PT-2026-81460

Name of the Vulnerable Software and Affected Versions OpenEXR versions prior to 3.2.11 OpenEXR versions 3.3.0 through 3.3.12 OpenEXR versions 3.4.0 through 3.4.13 Description An issue exists where the TypedDeepImageChannel::row function can return an out-of-bounds pointer when processing a crafte...

PT-2026-81461

Name of the Vulnerable Software and Affected Versions OpenEXR versions prior to 3.2.11 OpenEXR versions 3.3.0 through 3.3.12 OpenEXR versions 3.4.0 through 3.4.13 Description On ILP32 builds, an out-of-bounds read occurs when processing a crafted uncompressed deep-tile EXR. This happens because t...

The vulnerability of the tcf_ct_init() function in the net/sched/act_ct.c module of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the tcfctinit function in the net/sched/actct.c module of the Linux operating system is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the...

CVE-2026-75421

CVE-2026-75421 is a stack-buffer-underflow in the IOFile::getLine() function of aria2 versions up to and including 1.37.0 . The flaw is triggered locally without privileges or user interaction, leading to a low availability impact (potential crash) with no confidentiality or integrity impact (CVS...

PT-2026-81861

aria2 =1.37.0 has a stack-buffer-underflow vulnerability in the IOFile::getLine function...

The vulnerability of the environment.lookup() function in the child_process module of the json-data processing tool, JSONata, allows a attacker to execute arbitrary code.

The vulnerability of the environment.lookup function in the childprocess module of the json-data processing tool JSONata is related to improper code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PT-2026-81298

A weakness has been identified in liketrek TREK up to 3.0.22. This impacts the function validateShareTokenForAsset of the component Journey Photo Proxy. Executing a manipulation can lead to incorrect authorization. The attack can be launched remotely. This attack is characterized by high...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the jsonValue function when user-controlled data is supplied to the jsonPath parameter with PostgresDriver. An attacker can execute arbitrary SQL commands by injecting malicious input. Remediation Upgrade...

SQL Injection

Overview cakephp/cakephp is a rapid development framework for PHP which uses commonly known design patterns like Associative Data Mapping, Front Controller, and MVC. Affected versions of this package are vulnerable to SQL Injection via the jsonValue function when user-controlled data is supplied ...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple Base OS issues

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple Base OS issues. We have updated the base image used by our Speech Services and the following vulnerabilities have been addressed. Please read the details for remediation below. Vulnerability Details CVEID:CVE-2024-34459...

CVE-2026-78434

A flaw has been found in Faveo Helpdesk up to 2.0.3. This impacts the function FormController::postticketreply of the file app/Http/Controllers/Client/helpdesk/FormController.php of the component post-ticket-reply Endpoint. This manipulation causes missing authentication. The attack can be...

CVE-2026-78435

A vulnerability has been found in Faveo Helpdesk up to 2.0.3. Affected is the function unlink of the file app/Http/Controllers/Admin/helpdesk/SettingsController.php of the component Logo Handler. Such manipulation of the argument data1 leads to path traversal. The attack can be launched remotely...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an out-of-bounds read in onnx [CVE-2026-14647]

Summary IBM Watson Speech Services Cartridge is vulnerable to an out-of-bounds read in onnx that affects the function convPoolShapeInferenceopset19 of the file onnx/defs/nn/old.cc of the component onnxruntime CVE-2026-14647. Onnx is used as part of our service runtimes. This vulnerability has bee...

CVE-2026-59648

A flaw was found in Bouncy Castle for Java. The OpenPGP Argon2 S2K Salted Key Derivation Function implementation allows a remote attacker to influence the amount of memory and passes used during key derivation. This can lead to a denial of service DoS by consuming excessive system resources, maki...

CVE-2026-58063

A flaw was found in Bouncy Castle for Java. A remote attacker can exploit this vulnerability by providing a specially crafted BCFKS keystore file that specifies an unbounded Key Derivation Function KDF cost. This can lead to a Denial of Service DoS as the system attempts to process the file,...

CVE-2026-15055

A flaw was found in Bouncy Castle for Java. An attacker could exploit this vulnerability by providing a specially crafted input to the PKCS8 / PBES2 decryptors. This input could specify an excessively high Key Derivation Function KDF cost, causing the decryptor to consume significant computationa...

CVE-2026-78435 Faveo Helpdesk Logo SettingsController.php unlink path traversal

A vulnerability has been found in Faveo Helpdesk up to 2.0.3. Affected is the function unlink of the file app/Http/Controllers/Admin/helpdesk/SettingsController.php of the component Logo Handler. Such manipulation of the argument data1 leads to path traversal. The attack can be launched remotely...

CVE-2026-78435 Faveo Helpdesk Logo SettingsController.php unlink path traversal

A vulnerability has been found in Faveo Helpdesk up to 2.0.3. Affected is the function unlink of the file app/Http/Controllers/Admin/helpdesk/SettingsController.php of the component Logo Handler. Such manipulation of the argument data1 leads to path traversal. The attack can be launched remotely...

CVE-2026-78435 Faveo Helpdesk Logo SettingsController.php unlink path traversal

A vulnerability has been found in Faveo Helpdesk up to 2.0.3. Affected is the function unlink of the file app/Http/Controllers/Admin/helpdesk/SettingsController.php of the component Logo Handler. Such manipulation of the argument data1 leads to path traversal. The attack can be launched remotely...

CVE-2026-78435

A path traversal vulnerability exists in Faveo Helpdesk up to version 2.0.3 . The flaw is in the unlink function within app/Http/Controllers/Admin/helpdesk/SettingsController.php (component: Logo Handler ). Manipulation of the data1 argument allows an authenticated attacker (high privileges requi...