CVE-2026-47781

PDM is a Python package and dependency manager. In versions up to and including 2.26.9, PDM automatically loads project-local plugins from a .pdm-plugins directory during initialization, allowing an attacker-controlled file in an untrusted repository checkout to execute arbitrary Python code befo...

python-pillow: Pillow: Denial of Service via crafted PCF font data

A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit this vulnerability by providing specially crafted PCF font data. This data, when processed, can lead to excessive memory allocation because the library does not properly check for decompression bombs. The primar...

CVE-2026-47763

pdm is a Python package and dependency manager supporting the latest PEP standards. In versions prior to 2.27.0, pdm writes several project-local state or configuration files without symlink protection. If a malicious repository places those files as symlinks, local PDM operations can overwrite t...

CVE-2026-16728 vulnerabilities

Vulnerabilities for packages: commercial-gitlab-rails-ee, langfuse, pulumi, saf, vitess, actions-runner, renovate, prism, langfuse-fips, pelias-api, npm, commercial-gitlab-rails-ee-fips, code-server, kibana...

GHSA-V3R7-H72X-CJCM vulnerabilities

Vulnerabilities for packages: commercial-gitlab-rails-ee, langfuse, pulumi, saf, vitess, actions-runner, renovate, prism, langfuse-fips, pelias-api, npm, commercial-gitlab-rails-ee-fips, code-server, kibana...

CVE-2026-13697 vulnerabilities

Vulnerabilities for packages: commercial-gitlab-rails-ee, langfuse, vitess, renovate, langfuse-fips, pelias-api, commercial-gitlab-rails-ee-fips, code-server, kibana...

GHSA-4CWX-7WF7-3272 vulnerabilities

Vulnerabilities for packages: commercial-gitlab-rails-ee, langfuse, vitess, renovate, langfuse-fips, pelias-api, commercial-gitlab-rails-ee-fips, code-server, kibana...

GHSA-8359-H9FX-J6V9 vulnerabilities

Vulnerabilities for packages: label-studio...

GHSA-RFR2-MQ9M-X2QX vulnerabilities

Vulnerabilities for packages: label-studio...

CVE-2026-55403 vulnerabilities

Vulnerabilities for packages: label-studio...

GHSA-MJRX-74JH-7XGW vulnerabilities

Vulnerabilities for packages: nextcloud-server...

CVE-2026-67355 vulnerabilities

Vulnerabilities for packages: nextcloud-server...

CVE-2026-70367

A Server-Side Request Forgery SSRF bypass vulnerability exists in “stunnel” 5.79 and lower when configured in SOCKS proxy mode. This flaw allows a client to bypass intended localhost restrictions by using IPv4-mapped IPv6 addresses e.g., “::ffff:127.0.0.1” or unspecified addresses "0.0.0.0", "::"...

CVE-2026-68744

A flaw was found in SSSD. The sssnssprotocolfillinitgr function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to...

SUSE CVE-2026-12061

unknown...

CVE-2022-21680 vulnerabilities

Vulnerabilities for packages: arangodb...

GHSA-88FW-V6X4-3F58 vulnerabilities

Vulnerabilities for packages: camunda-zeebe, apache-nifi-registry...

GHSA-M4P7-R5RC-7G4J vulnerabilities

Vulnerabilities for packages: py3-cassandra-medusa, airflow, kserve, superset, kubeflow-pipelines...

CVE-2026-59884 vulnerabilities

Vulnerabilities for packages: openstack-keystone-2025.1, authentik, kubeflow-pipelines, wazuh-manager, authentik-fips, wazuh-manager-fips, kserve, localstack, openstack-keystone-2026.1, duplicity, dbt-bigquery, airflow, openstack-keystone-2025.2, py3-cassandra-medusa, superset, datahub-ingestion,...

CVE-2026-67338

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...