Astra Linux – Vulnerability in exiv2

Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An infinite loop was discovered in Exiv2 versions v0.27.4 and earlier. This infinite loop occurs when Exiv2 is used to modify the metadata of a specially crafted image file. ...

CVE-2026-71310

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, the shared HTTP CONNECT helper in lib/proxy/http.go parses proxy CONNECT responses with http.ReadResponse over an unrestricted buffered reader, allowing a malicious or...

CVE-2026-13477

IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 could allow an authenticated privileged user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input...

Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses tar which is vulnerable to CVE-2026-53655

Summary IBM Maximo Application Suite - Visual Inspection component uses tar which is vulnerable to CVE-2026-53655, This bulletin contains information regarding the vulnerability and its remediation. Vulnerability Details CVEID:CVE-2026-53655 DESCRIPTION: node-tar is a full-featured Tar for Node.j...

CVE-2026-65511

Unauthenticated Cross Site Scripting XSS in Manual - Documentation, Knowledge Base & Education WordPress Theme = 7.5.4 versions...

CVE-2026-65500

Unauthenticated Broken Access Control in Manual - Documentation, Knowledge Base & Education WordPress Theme = 7.5.4 versions...

CVE-2026-65496

Author Server Side Request Forgery SSRF in Complianz = 7.5.0 versions...

CVE-2026-65522

Contributor Cross Site Scripting XSS in Manual - Documentation, Knowledge Base & Education WordPress Theme = 7.5.4 versions...

CVE-2026-65522 WordPress Manual - Documentation, Knowledge Base & Education WordPress theme theme <= 7.5.4 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Manual - Documentation, Knowledge Base & Education WordPress Theme = 7.5.4 versions...

CVE-2026-65511

CVE-2026-65511 affects the WordPress Manual - Documentation, Knowledge Base & Education WordPress Theme (versions

EUVD-2026-48117

Unauthenticated Cross Site Scripting XSS in Manual - Documentation, Knowledge Base & Education WordPress Theme = 7.5.4 versions...

WordPress Manual - Documentation, Knowledge Base & Education WordPress theme theme <= 7.5.4 - Broken Access Control vulnerability

WordPress Manual - Documentation, Knowledge Base & Education WordPress theme theme = 7.5.4 - Broken Access Control vulnerability discovered by ed32.dll in WordPress Theme Manual - Documentation, Knowledge Base & Education WordPress Theme versions = 7.5.4...

CVE-2026-60575

...

NPM: node-tar: Process crash via PAX numeric path type confusion

NPM: node-tar: Process crash via PAX numeric path type confusion vulnerability discovered by ? in WordPress Npm tar versions = 7.5.17...

NPM: node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records

NPM: node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records vulnerability discovered by ? in WordPress Npm tar versions = 7.5.16...

Arbitrary Code Injection

Overview uproot is a ROOT I/O in pure Python and NumPy. Affected versions of this package are vulnerable to Arbitrary Code Injection via the TStreamerInfo metadata processing. An attacker can execute arbitrary Python code by supplying a crafted ROOT file containing malicious streamer metadata...

K000162267: Openfire vulnerability CVE-2023-32315

Security Advisory Description Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was found to be vulnerable to a path traversal attack via the setup environment. This permitted an unauthenticated user to use the...

pypdf vulnerable to inefficient decoding of ASCIIHexDecode streams

ImpactAn attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /ASCIIHexDecode filter. PatchesThis has been fixed in pypdf==6.7.5. WorkaroundsIf you cannot upgrade yet, consider applying the changes from PR 3666...

CVE-2026-59871

node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindowsPathentry.path.split'/' to throw an uncaught TypeError. This issue is...

CVE-2026-59875

node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach fs.lstat or fs.open and terminate the process with an uncaught exception. This issue is...