CVE-2026-64242

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: net2280: Fix double free in probe error path usbinitializegadget installs gadgetrelease as the release callback for the embedded gadget device. The struct net2280 instance is therefore released through gadgetrelease...

PT-2026-64998

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.6 Description Authenticated attackers can delete arbitrary files due to insufficient sanitization of path traversal sequences in the existing image field during category updates. This issue occurs within the...

UBUNTU-CVE-2026-64226

In the Linux kernel, the following vulnerability has been resolved: schedext: Avoid UAF in scxrootenableworkfn init failure path In scxrootenableworkfn, puttaskstructp is called before scxerror dereferences p-comm and p-pid. If the iterator's reference is the last drop, the task is freed...

UBUNTU-CVE-2026-64523

In the Linux kernel, the following vulnerability has been resolved: net/handshake: Take a long-lived file reference at submit handshakenlacceptdoit needs the file pointer backing req-hrsk-sksocket to survive the window between handshakereqnext and the subsequent FDPREPARE and getfile. The...

SUSE CVE-2026-42955

In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the 'ghost domain names' family of attacks was found in Unbound that could extend the ghost domain window by up to one cached TTL configured value for A/AAAA glue records. Similar to other...

nodejs: Node.js: Permission Model bypass via `process.report.writeReport()` path misvalidation

A flaw was found in Node.js. This vulnerability allows a bypass of the Permission Model enforcement due to path misvalidation within the process.report.writeReport function. An attacker could exploit this to bypass intended security boundaries, potentially leading to unauthorized access to...

Arbitrary Code Injection

Overview datamodel-code-generator is a Datamodel Code Generator Affected versions of this package are vulnerable to Arbitrary Code Injection via the customBasePath schema field. An attacker can execute arbitrary Python code by supplying a specially crafted value containing embedded newlines and a...

gitpython: GitPython: Remote Code Execution via Newline Injection in config_writer()

A flaw was found in GitPython. This vulnerability allows attackers to inject newline characters into the section parameter of the configwriter function, leading to the injection of arbitrary section headers into the .git/config file. By forging a core section with a malicious hooksPath, an attack...

CVE-2026-63720

datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value ...

EUVD-2026-49050

datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value ...

CVE-2026-63720 datamodel-code-generator Code Injection via Unvalidated customBasePath Schema Field

datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value ...

CVE-2026-63720 datamodel-code-generator Code Injection via Unvalidated customBasePath Schema Field

datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value ...

CVE-2026-63720 datamodel-code-generator Code Injection via Unvalidated customBasePath Schema Field

datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value ...

Path Traversal

dompdf/dompdf is vulnerable to Path Traversal. The vulnerability is due to an improper prefix validation in the validateLocalUri method, where normalized paths are checked using strpos without enforcing directory boundaries, which allows an attacker who can control rendered HTML to escape the...

Path Traversal

dompdf/dompdf is vulnerable to Path Traversal. The vulnerability is due to improper validation of file paths when processing SVG images embedded through data: URIs, where the second SVG processing pass performed by php-svg-lib does not enforce the same security restrictions, allowing an...

PT-2026-64795

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions prior to 0.70.0 Description A code injection flaw exists where attackers controlling input schemas can achieve remote code execution. By providing a malicious customBasePath value containing embedded newlines...

gitpython: GitPython: Remote Code Execution via Newline Injection in config_writer()

A flaw was found in GitPython. This vulnerability allows attackers to inject newline characters into the section parameter of the configwriter function, leading to the injection of arbitrary section headers into the .git/config file. By forging a core section with a malicious hooksPath, an attack...

nodejs: Node.js: Permission Model bypass via `process.report.writeReport()` path misvalidation

A flaw was found in Node.js. This vulnerability allows a bypass of the Permission Model enforcement due to path misvalidation within the process.report.writeReport function. An attacker could exploit this to bypass intended security boundaries, potentially leading to unauthorized access to...

SUSE CVE-2026-64262

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: end fusereq on io-uring cancel task work When iouring delivers task work with tw.cancel set PFEXITING, PFKTHREAD fallback, or percpurefisdying on the ring context, fuseuringsendintask takes the cancel branch, assigns...

SUSE CVE-2026-64281

In the Linux kernel, the following vulnerability has been resolved: svcrdma: wake sq waiters when the transport closes Threads parked in svcrdmasqwait on scsqticketwait or scsendwait can hang indefinitely in TASKUNINTERRUPTIBLE state across transport teardown, pinning svcxprt references and...