CVE-2026-74886

opensslencrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where the PluginImportGuard blocks a different set of modules than the AST analyzer's DANGEROUSMODULES set. Attackers can bypass AST analysis through string obfuscation or encoding to import unblocked dangerous...

CVE-2026-74886 openssl_encrypt before 1.4.0 Plugin Import Guard Bypass

opensslencrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where the PluginImportGuard blocks a different set of modules than the AST analyzer's DANGEROUSMODULES set. Attackers can bypass AST analysis through string obfuscation or encoding to import unblocked dangerous...

CVE-2026-74879 openssl_encrypt before 1.4.0 Information Disclosure via /ready endpoint

opensslencrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready endpoint that returns full database exception strings to unauthenticated callers. Attackers can trigger database errors to extract sensitive information including hostnames, IP addresses, connection...

CVE-2026-74886: Incomplete List of Disallowed Inputs

opensslencrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where the PluginImportGuard blocks a different set of modules than the AST analyzer's DANGEROUSMODULES set. Attackers can bypass AST analysis through string obfuscation or encoding to import unblocked dangerous...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-100119)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100119 advisory. In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Prefer NLANULSTRING These attributes are evaluated as c-string passed to strcmp, but...

PT-2026-76622

openssl encrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where the PluginImportGuard blocks a different set of modules than the AST analyzer's DANGEROUS MODULES set. Attackers can bypass AST analysis through string obfuscation or encoding to import unblocked dangerous...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-099525)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099525 advisory. Externally-controlled format string in PostgreSQL timeofday function allows an attacker to retrieve portions of server memory, via crafted timezone zones. Versions...

CVE-2026-74785

Scriban before 7.0.0 contains three distinct denial-of-service vulnerabilities in expression evaluation that bypass existing safety controls through unbounded string multiplication, uncontrolled BigInteger shift operations, and LoopLimit bypass via range enumeration in builtin functions. Attacker...

CVE-2026-74785

Scriban before 7.0.0 contains three distinct denial-of-service vulnerabilities in expression evaluation that bypass existing safety controls through unbounded string multiplication, uncontrolled BigInteger shift operations, and LoopLimit bypass via range enumeration in builtin functions. Attacker...

EUVD-2026-59951

Scriban before 7.0.0 contains three distinct denial-of-service vulnerabilities in expression evaluation that bypass existing safety controls through unbounded string multiplication, uncontrolled BigInteger shift operations, and LoopLimit bypass via range enumeration in builtin functions. Attacker...

CVE-2026-74785 Scriban before 7.0.0 Denial of Service via Unbounded Resource Consumption

Scriban before 7.0.0 contains three distinct denial-of-service vulnerabilities in expression evaluation that bypass existing safety controls through unbounded string multiplication, uncontrolled BigInteger shift operations, and LoopLimit bypass via range enumeration in builtin functions. Attacker...

CVE-2026-74785 Scriban before 7.0.0 Denial of Service via Unbounded Resource Consumption

Scriban before 7.0.0 contains three distinct denial-of-service vulnerabilities in expression evaluation that bypass existing safety controls through unbounded string multiplication, uncontrolled BigInteger shift operations, and LoopLimit bypass via range enumeration in builtin functions. Attacker...

CVE-2026-74785: Uncontrolled Resource Consumption

Scriban before 7.0.0 contains three distinct denial-of-service vulnerabilities in expression evaluation that bypass existing safety controls through unbounded string multiplication, uncontrolled BigInteger shift operations, and LoopLimit bypass via range enumeration in builtin functions. Attacker...

Security Bulletin: This Power System update is being released to address CVE-2026-15961

Summary IBM PowerVM could allow a local attacker to obtain sensitive information or cause a denial of service due to improper control of format strings. Vulnerability Details CVEID:CVE-2026-15961 DESCRIPTION: IBM PowerVM could allow a local attacker to obtain sensitive information or cause a deni...

AZL-96384 CVE-2026-74291 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ASoC: topology: Check PCM and DAI name strings before use Topology objects store several PCM and DAI names in fixed-size UAPI arrays. Other topology parser paths validate these fields with bounded strnlen checks before using them...

CVE-2026-72273

In the Linux kernel, the following vulnerability has been resolved: fbdev: efifb: fix memory leak in efifbprobe Since commit 73ce73c30ba9 "fbdev: Transfer video= option strings to caller; clarify ownership" the string returned from fbgetoptions is expected to be freed by the caller, but the strin...

CVE-2026-74291 ASoC: topology: Check PCM and DAI name strings before use

In the Linux kernel, the following vulnerability has been resolved: ASoC: topology: Check PCM and DAI name strings before use Topology objects store several PCM and DAI names in fixed-size UAPI arrays. Other topology parser paths validate these fields with bounded strnlen checks before using them...

CVE-2026-72318

CVE-2026-72318 affects the Linux kernel CIFS/SMB path handling. The flaw arises in parse_dfs_referrals(), where string offsets in DFS referrals are not validated against the received buffer, allowing crafted referrals to cause pointers to read outside the buffer. This can lead to out-of-bounds re...

PT-2026-72506

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the parse dfs referrals function where string offsets supplied by the server are used to compute DfsPath and NetworkAddress string pointers without verifying if they...

Linux Distros Unpatched Vulnerability : CVE-2026-72318

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cifs: validate DFS referral string offsets parsedfsreferrals validates that the response header and referral array fit in the received buffer, but each referral...