CVE-2026-68580

FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection channel audin across ALSA, sndio, WinMM, and OpenSL ES backends that fail to validate the FramesPerPacket parameter from RDP servers. Attackers can supply a malicious FramesPerPacket value causing...

EUVD-2026-51990

FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection channel audin across ALSA, sndio, WinMM, and OpenSL ES backends that fail to validate the FramesPerPacket parameter from RDP servers. Attackers can supply a malicious FramesPerPacket value causing...

CVE-2026-68580 FreeRDP before 3.29.0 Integer Overflow via Audio Input Channel

FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection channel audin across ALSA, sndio, WinMM, and OpenSL ES backends that fail to validate the FramesPerPacket parameter from RDP servers. Attackers can supply a malicious FramesPerPacket value causing...

CVE-2026-68580

FreeRDP contains an integer overflow in the audio input redirection channel (audin) for versions before 3.29.0, affecting ALSA, sndio, WinMM, and OpenSL ES backends. A malicious FramesPerPacket value from the RDP server can cause allocation size wraparound, leading to a heap-based buffer overflow...

OESA-2026-3193 python-urwid security update

Urwid is a console user interface library for Python. It includes many features useful for text console application developers Security Fixes: The urwid web display backend urwid/display/web.py generates web session identifiers urwidid in Screen.start by concatenating two random.randrange109 call...

Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers

Summary rexmediapool::isAllowedExtension in redaxo/src/addons/mediapool/lib/mediapool.php accepts filenames that contain a blocked extension as a non-terminal segment of a longer extension chain, for example shell.php.any.jpg. The check only catches the blocked extension when it appears at the en...

CVE-2026-53599 Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers

REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rexmediapool::isAllowedExtension in redaxo/src/addons/mediapool/lib/mediapool.php lets an authenticated backend user with mediaupload permission upload a JPEG/PHP polyglot named shell.php.any.jpg, which web servers with...

CVE-2026-53599

CVE-2026-53599 affects REDAXO CMS versions 5.18.2–5.21.1 where rex_mediapool::isAllowedExtension lets an authenticated backend user with media[upload] permission upload a JPEG/PHP polyglot named shell.php.any.jpg. On servers with multi-extension PHP handlers, this can be executed as the web serve...

CVE-2026-55825 Contao: Possible path traversal in job download URIs

Contao is an Open Source CMS. In versions 5.7.0 through 5.7.6, an authenticated backend user who can access one job can request an attachment identifier containing ../ segments and make the job attachment download endpoint read a file from another job directory inside var/job-attachments. The...

CVE-2026-55825 Contao: Possible path traversal in job download URIs

Contao is an Open Source CMS. In versions 5.7.0 through 5.7.6, an authenticated backend user who can access one job can request an attachment identifier containing ../ segments and make the job attachment download endpoint read a file from another job directory inside var/job-attachments. The...

CVE-2026-55825

CVE-2026-55825 (Contao) : Affected are Contao core-bundle versions 5.7.0–5.7.6. An authenticated backend user who can access one job can craft an attachment identifier containing ../ segments to have the job attachment download endpoint read a file from another job directory inside var/job-attach...

CVE-2026-17350

The per-tool permission system custom roles / role-based tool permissions, introduced in pgAdmin 4 9.3 did not enforce its permission check consistently. In SERVER mode, pgAdmin 4 gates each tool behind a per-tool Flask-Security permission, but the permission decorator permissionsrequired was...

CVE-2026-17350 pgAdmin 4: Tool permission bypass via backend routes and Socket.IO handlers

The per-tool permission system custom roles / role-based tool permissions, introduced in pgAdmin 4 9.3 did not enforce its permission check consistently. In SERVER mode, pgAdmin 4 gates each tool behind a per-tool Flask-Security permission, but the permission decorator permissionsrequired was...

EUVD-2026-51563

The per-tool permission system custom roles / role-based tool permissions, introduced in pgAdmin 4 9.3 did not enforce its permission check consistently. In SERVER mode, pgAdmin 4 gates each tool behind a per-tool Flask-Security permission, but the permission decorator permissionsrequired was...

CVE-2026-17350 pgAdmin 4: Tool permission bypass via backend routes and Socket.IO handlers

The per-tool permission system custom roles / role-based tool permissions, introduced in pgAdmin 4 9.3 did not enforce its permission check consistently. In SERVER mode, pgAdmin 4 gates each tool behind a per-tool Flask-Security permission, but the permission decorator permissionsrequired was...

CVE-2026-17350

Summary: CVE-2026-17350 affects pgAdmin 4 in SERVER mode (9.3–9.17). The per-tool permission system did not consistently enforce tool-level permissions; only the front-door route used a permissions_required decorator, while other backend routes and Socket.IO handlers relied on authentication chec...

CVE-2026-17350 pgAdmin 4: Tool permission bypass via backend routes and Socket.IO handlers

The per-tool permission system custom roles / role-based tool permissions, introduced in pgAdmin 4 9.3 did not enforce its permission check consistently. In SERVER mode, pgAdmin 4 gates each tool behind a per-tool Flask-Security permission, but the permission decorator permissionsrequired was...

CVE-2026-18157

A flaw was found in yggdrasil-worker-package-manager. A local attacker with existing access to the system could exploit an argument injection vulnerability in the APT backend. This allows specially crafted package names, which begin with a hyphen, to be misinterpreted as command options by apt-ge...

EUVD-2026-51380

A flaw was found in yggdrasil-worker-package-manager. A local attacker with existing access to the system could exploit an argument injection vulnerability in the APT backend. This allows specially crafted package names, which begin with a hyphen, to be misinterpreted as command options by apt-ge...

PT-2026-66775

Name of the Vulnerable Software and Affected Versions pgAdmin 4 versions 9.3 through 9.16 Description In SERVER mode, the per-tool permission system fails to consistently enforce permission checks. While a permissions required decorator is used on the initial route of a tool, subsequent backend...