pillow: Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO

A flaw was found in Pillow. When saving compressed Tagged Image File Format TIFF images into memory buffers rather than direct files, the library incorrectly calculates the required memory allocation. A remote attacker who supplies a crafted image for processing can trigger a heap-based buffer...

GitPython: GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() Refspec

A flaw was found in GitPython. This vulnerability allows an attacker to achieve arbitrary code execution on the host system. The issue occurs because the Remote.pull function inspects only keyword arguments for unsafe command options and fails to validate positional repository reference...

Critical: Red Hat Security Advisory: Satellite 6.19 security update

A security update for Red Hat Satellite is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links ...

CVE-2021-31166

CVE-2021-31166: HTTP Protocol Stack Remote Code Execution Vulnerability This is a proof of concept for CVE-2021-31166 "HTTP Protocol Stack Remote Code Execution Vulnerability", a use-after-free dereference in http.sys patched by Microsoft in May 2021. According to this tweet the vulnerability has...

Important: Red Hat Security Advisory: libXrender security update

An update for libXrender is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

libXrender: libXrender: Code injection via heap overflow in RenderQueryPictFormats

A flaw was found in libXrender. Malicious X servers can exploit a heap overflow vulnerability in the RenderQueryPictFormats function. This allows them to inject arbitrary code into connected X clients, potentially leading to unauthorized control over the client's system...

Malicious code in bq-helix-recon-6ade983e (PyPI)

Source: kam193 9663aaa7e713f47d83da712da5653aa7d3e1919fd70419d9fc5749145f575b17 Package places PTH/sitecustomize files triggering execution of malicious code on every Python startup. The code then collects information from the environment, including credential files, environment variables, data...

DevAudit

Note : DevAudit uses the OSS Index database, which has some rate limiting. If you notice you are hitting the limit please raise an issue. Authenticated users get a higher limit, and we am implementing authentication into DevAudit soon. Most non-authenticated users probably won't notice the limit...

CVE-2026-61707 SOCFortress CoPilot: Stored case-report template injection permits backend code execution

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, in the reported deployment, case-report templates uploaded by customeruser, the lowest-privilege portal role, are later executed by non-sandboxed Jinja2 engines when an admin o...

CVE-2026-61707 SOCFortress CoPilot: Stored case-report template injection permits backend code execution

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, in the reported deployment, case-report templates uploaded by customeruser, the lowest-privilege portal role, are later executed by non-sandboxed Jinja2 engines when an admin o...

CVE-2026-61707

SOCFortress CoPilot versions prior to 0.1.76 are vulnerable to stored case-report template injection . The /case-report-template/upload route fails to validate template content, allowing a customer_user to upload and replace legitimate templates in a shared global store. When an admin or analyst ...

CVE-2026-61707 SOCFortress CoPilot: Stored case-report template injection permits backend code execution

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, in the reported deployment, case-report templates uploaded by customeruser, the lowest-privilege portal role, are later executed by non-sandboxed Jinja2 engines when an admin o...

libX11: libX11: Heap-based buffer overflow via malicious X server

A flaw was found in libX11. A heap-based buffer overflow vulnerability exists during the handling of XkbGetMap replies. A remote attacker, by operating a malicious X server, could exploit this flaw to potentially execute arbitrary code or cause a denial of service on the client system. User...

CVE-2026-61645 Docat has Arbitrary File Upload exists in Upload API

Docat is a tool for hosting versioned static documentation. In the affected implementation, an arbitrary file upload vulnerability in the Upload API arises because the API does not validate the uploaded file path or type. An attacker can overwrite sensitive configuration files or place malicious...

CVE-2026-61645

The Docat documentation hosting tool contains an arbitrary file upload vulnerability in its Upload API. The root cause is a lack of validation for the uploaded file path or type . An attacker can exploit this to overwrite sensitive configuration files or deposit malicious files on the web server....

CVE-2026-61645 Docat has Arbitrary File Upload exists in Upload API

Docat is a tool for hosting versioned static documentation. In the affected implementation, an arbitrary file upload vulnerability in the Upload API arises because the API does not validate the uploaded file path or type. An attacker can overwrite sensitive configuration files or place malicious...

CVE-2026-61645 Docat has Arbitrary File Upload exists in Upload API

Docat is a tool for hosting versioned static documentation. In the affected implementation, an arbitrary file upload vulnerability in the Upload API arises because the API does not validate the uploaded file path or type. An attacker can overwrite sensitive configuration files or place malicious...

CVE-2026-3288

CVE-2026-3288: ingress-nginx Configuration Injection via rewrite-target Annotation Keywords: CVE-2026-3288, ingress-nginx vulnerability, Kubernetes security, nginx configuration injection, rewrite-target annotation, RCE, Secret disclosure, CWE-20, CAPEC-176, ingress-nginx CVE 2026, Kubernetes...

droid-hunter

.---. .----------- / \ / ------ / / \ / ----- ╔╦╗╦═╗╔═╗╦╔╦╗ ╦ ╦╦ ╦╔╗╔╔╦╗╔═╗╦═╗ ////// ' / --- ║║╠╦╝║ ║║ ║║───╠═╣║ ║║║║ ║ ║╣ ╠╦╝ //// / // : : --- ═╩╝╩╚═╚═╝╩═╩╝ ╩ ╩╚═╝╝╚╝ ╩ ╚═╝╩╚═ // / / / '-- By HaHwul // //..\ www.hahwul.com ====UU====UU==== https://github.com/hahwul/droid-hunter '//||\ ''...

CVE-2026-92092

A flaw was found in openshift-ansible. The installer container's run script downloads and executes remote inventory and dynamic scripts without integrity verification. A remote attacker, by performing a Man-in-the-Middle MITM attack or compromising the HTTP server providing these scripts, could...