CVE-2026-15525

A vulnerability was detected in kLOsk adloop up to 0.9.0. This vulnerability affects the function validateurls of the file src/adloop/ads/write.py. Performing a manipulation of the argument finalurl results in server-side request forgery. The attack may be initiated remotely. The exploit is now...

CVE-2026-15520

A vulnerability was determined in GNU LibreDWG 0.13.4-154-g0b573035. This impacts the function decompressR2004section of the file src/decode.c of the component R2004 Section Decompression. Executing a manipulation can lead to heap-based buffer overflow. The attack requires local access. The explo...

CVE-2026-15520 GNU LibreDWG R2004 Section Decompression decode.c decompress_R2004_section heap-based overflow

A vulnerability was determined in GNU LibreDWG 0.13.4-154-g0b573035. This impacts the function decompressR2004section of the file src/decode.c of the component R2004 Section Decompression. Executing a manipulation can lead to heap-based buffer overflow. The attack requires local access. The explo...

RLSA-2026:37436 Important: golang security, bug fix, and enhancement update

The golang packages provide the Go programming language compiler. Security Fixes: golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-39821 os: golang: Go os.Root: Symlink following vulnerability allows directory traversal...

PT-2026-59243

Summary StrictRolePermission and AuthorityCreatorPermission in lemur/auth/permissions.py call flask principal.Permission. init with zero Needs when their config flags are unset. Both flags defaulted to False in code prior to the fix, so this was the state of any Lemur install that hadn't explicit...

PT-2026-59811

Impact If BCast::ToShape is given input larger than an int32, it will crash, despite being supposed to handle up to an int64. An example can be seen in tf.experimental.numpy.outer by passing in large input to the input b. python import tensorflow as tf value = tf.constantshape=2, 1024, 1024, 1024...

PT-2026-59018

A weakness has been identified in aiwaves-cn agents up to e8c4e3c2d19739d3dff59e577d1c97090cc15f59. Affected by this issue is the function recall relevant memories to working memory of the file core/cat/looking glass/stray cat.py of the component cheshire cat core. This manipulation causes resour...

PT-2026-60045

Impact DNSIncoming. decode labels at offset recurses once per DNS-name compression pointer RFC 1035 §4.1.4. Pointer cycles and label counts were capped, but the chain length of unique forward pointers was not. A single 3 kB mDNS packet carrying 1500 chained pointers drives the recursion past...

PT-2026-59760

Impact The function tf.raw ops.LookupTableImportV2 cannot handle scalars in the values parameter and gives an NPE. python import tensorflow as tf v = tf.Variable1 @tf.functionjit compile=True def test: func = tf.raw ops.LookupTableImportV2 para='table handle': v.handle,'keys': 62.98910140991211,...

PT-2026-59951

Impact The UnbatchGradOp function takes an argument id that is assumed to be a scalar. A nonscalar id can trigger a CHECK failure and crash the program. python import numpy as np import tensorflow as tf id is not scalar tf.raw ops.UnbatchGradoriginal input= tf.constant1,batch index=tf.constant0,0...

PT-2026-59931

Impact version:2.11.0 //core/ops/audio ops.cc:70 Status SpectrogramShapeFnInferenceContext c ShapeHandle input; TF RETURN IF ERRORc-WithRankc-input0, 2, &input; int32 t window size; TF RETURN IF ERRORc-GetAttr"window size", &window size; int32 t stride; TF RETURN IF ERRORc-GetAttr"stride", &strid...

Linux driver cb7210 module Heap Buffer Overflow DoS

The vulnerability of the drivers/staging/gpib/cb7210/cb7210.c module in the Linux operating system’s kernel is related to incorrect initialization. Exploiting this vulnerability can allow an attacker to cause a service failure...

MongoDB Hash Table DoS

The vulnerability of the Slot-Based Execution SBE hash table implementation in the MongoDB database management system is related to a mistake in releasing memory that has already been released. Exploiting this vulnerability can allow an attacker to cause service interruptions...

PT-2026-59859

Impact If QuantizedAdd is given min input or max input tensors of a nonzero rank, it results in a segfault that can be used to trigger a denial of service attack. python import tensorflow as tf Toutput = tf.qint32 x = tf.constant140, shape=1, dtype=tf.quint8 y = tf.constant26, shape=10,...

PT-2026-59571

Summary Type: Insecure Direct Object Reference. The issue CRUD endpoints GET / PATCH / DELETE /workspaces/workspace id/issues/issue id gate access on require workspace memberworkspace id only, then resolve issue id through IssueService.getissue id which is a primary-key lookup with no workspace...

PT-2026-59741

Impact When running with XLA, tf.raw ops.ParallelConcat segfaults with a nullptr dereference when given a parameter shape with rank that is not greater than zero. python import tensorflow as tf func = tf.raw ops.ParallelConcat para = 'shape': 0, 'values': 1 @tf.functionjit compile=True def test: ...

PT-2026-59488

Summary The PXR24 decompression function undo pxr24 impl in OpenEXR internal pxr24.c ignores the actual decompressed size outSize returned by exr uncompress buffer and instead reads from the scratch buffer based solely on the expected size uncompressed size derived from the header metadata...

PT-2026-59432

Summary A memory-safety vulnerability in Open Babel's Gaussian output parser allowed an out-of-bounds write when reading a crafted input file. Details The flaw was in the coords type orientation parser inside the Gaussian output reader. A malformed orientation block caused the parser to write pas...

PT-2026-59486

Summary The DWA lossy decoder constructs temporary per-component block pointers using signed 32-bit arithmetic. For a large enough width, the calculation overflows and later decoder stores operate on a wrapped pointer outside the allocated rowBlock backing store. This bug is reachable from the...

📄 Google Pixel 10 Codec3P VPU fw_debug_buf Use-After-Free / Privilege Escalation

C proof of concept and vulnerability write-up for CVE-2026-0125 affecting the Google Pixel 10 Codec3P VPU driver. The issue is a race condition involving the fwdebugbuf pointer in the VPU kernel driver. The issue was fixed in the June 2026 Pixel Security Bulletin. Issue description There are...