CVE-2026-48799 Postiz: Unauthenticated arbitrary lifetime PRO grant via Nowpayments webhook

Postiz is an AI social media scheduling tool. Prior to 2.21.8, Postiz fails to verify Nowpayments IPN callback authenticity against the payment provider shared secret and reads the target subscription identifier from the untrusted request body, allowing a low-privileged account to grant arbitrary...

CVE-2026-59762

When an HTTP/2 profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Impact: System performance can degrade until the TMM process is either forced to restart or is manually restarted. This vulnerability allows a remote,...

PT-2026-60198

Name of the Vulnerable Software and Affected Versions Penpot versions prior to 2.14.5 Description An issue exists where invitation tokens from create-team-invitations in teams invitations.clj are exposed. Additionally, an existing profile id is embedded in prepare-register-profile within auth.clj...

Linux Distros Unpatched Vulnerability : CVE-2026-15713

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was found in libsoup's HTTP/2 protocol implementation. The library fails to correctly release memory context blocks under specific stream...

PT-2026-60213

Name of the Vulnerable Software and Affected Versions File Browser versions prior to 2.63.17 Description When Signup and CreateUserDir are both set to true, the software uses the cleanUsername function to build new user scopes. A many-to-one normalization flaw allows different usernames for...

CVE-2026-49476 Soup Sieve: Memory Exhaustion via Large Comma-Separated Selector Lists in soupsieve

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve allocates unbounded memory when compiling large comma-separated selector lists, allowing an attacker who can supply a crafted selector string to soupsieve.compile o...

EUVD-2026-44538

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve contains a regular expression vulnerable to catastrophic backtracking when processing an attribute selector with an unterminated quoted value in...

CVE-2026-48816

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.1.1, @sigstore/verify derives a transparency-log timestamp from tlogEntries.integratedTime for bundle v0.2 inclusionProof-only entries even though the inclusion proof path does not cryptographically bind...

CVE-2026-15713

This CVE affects Libsoup’s HTTP/2 implementation. The issue is a memory leak where memory context blocks are not properly released under specific stream termination conditions (e.g., window exhaustion or explicit stream resets). A remote, unauthenticated attacker acting as a malicious network pee...

tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated

Apache Tomcat did not validate HTTP/2 request headers, triggering unexpected application behavior, as applications may presume that header values exposed through the Servlet API would be valid...

CVE-2026-49788

CVE-2026-49788 : An HTTP/2 denial-of-service vulnerability due to unbounded resource allocation allows an unauthenticated network attacker to exhaust resources and disrupt service. CVSSv3.1 base score 7.5 (HIGH); vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. No product/vendor/version details are p...

CVE-2026-49788 HTTP/2 Denial of Service Vulnerability

...

CVE-2026-51105

Buffer Overflow vulnerability in aMULE-Project aMule v.2.3.3 allows a remote attacker to cause a denial of service via the OPSERVERMESSAGE Handler...

HTTP/2 Denial of Service Vulnerability

Allocation of resources without limits or throttling in HTTP/2 allows an unauthorized attacker to deny service over a network...

EUVD-2026-43606

OpENer 2.3.0 master branch up to commit 76b95cf is vulnerable to a severe memory corruption issue caused by an integer underflow in the processing of connected explicit messages SendUnitData...

CVE-2026-51105

CVE-2026-51105 affects aMULE-Project’s aMule 2.3.3. The root cause is a Buffer Overflow in the OP_SERVERMESSAGE Handler, enabling a remote attacker over the network with no user interaction to cause a denial of service. The CVSS indicates Network access, low complexity, no privileges, and a High ...

ROS-20260714-73-0015

The vulnerability of SMB2 protocol analyzer in Wireshark is related to improper management of sequential memory allocation. Exploiting this vulnerability can allow attackers to cause service failures...

PYSEC-2026-3231 TensorFlow vulnerable to seg fault in `tf.raw_ops.Print`

Impact When the parameter summarize of tf.rawops.Print is zero, the new method SummarizeArray will reference to a nullptr, leading to a seg fault. python import tensorflow as tf tf.rawops.Printinput = tf.constant1, 1, 1, 1,dtype=tf.int32, data = False, False, False, False, False, False, False,...

PYSEC-2026-3122 TensorFlow has Heap-buffer-overflow in AvgPoolGrad

Impact python import os os.environ'TFENABLEONEDNNOPTS' = '0' import tensorflow as tf printtf.version with tf.device"CPU": ksize = 1, 40, 128, 1 strides = 1, 128, 128, 30 padding = "SAME" dataformat = "NHWC" originputshape = 11, 9, 78, 9 grad = tf.saturatecasttf.random.uniform16, 16, 16, 16,...

PYSEC-2026-3300 TensorFlow vulnerable to Out-of-Bounds Read in DynamicStitch

Impact If the parameter indices for DynamicStitch does not match the shape of the parameter data, it can trigger an stack OOB read. python import tensorflow as tf func = tf.rawops.DynamicStitch para='indices': 0xdeadbeef, 405, 519, 758, 1015, 'data': 110.27793884277344, 120.29475402832031,...