PT-2026-70575

Name of the Vulnerable Software and Affected Versions Windows DNS affected versions not specified Description A stack-based buffer overflow in Windows DNS allows an unauthorized attacker to execute arbitrary code over a network, which can affect the system. A stack-based buffer overflow occurs wh...

PT-2026-70738

Name of the Vulnerable Software and Affected Versions Windows Package Manager affected versions not specified Description Improper privilege management allows an authorized attacker to elevate privileges locally. Recommendations At the moment, there is no information about a newer version that...

PT-2026-70824

Name of the Vulnerable Software and Affected Versions Adobe Commerce affected versions not specified Magento Open Source affected versions not specified Description An incorrect authorization issue allows unauthenticated remote attackers to bypass authentication controls and hijack customer...

PT-2026-70920

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.137 Description A use-after-free issue exists in the TabStrip component of Google Chrome on Mac. This occurs when a remote attacker, having already compromised the renderer process, uses a specially...

PT-2026-70220

Name of the Vulnerable Software and Affected Versions SeaweedFS versions prior to 4.24 Description The filer registers the SeaweedIdentityAccessManagement gRPC service without requiring authentication when the jwt.filer signing.key is unset. This allows any client with access to the filer gRPC po...

postgis:gserialized_from_bytea_fuzzer: Crash in gserialized2_from_lwgeom_any

Project: https://git.osgeo.org/gitea/postgis/postgis.git Detailed Report: https://oss-fuzz.com/testcase?key=5672880541859840 Project: postgis Fuzzing Engine: libFuzzer Fuzz Target: gserializedfrombyteafuzzer Job Type: libfuzzerubsanpostgis Platform Id: linux Crash Type: UNKNOWN READ Crash Address...

postgis:gserialized_from_bytea_fuzzer: Crash in ptarray_calculate_gbox_cartesian

Project: https://git.osgeo.org/gitea/postgis/postgis.git Detailed Report: https://oss-fuzz.com/testcase?key=5607611131822080 Project: postgis Fuzzing Engine: libFuzzer Fuzz Target: gserializedfrombyteafuzzer Job Type: libfuzzerubsanpostgis Platform Id: linux Crash Type: UNKNOWN READ Crash Address...

ntopng:fuzz_dissect_packet: Heap-buffer-overflow in NetworkInterface::processPacket

Project: https://github.com/ntop/ntopng.git Detailed Report: https://oss-fuzz.com/testcase?key=5555893120073728 Project: ntopng Fuzzing Engine: afl Fuzz Target: fuzzdissectpacket Job Type: aflasanntopng Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address: 0x76619133257c Crash...

postgis:gserialized_from_bytea_fuzzer: Crash in gserialized1_validate_geometry_buffer

Project: https://git.osgeo.org/gitea/postgis/postgis.git Detailed Report: https://oss-fuzz.com/testcase?key=5145183210242048 Project: postgis Fuzzing Engine: libFuzzer Fuzz Target: gserializedfrombyteafuzzer Job Type: libfuzzerubsanpostgis Platform Id: linux Crash Type: UNKNOWN READ Crash Address...

zxc:zxc_fuzzer_decompress: Global-buffer-overflow in zxc_decompress_chunk_wrapper_default

Project: https://github.com/hellobertrand/zxc.git Detailed Report: https://oss-fuzz.com/testcase?key=5141221035802624 Project: zxc Fuzzing Engine: afl Fuzz Target: zxcfuzzerdecompress Job Type: aflasanzxc Platform Id: linux Crash Type: Global-buffer-overflow READ 16 Crash Address: 0x5769f10dc90c...

postgis:gserialized_from_bytea_fuzzer: Heap-buffer-overflow in gserialized2_validate_nurbs

Project: https://git.osgeo.org/gitea/postgis/postgis.git Detailed Report: https://oss-fuzz.com/testcase?key=5123821921959936 Project: postgis Fuzzing Engine: libFuzzer Fuzz Target: gserializedfrombyteafuzzer Job Type: libfuzzerasanpostgis Platform Id: linux Crash Type: Heap-buffer-overflow READ 8...

ogre:script_fuzz: Heap-buffer-overflow in Ogre::ScriptParser::parse

Project: https://github.com/OGRECave/ogre.git Detailed Report: https://oss-fuzz.com/testcase?key=4932602193313792 Project: ogre Fuzzing Engine: honggfuzz Fuzz Target: scriptfuzz Job Type: honggfuzzasanogre Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x74a4903e3098...

CVE-2026-72731

Discourse is an open-source discussion platform. From 2026.1.0-latest until 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, anyone able to run a parameterized Data Explorer query, including non-staff members of a group a query is shared with, could craft parameter values that escaped the...

CVE-2026-72731 Discourse: Strip SQL comments and use non-recursive parameter interpolation in Data Explorer

Discourse is an open-source discussion platform. From 2026.1.0-latest until 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, anyone able to run a parameterized Data Explorer query, including non-staff members of a group a query is shared with, could craft parameter values that escaped the...

EUVD-2026-55671

Discourse is an open-source discussion platform. From 2026.1.0-latest until 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, anyone able to run a parameterized Data Explorer query, including non-staff members of a group a query is shared with, could craft parameter values that escaped the...

CVE-2026-72731

Discourse is an open-source discussion platform. From 2026.1.0-latest until 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, anyone able to run a parameterized Data Explorer query, including non-staff members of a group a query is shared with, could craft parameter values that escaped the...

CVE-2026-72731

Discourse vulnerability CVE-2026-72731 affects 2026.1.0-latest through 2026.8.0-latest.1, including the Data Explorer query path and plugin data_explorer code, where parameterized Data Explorer queries could be crafted to escape the intended query via non-recursive and recursive parameter interpo...

CVE-2026-72731 Discourse: Strip SQL comments and use non-recursive parameter interpolation in Data Explorer

Discourse is an open-source discussion platform. From 2026.1.0-latest until 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, anyone able to run a parameterized Data Explorer query, including non-staff members of a group a query is shared with, could craft parameter values that escaped the...

CVE-2026-72731 Discourse: Strip SQL comments and use non-recursive parameter interpolation in Data Explorer

Discourse is an open-source discussion platform. From 2026.1.0-latest until 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, anyone able to run a parameterized Data Explorer query, including non-staff members of a group a query is shared with, could craft parameter values that escaped the...

AWS CLI: Disabled SSH host key verification in Amazon AWS CLI EMR helper commands

SummaryThe AWS Command Line Interface AWS CLI is a unified tool to manage AWS services from the command line. An issue exists where the EMR SSH helper commands aws emr ssh, aws emr socks, aws emr put, aws emr get passed StrictHostKeyChecking=no to the underlying SSH client, disabling host key...