654775 matches found
OESA-2026-4628 aspell security update
GNU Aspell is a spell checker intended to replace Ispell. It can be used as a library and spell checker. Its main feature is that it provides much better suggestions than other inspectors, including Ispell and Microsoft Word. It also has many other technical enhancements to Ispell, such as the us...
OESA-2026-4622 libgit2 security update
libgit2 is a portable, pure C implementation of the Git core methods provided as a re-entrant linkable library with a solid API, allowing you to write native speed custom Git applications in any language which supports C bindings. Security Fixes: libgit2 versions before 1.8.7 and 1.9.0 before 1.9...
OESA-2026-4623 libgit2 security update
libgit2 is a portable, pure C implementation of the Git core methods provided as a re-entrant linkable library with a solid API, allowing you to write native speed custom Git applications in any language which supports C bindings. Security Fixes: libgit2 versions before 1.8.7 and 1.9.0 before 1.9...
OESA-2026-4621 libgit2 security update
libgit2 is a portable, pure C implementation of the Git core methods provided as a re-entrant linkable library with a solid API, allowing you to write native speed custom Git applications in any language which supports C bindings. Security Fixes: libgit2 versions before 1.8.7 and 1.9.0 before 1.9...
OESA-2026-4596 mariadb security update
MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon mariadbd and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs a...
OESA-2026-4557 eog security update
EOG is an application used for viewing and cataloging image files on the GNOME Desktop.It has basic editing capabilites. Security Fixes: A flaw was found in Eye of GNOME eog. A heap-based buffer overflow exists in the PNG metadata reader due to improper state handling when parsing split metadata...
OESA-2026-4555 eog security update
EOG is an application used for viewing and cataloging image files on the GNOME Desktop.It has basic editing capabilites. Security Fixes: A flaw was found in Eye of GNOME eog. A heap-based buffer overflow exists in the PNG metadata reader due to improper state handling when parsing split metadata...
OESA-2026-4556 eog security update
EOG is an application used for viewing and cataloging image files on the GNOME Desktop.It has basic editing capabilites. Security Fixes: A flaw was found in Eye of GNOME eog. A heap-based buffer overflow exists in the PNG metadata reader due to improper state handling when parsing split metadata...
OESA-2026-4554 eog security update
EOG is an application used for viewing and cataloging image files on the GNOME Desktop.It has basic editing capabilites. Security Fixes: A flaw was found in Eye of GNOME eog. A heap-based buffer overflow exists in the PNG metadata reader due to improper state handling when parsing split metadata...
OESA-2026-4546 nginx security update
NGINX is a free, open-source, high-performance HTTP server and reverse proxy, as well as an IMAP/POP3 proxy server. Security Fixes: A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return...
OESA-2026-4544 nginx security update
NGINX is a free, open-source, high-performance HTTP server and reverse proxy, as well as an IMAP/POP3 proxy server. Security Fixes: A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return...
OESA-2026-4545 nginx security update
NGINX is a free, open-source, high-performance HTTP server and reverse proxy, as well as an IMAP/POP3 proxy server. Security Fixes: A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return...
OESA-2026-4543 nginx security update
NGINX is a free, open-source, high-performance HTTP server and reverse proxy, as well as an IMAP/POP3 proxy server. Security Fixes: A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return...
OESA-2026-4542 brotli security update
Brotli is a generic-purpose lossless compression algorithm that compresses data using a combination of a modern variant of the LZ77 algorithm, Huffman coding and 2nd order context modeling, with a compression ratio comparable to the best currently available general-purpose compression methods. It...
BIT-VIRTUALENV-2026-113776 virtualenv activation scripts run code from a path that contains a placeholder name
virtualenv is a tool for creating isolated virtual python environments. From 20.26.6 until 21.14.2, ViaTemplateActivator.instantiatetemplate replaces placeholders one key at a time across the complete activation template, so trigger names such as VIRTUALNAME, VIRTUALENV, or VIRTUALPROMPT inside a...
BIT-VIRTUALENV-2026-113723 virtualenv: Bash prompt values can change meaning under older compatibility modes
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and dr...
BIT-VIRTUALENV-2026-113720 virtualenv: Seeded files retain permissions from an older cache
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the app-data copy seeder uses shutil.copy to copy cached package files into later environments, causing cached source modes to override the current run's umask. A cache populated under a permissive umask can...
BIT-VIRTUALENV-2026-113718 virtualenv: Xonsh activation literals depend on the script decoding codec
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, POSIX xonsh activation quote uses repr to write printable non-ASCII prompt or destination data into UTF-8 activate.xsh, while xonsh can read that script using $XONSHENCODING. Under a legacy multibyte codec...
BIT-PILLOW-2026-96778 Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer
Pillow is a Python imaging library. From 9.4.0 until 13.0.0, ImagingJpegEncode in src/libImaging/JpegEncode.c can call jpegwritemarker for a JPEG COM comment when an ICC profile has exactly filled the 65536-byte encoder buffer. libjpeg writes one byte before checking the exhausted freeinbuffer...
Advisory ROSA-SA-2026-3317
There are 20 vulnerabilities in Apache httpd, including a buffer overflow in modvhostalias CVE-2026-63292, which could potentially allow remote code execution by sending an HTTP request containing a large Host header. The vulnerability occurs when a host substitution parameter is specified in the...