JeecgBoot security vulnerability

JeecgBoot is a Java low-code platform developed by Jeecg Corporation, designed for enterprise web applications. Versions of JeecgBoot from v3.0.0 to v3.5.3 have security vulnerabilities. These vulnerabilities stem from command injection in the component jmreport/show, which could allow attackers ...

PT-2026-46571

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 149.0.7827.53 Description A use after free issue exists in Views, where a remote attacker could potentially exploit heap corruption—a condition where memory allocation on the heap is corrupted—via a crafted HTML...

Medium: freerdp

Issue Overview: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a client-side heap buffer overflow occurs in the FreeRDP client's AVC420/AVC444 YUV-to-RGB conversion path due to missing horizontal bounds validation of H.264 metablock regionRects coordinates. In...

CVE-2026-34874: NULL Pointer Dereference

An issue was discovered in Mbed TLS through 3.6.5 and 4.x through 4.0.0. There is a NULL pointer dereference in distinguished name parsing that allows an attacker to write to address 0...

MBed TLS security vulnerabilities

Mbed TLS is an open-source, portable, easy-to-use, readable, and flexible SSL library developed by Mbed. Versions of Mbed TLS from 3.5.0 to 4.0.0 contain security vulnerabilities, which stem from the potential for client impersonation when restoring TLS 1.3 sessions...

PT-2026-29611

Name of the Vulnerable Software and Affected Versions Mbed TLS versions 3.5.0 through 4.0.0 Description A security issue was identified that allows client impersonation during TLS 1.3 session resumption. Recommendations Update to a version later than 4.0.0...

PT-2026-36321

Name of the Vulnerable Software and Affected Versions Exiftool versions prior to 13.54 Description Local code injection is possible through the manipulation of the -ee argument. The issue resides in the Process mrld function within the lib/Image/ExifTool/GM.pm file, specifically affecting the JPE...

Amazon Linux 2023 : freerdp, freerdp-devel, freerdp-libs (ALAS2023-2026-1520)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1520 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a client-side heap buffer overflow occurs in the FreeRDP client's AVC420/AVC444 YUV-to-RGB conversion path due...

Fedora: Security Advisory (FEDORA-2026-f6fe509803)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Important: ImageMagick

Issue Overview: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap information disclosure vulnerability exists in ImageMagick's PSD Adobe Photoshop format handler. When processing a maliciously crafted PS...

Credential Exposure

Overview openssl-encrypt is an A package for secure file encryption and decryption based on modern ciphers using heavy-compute-load chaining of hashing and KDF to generate strong encryption password based on users provided password to ensure secure encryption of files Affected versions of this...

Cross-site Request Forgery (CSRF)

Overview admidio/admidio is a free open source user management system for websites of organizations and groups. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF in the itemsave process when the imported parameter is set to true. An attacker can bypass both CSRF...

CVE-2026-28228

OpenOlat is an open source web-based e-learning platform for teaching, learning, assessment and communication. Prior to versions 19.1.31, 20.1.18, and 20.2.5, an authenticated user with the Author role can inject Velocity directives into a reminder email template. When the reminder is processed...

baserCMS is Vulnerable to Cross-site Scripting

baserCMS has DOM-based cross-site scripting in tag creation. Target baserCMS 5.2.2 and earlier versions Vulnerability Malicious JavaScript may be executed when creating a tag. Countermeasures Update to the latest version of baserCMS Please refer to the following page to reference for more...

baserCMS has an SQL injection vulnerability in its blog post functionality

baserCMS has a SQL injection vulnerability in blog posts. Target baserCMS 5.2.2 and earlier versions Vulnerability Malicious SQL may be executed in blog posts. Countermeasures Update to the latest version of baserCMS Please refer to the following page to reference for more information...

cratedb-mcp (0.0.3), figma-to-compose-mcp (>=0.1.0, <=1.1.1) +7 more potentially affected by CVE-2026-27124 via fastmcp (2.6.1)

fastmcp PYPI version 2.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - cratedb-mcp 0.0.3 - figma-to-compose-mcp =0.1.0, =0.1.0, =0.1.0, =0.0.2, =1.0.0, =3.0.0, =3.0.2 Source cves: CVE-2026-27124 Source advisory:...

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Overview Affected versions of this package are vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator PRNG seeded with predictable values in the secretkey and hashidsalt. An attacker can gain unauthorized access to any user account, including administrators, by brute-forcing t...

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Overview Affected versions of this package are vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator PRNG seeded with predictable values in the secretkey and hashidsalt. An attacker can gain unauthorized access to any user account, including administrators, by brute-forcing t...

cratedb-mcp (0.0.3), figma-to-compose-mcp (>=0.1.0, <=1.1.1) +7 more potentially affected by CVE-2025-64340 via fastmcp (2.6.1)

fastmcp PYPI version 2.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - cratedb-mcp 0.0.3 - figma-to-compose-mcp =0.1.0, =0.1.0, =0.1.0, =0.0.2, =1.0.0, =3.0.0, =3.0.2 Source cves: CVE-2025-64340 Source advisory:...

CVE-2026-34556 iccDEV: HBO in icAnsiToUtf8()

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, there is a heap-buffer-overflow HBO in icAnsiToUtf8 in the XML conversion path. The issue is triggered by a crafted ICC profile which causes icAnsiToUtf8std::string&, char const ...