PT-2026-47221

Name of the Vulnerable Software and Affected Versions Twig affected versions not specified Description An issue exists where sandboxing enabled through SourcePolicyInterface can be bypassed. The CoreExtension::column function receives the sandbox state via the needs is sandboxed channel as a...

PT-2026-47215

Name of the Vulnerable Software and Affected Versions Symfony versions prior to 6.4 Symfony versions prior to 7.4 Symfony versions prior to 8.0 Symfony versions prior to 8.1 Description The UrlSanitizer::parse function fails to properly reject certain characters, allowing for visual spoofing of...

PT-2026-47211

Name of the Vulnerable Software and Affected Versions Symfony versions prior to 5.4.31 Symfony versions prior to 6.4.11 Description SymfonyComponentHttpClientNoPrivateNetworkHttpClient is a decorator designed to block requests to private networks. However, the list of blocked subnets omits severa...

PT-2026-47219

Name of the Vulnerable Software and Affected Versions Twig versions prior to 3.26.0 Description An issue exists where the sandbox visitor fails to wrap mapping keys in ArrayExpression with CheckToStringNode. When a dynamic key expression resolves to a Stringable object, the ArrayExpression::compi...

PT-2026-47091

Name of the Vulnerable Software and Affected Versions crun affected versions not specified Description Security issues were identified and subsequently resolved in the software. Recommendations Update to version 1.28-1.1...

CVE-2026-41073

RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10 and 6.0.0 through 6.0.2 contain a spreadsheet CSV/formula injection vulnerability. User-controlled data in spreadsheet exports is not sanitized before being written to the output file, which can caus...

UBUNTU-CVE-2026-6841

Request Tracker is vulnerable to a reflected cross-site scripting XSS vulnerability via the "Page" parameter in GET requests. An attacker can craft a URL that, when opened, results in arbitrary JavaScript execution in the victim’s browser. This vulnerability affects versions from 5.0.4 up to 5.0....

CVE-2026-41999

Incorrect Behaviour of Views with TCP PROXY Requests...

CVE-2026-42000

Insufficient Validation of Names During AXFR...

UBUNTU-CVE-2026-41999

Incorrect Behaviour of Views with TCP PROXY Requests...

CVE-2026-44075

A missing break statement in DSI OpenSession processing in Netatalk 1.5.0 through 4.4.2 causes a DSIOPTATTNQUANT switch case to fall through into DSIOPTSERVQUANT, resulting in unintended session option handling that may allow a remote attacker to cause a minor service disruption via crafted DSI...

CVE-2026-44058

An authentication bypass vulnerability in Netatalk 2.2.2 through 4.4.2 allows a remote privileged user to authenticate as an arbitrary user via the admin auth user mechanism...

CVE-2026-44065

An off-by-two error in lpwrite in papd in Netatalk 2.0.0 through 4.4.2 allows an adjacent network attacker to modify limited data or cause a minor service disruption via crafted print data...

CVE-2026-44073

Authentication modules in Netatalk 1.5.0 through 4.4.2 fail to check the return value of seteuid, which may allow a remote authenticated attacker to retain elevated privileges under error conditions...

CVE-2026-7835

A format string argument mismatch in Netatalk 3.0.3 through 4.4.2 allows a remote authenticated attacker to cause a minor denial of service via crafted input that triggers incorrect format string processing...

PT-2026-45158

Name of the Vulnerable Software and Affected Versions Twig affected versions not specified Description SandboxNodeVisitor fails to fully enforce SecurityPolicy::checkMethodAllowed for implicit toString calls because the set of wrapped AST nodes in CheckToStringNode is incomplete. This allows a...

CVE-2026-44230

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.4 up to but not including 5.0.10, and 6.0.0 up to but not including 6.0.3 contain a reflected Cross-Site Scripting XSS vulnerability where an attacker who can induce an authenticated RT user to visit a crafted U...

CVE-2026-46529

Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A single-click remote code execution vulnerability in versions prior to 1.26.3 and 1.28.4 allows an attacker to achieve arbitrary code execution as the user by tricking them into clicking a link inside...

CVE-2025-54518

Improper isolation of shared resources within the CPU operation cache on Zen 2-based products could allow an attacker to corrupt instructions executed at a different privilege level, potentially resulting in privilege escalation...

PT-2026-45007

Name of the Vulnerable Software and Affected Versions Vim versions prior to 9.2.480 Description A flaw in the netrw plugin allows arbitrary Vimscript execution when processing a crafted filename containing quote characters and expression fragments. This occurs during mark/unmark operations, where...