CVE-2026-68006

A flaw was found in Puma. An attacker could exploit a vulnerability within the HTTP parser component to execute arbitrary code. This could allow the attacker to take control of the affected system...

CVE-2026-107734 SumatraPDF: SyncTeX Argument Injection in Inverse Search Enables Arbitrary Command Execution via External Editors

SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, an attacker-controlled SyncTeX source filename is substituted for the %f placeholder in an external editor command line without safe Windows argument quoting, and the resulting command line is passed to CreateProcessW. A user...

CVE-2026-107734 SumatraPDF: SyncTeX Argument Injection in Inverse Search Enables Arbitrary Command Execution via External Editors

SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, an attacker-controlled SyncTeX source filename is substituted for the %f placeholder in an external editor command line without safe Windows argument quoting, and the resulting command line is passed to CreateProcessW. A user...

CVE-2026-107651

A heap-based buffer overflow exists in Eye of GNOME (eog) within the PNG metadata reader . The vulnerability is caused by improper state handling during the parsing of split metadata chunks. A remote attacker could exploit this by tricking a user into opening a specially crafted PNG file , which ...

CVE-2026-107651

A flaw was found in Eye of GNOME eog. A heap-based buffer overflow exists in the PNG metadata reader due to improper state handling when parsing split metadata chunks. A remote attacker could exploit this flaw by enticing a user into opening a specially crafted PNG file, potentially leading to...

CVE-2026-107651 Eog: eog: arbitrary code execution via heap buffer overflow in png metadata reader

A flaw was found in Eye of GNOME eog. A heap-based buffer overflow exists in the PNG metadata reader due to improper state handling when parsing split metadata chunks. A remote attacker could exploit this flaw by enticing a user into opening a specially crafted PNG file, potentially leading to...

CVE-2026-107651

A flaw was found in Eye of GNOME eog. A heap-based buffer overflow exists in the PNG metadata reader due to improper state handling when parsing split metadata chunks. A remote attacker could exploit this flaw by enticing a user into opening a specially crafted PNG file, potentially leading to...

CVE-2026-105404

A flaw was found in ImageMagick. This vulnerability allows a remote attacker to achieve arbitrary code execution or unauthorized data access by supplying crafted input values to the PostScript a page description language coders. Because the application fails to properly sanitize and escape values...

DEBIAN-CVE-2026-89091

A flaw was found in ansible-core. When installing a collection with ansible-galaxy collection install, the archive extractor validates member paths using lexical path normalisation os.path.abspath instead of resolving symbolic links os.path.realpath, and it performs no containment check on...

AZL-107132 CVE-2026-89091 affecting package ansible 2.17.11-1

A flaw was found in ansible-core. When installing a collection with ansible-galaxy collection install, the archive extractor validates member paths using lexical path normalisation os.path.abspath instead of resolving symbolic links os.path.realpath, and it performs no containment check on...

CVE-2026-89091

A flaw was found in ansible-core. When installing a collection with ansible-galaxy collection install, the archive extractor validates member paths using lexical path normalisation os.path.abspath instead of resolving symbolic links os.path.realpath, and it performs no containment check on...

CVE-2026-84875

IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow...

CVE-2026-84249

IBM Guardium Data Protection 12.2, and 12.2.2 could allow a remote attacker to execute arbitrary management operations due to missing authentication for critical function...

CVE-2026-84058

IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to a buffer overrun in the TDS Microsoft SQL Server PRELOGIN packet decoder. A remote attacker who can send a specially crafted TDS PRELOGIN packet to a network monitored by an IBM Guardium Collector may cause a denial of service or...

CVE-2026-84198

IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow...

CVE-2026-75875

IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to path traversal...

CVE-2026-82900

IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to delete arbitrary files due to improper limitation of a pathname to a restricted directory...

CVE-2026-107726

Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, improper validation of data supplied by a malicious client able to connect to a cluster allows arbitrary reads from a cluster member's Java heap, off-heap data, an...

CVE-2026-107724

fast-jwt provides fast JSON Web Token JWT implementation. In 6.2.4, fast-jwt can classify raw serialized public JWK or JWKS JSON as an HMAC secret because src/crypto.js performDetectPublicKeyAlgorithms treats non-PEM strings as symmetric key material. If HS256 is explicitly allowed or inferred, a...

GHSA-556J-VV39-8RQV Banks: Symlink traversal and arbitrary file disclosure/overwrite in DirectoryPromptRegistry

Summary In banks.registries.DirectoryPromptRegistry, prompt file paths and the index file index.json do not refuse symbolic links. When a prompt directory contains or accepts untrusted files e.g. unpacked archives, shared repositories, or multi-tenant folders, symbolic links pointing outside the...