CVE-2026-13748: Improper Limitation of a Pathname to a Restricted Directory

Improper restriction of file path resolution in Snowflake CLI versions prior to 3.19 allowed arbitrary local file content to be read and transmitted to Snowflake services. An attacker could exploit this by supplying crafted repository or project content that referenced files outside the intended...

Important: git-lfs security update

Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fixes: golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycod...

RHEL 9 : git-lfs (RHSA-2026:30854)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:30854 advisory. Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing t...

Linux Distros Unpatched Vulnerability : CVE-2026-13023

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uninitialized Use in GPU in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the renderer process to obtain potentially...

Linux Distros Unpatched Vulnerability : CVE-2026-53169

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: reject NPUOPRESIZE commands from userspace NPUOPRESIZE is a U85-only command...

drm/msm/dpu: fix mismatch between power and frequency

...

Nokogiri: Possible Use-After-Free in XInclude Processing

...

ipv6: mcast: Fix use-after-free when processing MLD queries

...

Chromium: CVE-2026-13023 Uninitialized Use in GPU

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Linux Kernel Memory Error Reference Vulnerability (CNVD-2026-25961)

The Linux kernel is an open-source operating system kernel that provides core functions such as process management, memory management, network protocol stack, and hardware drivers. The Linux kernel has a memory error reference vulnerability. This vulnerability arises from processing MLD queries,...

EulerOS 2.0 SP15 : binutils (EulerOS-SA-2026-2435)

According to the versions of the binutils packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in the GNU Binutils BFD library, a widely used component for handling binary files such as object files and executables. The...

EulerOS 2.0 SP15 : libarchive (EulerOS-SA-2026-2445)

According to the versions of the libarchive packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression logic, caused by improper validation of...

ImageMagick has a Heap Buffer Over-Write in SF3 encoder when writing multi-frame image

An crafted multi-frame can result in a heap buffer over-write when encoding it with the SF3 encoder...

@activeboxes/piece-gmail (0.8.1), @activeboxes/piece-imap (0.2.10) +95 more potentially affected by CVE-2026-48801 via linkify-it (5.0.0)

linkify-it NPM version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on linkify-it and may be impacted: - @activeboxes/piece-gmail 0.8.1 - @activeboxes/piece-imap 0.2.10 - @activepieces/piece-gmail =0.6.0, =0.2.6, =0.0.1, =1.0.0, =1.0.6 -...

CVE-2026-54352

Budibase is an open-source low-code platform. Prior to 3.39.9, POST /api/pwa/process-zip at packages/server/src/api/routes/static.ts:24 accepts a builder-uploaded .zip, extracts it with [email protected] into a temp directory, then for each entry listed in icons.json validates the icon path, open...

JLSEC-2026-636

Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavfilter/afstereowiden.c:120:69...

JLSEC-2026-635

Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavutil/imgutils.c:353:9 in imagecopyplane...

CVE-2026-53289

In the Linux kernel, the following vulnerability has been resolved: ice: fix NULL pointer dereference in iceresetallvfs iceresetallvfs ignores the return value of icevfrebuildvsi. When the VSI rebuild fails e.g. during NVM firmware update via nvmupdate64e, icevsirebuild tears down the VSI on its...

CVE-2026-47207 Envoy crashes if multiple unexpected ext_proc responses are packed into one gRPC message

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, Envoy crashes if an extproc server sends a single gRPC message containing multiple, specially crafted ProcessingResponse messages. This can occur when the...

CVE-2026-47207

CVE-2026-47207 : Envoy crashes when an ext_proc server sends a single gRPC message containing multiple ProcessingResponse messages, leading to a use-after-free during processing of subsequent responses. Affected: Envoy versions 1.34.0 through 1.35.12 (as 1.35.13 fixes the issue) and 1.36.0–1.36.8...