PT-2026-59800

Impact If QuantizedInstanceNorm is given x min or x max tensors of a nonzero rank, it results in a segfault that can be used to trigger a denial of service attack. python import tensorflow as tf output range given = False given y min = 0 given y max = 0 variance epsilon = 1e-05 min separation =...

CVE-2026-39042

An issue in MikroTIk SIA Mikrotikls, Latvia RouterOS 7.21.x before v.7.21.4 and 7.22.x before v.7.22.2 allows a remote attacker to cause a denial of service via the unflatten function in libumsg.so...

MiracleLinux 8 : ruby:2.5 (AXSA:2026-1244:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1244:01 advisory. ruby/net-imap: ruby: Net::IMAP: IMAP Command Injection via Symbol Arguments CVE-2026-42258 net-imap: ruby: Net::IMAP: Information disclosure via...

PT-2026-57719

Missing Authorization vulnerability in peachpayments Peach Payments Gateway wc-peach-payments-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Peach Payments Gateway: from n/a through = 4.0.2...

PT-2026-60077

Authentication bypass in FacturaScripts: /login?action=two-factor-validation accepts brute-forceable TOTP without password or CSRF protection Summary Core/Controller/Login.php::twoFactorValidationAction accepts an unauthenticated POST containing only fsNick and fsTwoFactorCode. If the TOTP value...

PT-2026-58989

Description A JWT issued to an Org 1 account is accepted on the Org 2 API and can read the admin-only GraphQL participantDetails field for an Org 2 participant. The same trust-boundary problem also affects API-user authentication: an Org 1 API user can use a JWT on the Org 1 host and replay that...

nginx security, bug fix, and enhancement update

1.20.1-28.0.1.el98.4 - Reference oracle-indexhtml within Requires Orabug: 33802044 - Remove Red Hat references Orabug: 29498217 - Update upstream references Orabug: 36579090 2:1.20.1-28.4 - Resolves: RHEL-190800 - nginx: 'HTTP/2 bomb' nginx fix breaks module ABI causing crashes - Resolves:...

PT-2026-59081

Authenticated arbitrary file write in artifact bundle assembly Summary An authenticated file write vulnerability was identified in Bugsink 2.1.0 in the artifact bundle assembly flow. A user with a valid authentication token could cause the application to write attacker-controlled content to a...

PT-2026-59710

Impact When tf.raw ops.ResizeNearestNeighborGrad is given a large size input, it overflows. import tensorflow as tf align corners = True half pixel centers = False grads = tf.constant1, shape=1,8,16,3, dtype=tf.float16 size = tf.constant1879048192,1879048192, shape=2, dtype=tf.int32 tf.raw...

The vulnerability of the vm2 package manager’s code transformer allows a hacker to execute arbitrary code.

The vulnerability of the vm2 package manager’s code transformation transformer is related to a breach of data protection mechanisms. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...

Security update for xwayland (important)

openSUSE security update: security update for xwayland ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21283-1 Rating: important References: bsc1268893 bsc1268894 Cross-References: CVE-2026-55999 CVE-2026-56000 CVSS scores: CVE-2026-55999 SUSE : 7...

PT-2026-59894

Impact Constructing a tflite model with a paramater filter input channel of less than 1 gives a FPE. Patches We have patched the issue in GitHub commit 34f8368c535253f5c9cb3a303297743b62442aaa. The fix will be included in TensorFlow 2.12. We will also cherrypick this commit on TensorFlow 2.11.1...

PT-2026-59870

Impact When SetSize receives an input set shape that is not a 1D tensor, it gives a CHECK fails that can be used to trigger a denial of service attack. python import tensorflow as tf arg 0=1 arg 1=1,1 arg 2=1 arg 3=True arg 4='' tf.raw ops.SetSizeset indices=arg 0, set values=arg 1, set shape=arg...

PT-2026-59866

Impact tf.raw ops.DynamicStitch specifies input sizes when it is registered. cpp REGISTER OP"DynamicStitch" .Input"indices: N int32" .Input"data: N T" .Output"merged: T" .Attr"N : int = 1" .Attr"T : type" .SetShapeFnDynamicStitchShapeFunction; When it receives a differing number of inputs, such a...

PT-2026-59911

Impact tf.keras.losses.poisson receives a y pred and y true that are passed through functor::mul in BinaryOp. If the resulting dimensions overflow an int32, TensorFlow will crash due to a size mismatch during broadcast assignment. python import numpy as np import tensorflow as tf true value =...

PT-2026-59877

Impact If a list of quantized tensors is assigned to an attribute, the pywrap code fails to parse the tensor and returns a nullptr, which is not caught. An example can be seen in tf.compat.v1.extract volume patches by passing in quantized tensors as input ksizes. python import numpy as np import...

PT-2026-59088

An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to...

PT-2026-59410

Summary A memory-safety vulnerability in Open Babel's MOL2 file format parser caused a NULL pointer dereference when reading a crafted input file. Details The flaw was in OBAtom::SetFormalCharge as called from the MOL2 parser. A malformed atom record caused the parser to call the method on a NULL...

PT-2026-59750

Impact The implementation of FractionalAvgPoolGrad does not fully validate the input orig input tensor shape. This results in an overflow that results in a CHECK failure which can be used to trigger a denial of service attack. python import tensorflow as tf overlapping = True orig input tensor...

PT-2026-59730

Impact Constructing a tflite model with a paramater filter input channel of less than 1 gives a FPE. Patches We have patched the issue in GitHub commit 34f8368c535253f5c9cb3a303297743b62442aaa. The fix will be included in TensorFlow 2.12. We will also cherrypick this commit on TensorFlow 2.11.1...