CVE-2026-88265 Crun: crun: /dev/null symlink follow during stdio reopen allows host bind-mount write and chown

A flaw was found in crun. After pivotroot, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file's ownership. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed relea...

CVE-2026-88265

crun (a container runtime) is affected by a flaw where, after pivot_root , reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, allowing the container to change that file's ownership (chown). This effectively permits a host bind-mount write and chown from ...

EUVD-2026-75300

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c indexes the per-character encoding array using numchars from the FSQueryXBitmaps16 reply, but that array was allocated with a size derived from numextents in the separate FSQueryXExtents16 reply. The two CARD32 fields are never...

CVE-2026-59679

CVE-2026-59679 affects the libXfont2 font-server client (X.Org X11). The function fs_read_glyphs() in src/fc/fserve.c indexes the encoding[] array using num_chars from the FS_QueryXBitmaps16 reply, but that array was allocated based on num_extents from the separate FS_QueryXExtents16 reply—two fi...

CVE-2026-59679 fs_read_glyphs() heap OOB read/write via encoding array index mismatch in libXfont2

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c indexes the per-character encoding array using numchars from the FSQueryXBitmaps16 reply, but that array was allocated with a size derived from numextents in the separate FSQueryXExtents16 reply. The two CARD32 fields are never...

CVE-2026-59679

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c indexes the per-character encoding array using numchars from the FSQueryXBitmaps16 reply, but that array was allocated with a size derived from numextents in the separate FSQueryXExtents16 reply. The two CARD32 fields are never...

vim: Vim: Denial of Service via out-of-bounds write in spell sound-folding

An out-of-bounds write vulnerability in Vim's spellsoundfoldsal function allows an attacker to corrupt memory and crash the editor Denial of Service by supplying a specially crafted word during spell sound-folding...

vim: Vim: Denial of Service via out-of-bounds write in terminal handling

A flaw was found in Vim, an open-source command-line text editor. This vulnerability allows a program displaying output in a Vim terminal window to trigger an out-of-bounds write by sending a specific byte sequence. This can lead to a crash of the Vim application, resulting in a Denial of Service...

kernel: netfilter: conntrack: remove sprintf usage

A flaw was found in the Linux kernel's netfilter conntrack module. This vulnerability arises from the use of sprintf and insufficient buffer sizing in the manglecontentlen function, which can lead to a stack-out-of-bounds write. An attacker could potentially exploit this memory corruption issue t...

PT-2026-89504

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, FullyConnected::DeSerialize in src/lstm/fullyconnected.cpp does not validate the deserialized layer scalars ni and no against the weight-matrix dimensions. During FullyConnected::Forward, MatrixDotVector in...

PT-2026-89375

Capgo capgo.app fails to restrict direct write access to the public.sso providers table exposed through Supabase PostgREST. A holder of an ordinary Capgo full API key can insert a row with status='active' and enforce sso=true, bypassing the intended backend SSO provisioning route...

PT-2026-89725

A vulnerability in the /v1/runs API endpoint of lightning-ai/pytorch-lightning v2.2.4 allows attackers to exploit path traversal when extracting tar.gz files. When the LightningApp is running with the plugin server, attackers can deploy malicious tar.gz plugins that embed arbitrary files with pat...

RHEL 9 : vim (RHSA-2026:66366)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:66366 advisory. Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: Vim: Information disclosure and denial of service...

Linux Distros Unpatched Vulnerability : CVE-2026-88050

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Tesseract is an open source OCR engine. In version 5.5.3 and earlier, RecodedCharID::DeSerialize in src/ccutil/unicharcompress.h validates length but accepts...

RHEL 8 : gstreamer1-plugins-bad-free (RHSA-2026:66406)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:66406 advisory. GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a...

Linux Distros Unpatched Vulnerability : CVE-2026-88048

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Tesseract is an open source OCR engine. In version 5.5.3 and earlier, FullyConnected::DeSerialize in src/lstm/fullyconnected.cpp does not validate the...

PT-2026-89721

In lightning-ai/pytorch-lightning version 2.3.2, a vulnerability exists in the LightningApp when running on a Windows host. The vulnerability occurs at the /api/v1/upload file/ endpoint, allowing an attacker to write or overwrite arbitrary files by providing a crafted filename. This can lead to...

Important: vim security update

Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: Vim: Information disclosure and denial of service via crafted Unicode characters in terminal emulator CVE-2026-28420 vim: Vim: Denial of Service via out-of-bounds write in terminal handling CVE-2026-52859 vi...

PT-2026-89732

It was discovered that libEBML incorrectly handled certain read and write operations. An attacker could possibly use this issue to cause a buffer overflow, resulting in a denial of service...

PT-2026-89494

Warning: A critical path traversal vulnerability in Plesk Backup Manager allows arbitrary root file writes by authenticated customers. CVE-2026-68487 CVSS3.0: 9.9. Read the advisory https://t.co/GniZ2f5Oox and Patch Patch Patch...