allows a attacker to induce a service failure.

The vulnerability of the SCRAM Salted Challenge Response Authentication Mechanism mechanism in the PostgreSQL PgBouncer connection pool lies in the dereferencing of pointers due to the lack of validation for a required attribute in the end-message parser. Exploiting this vulnerability allows a...

PT-2026-98805

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ethosu accelerator driver where the command stream parser incorrectly interprets bits 15:14 of NPU SET IFM,OFM PRECISION as an activation storage mode on U65...

Linux Distros Unpatched Vulnerability : CVE-2026-67415

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.9 and 4.3.3, the Shovel parameter parser converted attacker-controlled runtime parameter valu...

PT-2026-99014

rclone versions = v1.72.0 and = v1.74.4 fixed in v1.75.0 contain multiple denial-of-service vulnerabilities in the archive backend's SquashFS parser, which relies on the github.com/diskfs/go-diskfs dependency. The parser fails to validate attacker-controlled superblock and metadata values before...

CVE-2026-97222: Use After Free

A heap use-after-free flaw was found in Gnumeric. When a user opens a crafted Gnumeric workbook containing a malformed SheetObjectComponent element, the XML parser can dereference a freed sheet-object component, causing Gnumeric to crash...

CVE-2025-1218: Heap-based Buffer Overflow

The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and c...

CVE-2026-91765: Uncontrolled Recursion

cleanupxmlnode in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exis...

Linux Distros Unpatched Vulnerability : CVE-2026-93213

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - of: fix out-of-bounds read in ofaliasscan stem parser The stem parser tests isdigitend - 1 before checking end start and so reads one byte before the property...

Linux Distros Unpatched Vulnerability : CVE-2026-19888

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to...

Linux Distros Unpatched Vulnerability : CVE-2026-97222

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap use-after-free flaw was found in Gnumeric. When a user opens a crafted Gnumeric workbook containing a malformed SheetObjectComponent element, the XML...

Linux Distros Unpatched Vulnerability : CVE-2026-88358

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - simdjson 4.6.1 contains a one-byte out-of-bounds read vulnerability in dom::parser::parseunpadded. A specially crafted truncated JSON document whose final...