CVE-2026-101265

A vulnerability exists in Intelbras TIP 125i versions 4.3.35 and 4.3.41 involving an unknown function within the Básico Page component. This flaw allows for the inclusion of sensitive information in the source code via a remote attack. The attack is characterized by high complexity and difficult ...

ANT-2026-RNHRV8B9 · LibreOffice/core · Stack Buffer Overflow / Off-by-N

stack-buffer-overflow medium CVE-2026-63275 Severity Claude high · Security research firm high · Maintainer medium Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ada Logics. ANT-2026-RNHRV8B9: CFF hint-stack bound...

ANT-2026-QT406EDT · LibreOffice/core · Memory corruption (heap buffer overflow)

other medium CVE-2026-63274 Severity Claude high · Security research firm high · Maintainer medium Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ada Logics. ANT-2026-QT406EDT: Heap overflow from unclamped /Length...

ANT-2026-YA6ADR86 · LibreOffice/core · Memory Safety / Stack Buffer Overflow

stack-buffer-overflow medium CVE-2026-63276 Severity Claude high · Security research firm high · Maintainer medium Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ada Logics. ANT-2026-YA6ADR86: CFF charstring to...

UBUNTU-CVE-2026-54160

Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. Prior to commits 658b24e and 1aa31d1, the GitHub Actions script used to prepare NUT tarballs and update GitHub Checks statuses and PR comments about it was...

GO-2026-6545 Grafana: Path traversal in the Tempo and Loki data source plugins in github.com/grafana/grafana

Grafana: Path traversal in the Tempo and Loki data source plugins in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabili...

GO-2026-6543 Canonical ADSys Uses a Less Trusted Source in github.com/ubuntu/adsys

Canonical ADSys Uses a Less Trusted Source in github.com/ubuntu/adsys. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please sugges...

GO-2026-6523 Convoy: Cross-Tenant Source IDOR Leaks Plaintext Message Broker Credentials in github.com/frain-dev/convoy

Convoy: Cross-Tenant Source IDOR Leaks Plaintext Message Broker Credentials in github.com/frain-dev/convoy...

Security update for amazon-ssm-agent

This update for amazon-ssm-agent fixes the following issue: CVE-2026-56854: golang.org/x/crypto/ssh: source-address restriction bypassed in 5 callback families bsc1278681 CVE-2026-56855: golang.org/x/crypto/ssh: prevent DoS on deadlocked established channel bsc1278681 CVE-2026-78662:...

SUSE-SU-2026:4372-1 Security update for amazon-ssm-agent

This update for amazon-ssm-agent fixes the following issue: - CVE-2026-56854: golang.org/x/crypto/ssh: source-address restriction bypassed in 5 callback families bsc1278681 - CVE-2026-56855: golang.org/x/crypto/ssh: prevent DoS on deadlocked established channel bsc1278681 - CVE-2026-78662:...

CVE-2026-82331

A flaw was found in the tar source plugin of Apache BuildStream. This improper link resolution vulnerability, also known as 'link following', allows a remote attacker to write arbitrary files on the host system. By crafting malicious source tarballs containing symlinks, an attacker can exploit th...

PT-2026-102403

Name of the Vulnerable Software and Affected Versions OpenDKIM versions prior to 2.11.1 Description A security flaw exists in the Tag Tokenizer component within the dkim process set function of the dkim.c file. A remote attacker can perform a manipulation that results in the use of a less trusted...

Important: rclone

Issue Overview: The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback,...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the GET /api/station/id/vue/profile endpoint. An attacker can obtain sensitive credentials, including admin, source, and relay passwords, by making authenticated requests with only View Station Page permission...

PT-2026-99489

Name of the Vulnerable Software and Affected Versions coollabsio Coolify versions prior to 4.1.1 Description A remote issue exists in the GitHub App Setup Handler component within the Github::redirect function of the /webhooks/source/github/redirect file. Manipulation of the state argument allows...

magento-instant-purchase-custom-price

abraxaslabs.tech · github.com/abraxas ·&...

Use of Less Trusted Source

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Use of Less Trusted Source via incomplete propagation of revision and coderevision pins across artifact boundaries in the model loader subsystem. Wh...

CVE-2026-100688

Budibase server before 3.45.0 contains a cross-tenant information disclosure vulnerability in the GET /api/applications/:appId/appPackage endpoint that allows authenticated users to read another tenant's application metadata and source code. Attackers can supply a victim tenant's app id to retrie...

CVE-2026-100688 Budibase server before 3.45.0 Cross-Tenant Information Disclosure

Budibase server before 3.45.0 contains a cross-tenant information disclosure vulnerability in the GET /api/applications/:appId/appPackage endpoint that allows authenticated users to read another tenant's application metadata and source code. Attackers can supply a victim tenant's app id to retrie...

CVE-2026-100688

Budibase server versions prior to 3.45.0 are vulnerable to a cross-tenant information disclosure vulnerability within the GET /api/applications/:appId/appPackage endpoint. The root cause is a lack of authorization checks , allowing authenticated users to access metadata and source code belonging ...