CVE-2026-63402: i18next: i18next is an internationalization framework for JavaScript

i18next is an internationalization framework for JavaScript. Prior to version 26.3.4, deepExtend in src/utils.js checks property existence with the in operator and recurses into inherited built-ins reached through Object.prototype. An application must explicitly pass attacker-controlled resource...

PT-2026-134186

Name of the Vulnerable Software and Affected Versions Tesseract versions prior to 5.5.4 Description The GENERIC 2D ARRAY::DeSerializeSize function in src/ccstruct/matrix.h reads matrix dimensions as signed int32 t values and compares them only with UINT16 MAX. This allows negative values to reach...

PT-2026-133466

Name of the Vulnerable Software and Affected Versions OPNsense versions prior to 26.7.8 Description Authenticated users with System: Firmware privileges can execute commands as root by providing a malicious firmware mirror URL. This occurs when shell metacharacters are submitted via the 'POST...

PT-2026-133731

Name of the Vulnerable Software and Affected Versions LM Studio versions prior to 0.4.22+1 Description A path traversal issue exists in the model downloader's resolveDownloadRequest function. This allows attackers to write files outside the designated models directory by using backslash-separated...

PT-2026-134191

OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, OpenVmHalo2Verifier.verify constructs raw proof calldata from user-controlled proofData, performs a staticcall to addressthis, and...

OpenWRT uhttpd input validation error vulnerability

OpenWRT uhttpd contains an input validation error vulnerability. This vulnerability arises because after processing invalid chunk-length entries, the clientpollpostdata function in client.c clears contentlength and transferchunked, but fails to clear the remaining request body or close the...

n8n permission and access control issue vulnerability

Versions prior to n8n 2.42.6, versions 2.43.x prior to 2.43.3, and versions 3.x prior to 3.0.1 contain a permission and access control vulnerability. This vulnerability arises because the deprecated Function, Function Item, and LangChain Code nodes run outside the isolation of the task runner...

WordPress Content Egg authorization issue vulnerability

WordPress Content Egg versions 12.0.0 and earlier contain an authorization issue vulnerability. This vulnerability stems from the absence of permission checks for each article within the ajaxUpdateProducts function. Although static nonces and the general editposts permission are validated,...

PT-2026-134475

Name of the Vulnerable Software and Affected Versions Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker versions prior to 4.1.2 Description Unauthenticated attackers can achieve remote code execution on the server. The issue occurs because the id...

Apache Pinot authorization issue vulnerability

Apache Pinot versions 1.5.1 and earlier contain an authorization issue vulnerability. This vulnerability stems from improper authorization in the single-phase query engine; the lookup conversion function identifies dimension tables via string literal parameters rather than using FROM clauses. As ...

PT-2026-133728

A vulnerability was determined in 37954679 cak-filemanagement-system up to 5e6433246475e66462e1fea980688de96a049297. This vulnerability affects the function move uploaded file of the file admin/add logs.php. Executing a manipulation of the argument File can lead to unrestricted upload. The attack...

IBM MQ 9.4.0.0 < 9.4.0.30 LTS / 9.4.1.0 < 9.4.5.4 CD / 10.0.0.0 < 10.0.0.6 (7284695)

The version of IBM MQ Server running on the remote host is 9.4.0.0 through 9.4.0.26 LTS, 9.4.1.0 through 9.4.5.3 CD, or 10.0.0.0 through 10.0.0.5. It is, therefore, affected by a vulnerability as referenced in the 7284695 advisory. - IBM MQ could allow an authenticated attacker to cause a denial ...

PT-2026-134224

Name of the Vulnerable Software and Affected Versions uhttpd affected versions not specified Description A flaw in the application-layer body-handler occurs when a POST /ubus request arrives in multiple TCP segments. The function uh ubus data send in ubus.c can desynchronize HTTP request boundari...

Important: thunderbird

Issue Overview: Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. CVE-2026-100762 Sandbox escape due to use-after-free in the DOM: Content Processes component...

Juniper SSR < 7.0.5 / 7.1.x < 7.1.7 / 7.2.x < 7.2.3 Multiple Vulnerabilities (JSA112183)

The version of Juniper Session Smart Router SSR or Session Smart Conductor installed on the remote host is prior to 7.0.5, 7.1.x prior to 7.1.7, or 7.2.x prior to 7.2.3. It is, therefore, affected by multiple vulnerabilities as referenced in the JSA112183 advisory. - An Improper Neutralization of...

CentOS Linux 7 [TuxCare] Security Update: postgresql / postgresql-contrib / postgresql-devel / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1793088226)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1793088226 advisory. - Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to...

RHEL 8 : webkit2gtk3 (RHSA-2026:92339)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:92339 advisory. WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: chromium-browser: skia:...

free5gc v4.2.3+ Root CA Private Key Exposure

free5gc versions v1.0.0 through v4.2.3+ contain a publicly committed Root CA private key that can be used to forge trusted network function certificates in deployments using its shipped TLS trust anchor. A proof of concept is provided. https://packetstorm.news/download/238561...

CentOS Linux 6 [TuxCare] Security Update: c-ares / c-ares-devel Multiple Vulnerabilities (CENTOS6:CLSA-2026:1793082403)

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1793082403 advisory. - Heap-based buffer overflow in the arescreatequery function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial of...

CentOS Linux 7 [TuxCare] Security Update: openssl / openssl-devel / openssl-libs / openssl-perl / etc (CENTOS7:CLSA-2026:1793106820)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1793106820 advisory. - Issue summary: Calling the OpenSSL API function SSLselectnextproto with an empty supported client protocols buffer may cause a crash or memory...