CVE-2026-58058 affecting package nmap for versions less than 7.95-4

CVE-2026-58058 affecting package nmap for versions less than 7.95-4. A patched version of the package is available...

CVE-2026-52955 affecting package kernel for versions less than 6.6.143.1-1

CVE-2026-52955 affecting package kernel for versions less than 6.6.143.1-1. A patched version of the package is available...

CVE-2026-56116 affecting package dhcpcd for versions less than 10.0.8-2

CVE-2026-56116 affecting package dhcpcd for versions less than 10.0.8-2. A patched version of the package is available...

CVE-2026-14258 affecting package dhcpcd for versions less than 10.0.8-4

CVE-2026-14258 affecting package dhcpcd for versions less than 10.0.8-4. A patched version of the package is available...

CVE-2026-52954 affecting package kernel for versions less than 6.6.143.1-1

CVE-2026-52954 affecting package kernel for versions less than 6.6.143.1-1. A patched version of the package is available...

CVE-2026-53131 affecting package kernel for versions less than 6.6.143.1-1

CVE-2026-53131 affecting package kernel for versions less than 6.6.143.1-1. A patched version of the package is available...

CVE-2026-56113 affecting package dhcpcd for versions less than 10.0.8-4

CVE-2026-56113 affecting package dhcpcd for versions less than 10.0.8-4. A patched version of the package is available...

CVE-2026-43973 affecting package rabbitmq-server for versions less than 3.13.7-6

CVE-2026-43973 affecting package rabbitmq-server for versions less than 3.13.7-6. A patched version of the package is available...

CVE-2026-52957 affecting package kernel for versions less than 6.6.143.1-1

CVE-2026-52957 affecting package kernel for versions less than 6.6.143.1-1. A patched version of the package is available...

CVE-2026-42250 affecting package kata-containers-cc for versions less than 3.15.0.aks0-15

CVE-2026-42250 affecting package kata-containers-cc for versions less than 3.15.0.aks0-15. A patched version of the package is available...

CVE-2026-27171 affecting package kata-containers for versions less than 3.19.1.kata3-6

CVE-2026-27171 affecting package kata-containers for versions less than 3.19.1.kata3-6. A patched version of the package is available...

Security Bulletin: Multiple Vulnerabilities in IBM API Connect

Summary Multiple vulnerabilities were addressed in IBM API Connect version v10.0.8.10 Vulnerability Details CVEID:CVE-2026-33244 DESCRIPTION: React Router is a router for React. In versions 7.5.1 through 7.13.1, when using Framework Mode with pre-rendering enabled, improper neutralization of the...

PYSEC-2026-1227 Bugsink is vulnerable to unauthenticated remote DoS via crafted Brotli input (via CPU)

Impact In affected versions, a specially crafted Brotli-compressed envelope can cause Bugsink to spend excessive CPU time in decompression, leading to denial of service. This can be done if the DSN is known, which it is in many common setups JavaScript, Mobile Apps. Patches Patched in Bugsink 2.0...

PYSEC-2026-1833 pypdf possibly loops infinitely when reading DCT inline images without EOF marker

Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page which has an inline image using the DCTDecode filter. Patches This has been fixed in pypdf==6.1.3. Workarounds If you cannot upgrade yet, consider...

PYSEC-2026-1343 Fides Webserver API is Vulnerable to OAuth Client Privilege Escalation

Summary The OAuth client creation and update endpoints of the Fides Webserver API do not properly authorize scope assignment. This allows highly privileged users with client:create or client:update permissions to escalate their privileges to owner-level. Details When creating or updating OAuth...

PYSEC-2026-1341 Fides Webserver API Rate Limiting Vulnerability in Proxied Environments

Summary The Fides Webserver API's built-in IP-based rate limiting is ineffective in environments with CDNs, proxies or load balancers. The system incorrectly applies rate limits based on directly connected infrastructure IPs rather than client IPs, and stores counters in-memory rather than in a...

OctoPrint Vulnerable to Denial of Service through malformed HTTP request in OctoPrint

ImpactOctoPrint versions up until and including 1.11.1 contain a vulnerability that allows any unauthenticated attacker to send a manipulated broken multipart/form-data request to OctoPrint and through that make the web server component become unresponsive. This could be used to effectively run a...

PYSEC-2026-1334 Information Disclosure Vulnerability in Privacy Center of SERVER_SIDE_FIDES_API_URL

SERVERSIDEFIDESAPIURL is a server-side configuration environment variable used by the Fides Privacy Center to communicate with the Fides webserver backend. The value of this variable is a URL which typically includes a private IP address, private domain name, and/or port. This vulnerability allow...

PYSEC-2026-1764 pdoc embeds link to malicious CDN if math mode is enabled

Impact Documentation generated with pdoc --math linked to JavaScript files from polyfill.io. The polyfill.io CDN has been sold and now serves malicious code. Users who produce documentation with math mode should update immediately. All other users are unaffected. Patches This issue has been fixed...

PYSEC-2026-1314 document-merge-service vulnerable to Remote Code Execution via Server-Side Template Injection

Impact What kind of vulnerability is it? Who is impacted? A remote code execution RCE via server-side template injection SSTI allows for user supplied code to be executed in the server's context where it is executed as the document-merge-server user with the UID 901 thus giving an attacker...