PT-2026-45657

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Memory corruption occurs when shared buffers are accessed without validating concurrent modifications to input from user-mode...

PT-2026-45486

Name of the Vulnerable Software and Affected Versions praisonai-platform versions prior to 0.1.4 Description A privilege escalation flaw exists in the PraisonAI Platform that allows any workspace member to grant owner-level privileges to arbitrary users. The issue stems from the POST...

Security update for apache-commons-lang3, apache-commons-text, apache-commons-configuration2, apache-commons-cli, apache-commons-io, apache-commons-codec (important)

openSUSE security update: security update for apache-commons-lang3, apache-commons-text, apache-commons-configuration2, apache-commons-cli, apache-commons-io, apache-commons-codec ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20841-1 Rating:...

PT-2026-45613

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A logic error in the fixInitiatingUserIfNecessary function of CallIntentProcessor.java allows for the possibility of making an emergency call. This issue can be...

PT-2026-45646

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Memory corruption occurs during the processing of fastboot commands when improperly formatted input is provided. Recommendations At the moment, there is no...

PT-2026-45642

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Memory corruption occurs during the processing of fastboot OEM commands. Recommendations At the moment, there is no information about a newer version that contai...

PT-2026-45493

Name of the Vulnerable Software and Affected Versions Nezha Monitoring versions 0.20.0 through 2.0.11 Description Authenticated agents can forge service-monitor results for services belonging to other users. The system accepts TaskResult messages from an authenticated agent based solely on whethe...

libbpf:bpf-object-fuzzer: Crash in btf__set_pointer_size

Detailed Report: https://oss-fuzz.com/testcase?key=6306551366483968 Project: libbpf Fuzzing Engine: libFuzzer Fuzz Target: bpf-object-fuzzer Job Type: libfuzzermsanlibbpf Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0xffffafff8688012c Crash State: btfsetpointersize bpfobjectinitbtf...

libbpf:bpf-object-fuzzer: Crash in btf_new

Detailed Report: https://oss-fuzz.com/testcase?key=4847158254960640 Project: libbpf Fuzzing Engine: libFuzzer Fuzz Target: bpf-object-fuzzer Job Type: libfuzzerasani386libbpf Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x01803244 Crash State: btfnew btfnew bpfobjectinitbtf Sanitize...

PT-2026-45373

Name of the Vulnerable Software and Affected Versions Apache ActiveMQ Broker versions prior to 5.19.7 Apache ActiveMQ Broker versions 6.0.0 through 6.2.5 Apache ActiveMQ All versions prior to 5.19.7 Apache ActiveMQ All versions 6.0.0 through 6.2.5 Apache ActiveMQ versions prior to 5.19.7 Apache...

Lightweight Music Server (LMS) 3.76.0 (metadata) Stored XSS

Summary LMS Lightweight Music Server: A specific C++ based project focused on a low memory footprint, featuring built-in user management and a recommendation engine. Description LMS stores media file metadata tags such as GENRE, ARTIST, and ALBUM exactly as written in the file and later renders...

binutils:fuzz_objdump_safe: Heap-buffer-overflow in parse_stab_array_type

Detailed Report: https://oss-fuzz.com/testcase?key=6591363465674752 Project: binutils Fuzzing Engine: honggfuzz Fuzz Target: fuzzobjdumpsafe Job Type: honggfuzzasanbinutils Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x7b85203e00f9 Crash State: parsestabarraytype...

gpac:fuzz_scene: Heap-use-after-free in lsr_restore_base

Project: https://github.com/gpac/gpac.git Detailed Report: https://oss-fuzz.com/testcase?key=4744197159845888 Project: gpac Fuzzing Engine: libFuzzer Fuzz Target: fuzzscene Job Type: libfuzzerasangpac Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x789a1a4ef8f0 Crash...

sentencepiece:trainer_fuzzer: Segv on unknown address in sentencepiece::unigram::Lattice::Viterbi

Detailed Report: https://oss-fuzz.com/testcase?key=5966429886414848 Project: sentencepiece Fuzzing Engine: afl Fuzz Target: trainerfuzzer Job Type: aflasansentencepiece Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: sentencepiece::unigram::Lattice::Viterbi void...

mupdf:pdf_fuzzer: Use-of-uninitialized-value in match_an_plus_b_microsyntax

Project: git://git.ghostscript.com/mupdf.git https://github.com/ArtifexSoftware/mupdf.git Detailed Report: https://oss-fuzz.com/testcase?key=5925882173915136 Project: mupdf Fuzzing Engine: libFuzzer Fuzz Target: pdffuzzer Job Type: libfuzzermsanmupdf Platform Id: linux Crash Type:...

PT-2026-45077

Name of the Vulnerable Software and Affected Versions Traccar Client versions prior to 9.7.20 Description The application registers a custom org.traccar.client://config deep-link scheme that allows the silent modification of persistent configuration settings without user confirmation or...

Linux Distros Unpatched Vulnerability : CVE-2026-47762

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability via forged mce:protected comments. Allows...

GHSA-6H6V-6M7W-7VXX PraisonAI Platform workspace-scoped routes allow cross-workspace object access by global object ID

Summary PraisonAI Platform's workspace-scoped REST routes contain a systemic object-level authorization flaw that allows an authenticated user from one workspace to access, modify, and delete objects belonging to another workspace by supplying the victim object's global UUID. The affected pattern...

PraisonAI Platform workspace-scoped routes allow cross-workspace object access by global object ID

Summary PraisonAI Platform's workspace-scoped REST routes contain a systemic object-level authorization flaw that allows an authenticated user from one workspace to access, modify, and delete objects belonging to another workspace by supplying the victim object's global UUID. The affected pattern...

PraisonAI Platform has a cross-workspace IDOR + member-role privilege escalation

Summary The Platform server exposes resources under /api/v1/workspaces/workspaceid/... and protects them with a requireworkspacememberworkspaceid FastAPI dependency. The dependency only checks that the caller is a member of the workspaceid in the URL prefix. The route handlers then look up the...