PT-2026-30806

Name of the Vulnerable Software and Affected Versions Rack::Session versions 2.0.0 through 2.1.1 Description Rack::Session is a session management implementation for Rack. Versions 2.0.0 through 2.1.1 incorrectly handle decryption failures when configured with secrets. If cookie decryption fails,...

PT-2026-31037

Name of the Vulnerable Software and Affected Versions OpenSSL versions 3.0 through 3.6 Description A NULL pointer dereference can occur during the processing of a delta CRL containing a Delta CRL Indicator extension if the required CRL Number extension is missing. This can lead to a denial of...

PT-2026-31024

Name of the Vulnerable Software and Affected Versions Flatpak versions prior to 1.16.4 Description Flatpak is a Linux application sandboxing and distribution framework. A flaw exists where the Flatpak portal accepts paths in the sandbox-expose options that can be app-controlled symlinks pointing ...

PT-2026-31032

Name of the Vulnerable Software and Affected Versions Emmett versions 2.5.0 through 2.8.0 Description Emmett, a full-stack Python web framework, contains a path traversal flaw in its RSGI static handler for internal assets / emmett paths. An attacker can use '../' sequences in requests, such as '...

kernel security update

6.12.0-124.49.1 - Add new Oracle Linux Driver Signing key 1 certificate Orabug: 37985782 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list...

PT-2026-31721

Name of the Vulnerable Software and Affected Versions wolfSSL versions prior to 5.9.1 Description Missing hash/digest size and Object Identifier OID checks allow digests smaller than allowed when verifying ECDSA certificates, or smaller than appropriate for the relevant key type, to be accepted b...

PT-2026-30795

The Popup Box WordPress plugin before 5.5.0 does not properly validate nonces in the add or edit popupbox function before saving popup data, allowing unauthenticated attackers to perform Cross-Site Request Forgery attacks. When an authenticated admin visits a malicious page, the attacker can crea...

PT-2026-31040

Name of the Vulnerable Software and Affected Versions OpenSSL affected versions not specified Description Converting an excessively large OCTET STRING value to a hexadecimal string leads to a heap buffer overflow on 32-bit platforms. This occurs when a crafted X.509 certificate contains an...

Masjesu Rising: The Commercial IoT Botnet Built for Stealth, DDoS, and IoT Evasion

Masjesu Rising: The Commercial IoT Botnet Built for Stealth, DDoS, and IoT Evasion By Mohideen Abdul Khader F · April 7, 2026 Botnet overview The Masjesu botnet, a sophisticated, commercially-run Internet of Things IoT threat, has been operational and evolving since early 2023, continuing into...

zeek:zeek-dns-fuzzer: Heap-buffer-overflow in zeek::String::String

Project: https://github.com/zeek/zeek.git Detailed Report: https://oss-fuzz.com/testcase?key=5864726512074752 Project: zeek Fuzzing Engine: libFuzzer Fuzz Target: zeek-dns-fuzzer Job Type: libfuzzerasanzeek Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x7a624a9fef33...

opencv:core_fuzzer: Incorrect-function-pointer-type in cv::split

Detailed Report: https://oss-fuzz.com/testcase?key=5816188348465152 Project: opencv Fuzzing Engine: libFuzzer Fuzz Target: corefuzzer Job Type: libfuzzerubsanopencv Platform Id: linux Crash Type: Incorrect-function-pointer-type Crash Address: Crash State: cv::split cv::split corefuzzer.cc...

openjph:ojph_expand_fuzz_target: Heap-buffer-overflow in ojph::local::resolution::finalize_alloc

Project: https://github.com/aous72/OpenJPH.git Detailed Report: https://oss-fuzz.com/testcase?key=5603613035790336 Project: openjph Fuzzing Engine: afl Fuzz Target: ojphexpandfuzztarget Job Type: aflasanopenjph Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 4 Crash Address:...

tidy-html5:tidy_general_fuzzer: Heap-use-after-free in prvTidyCleanGoogleDocument

Detailed Report: https://oss-fuzz.com/testcase?key=4761751731372032 Project: tidy-html5 Fuzzing Engine: libFuzzer Fuzz Target: tidygeneralfuzzer Job Type: libfuzzerasantidy-html5 Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x76e7f3ae03e8 Crash State:...

threetenbp:ThreetenbpFuzzer: Security exception in org.threeten.bp.format.DateTimeFormatterBuilder$CompositePrinterParser.parse

Detailed Report: https://oss-fuzz.com/testcase?key=4637310758223872 Project: threetenbp Fuzzing Engine: libFuzzer Fuzz Target: ThreetenbpFuzzer Job Type: libfuzzerasanthreetenbp Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

tidy-html5:tidy_general_fuzzer: Heap-use-after-free in prvTidyPPrintXMLTree

Detailed Report: https://oss-fuzz.com/testcase?key=6129312603635712 Project: tidy-html5 Fuzzing Engine: libFuzzer Fuzz Target: tidygeneralfuzzer Job Type: libfuzzerasantidy-html5 Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x7c6ec08e0aa8 Crash State:...

lucene:QueryParserFuzzer: Security exception in org.apache.lucene.analysis.tokenattributes.CharTermAttributeImpl.clone

Detailed Report: https://oss-fuzz.com/testcase?key=5762578633785344 Project: lucene Fuzzing Engine: libFuzzer Fuzz Target: QueryParserFuzzer Job Type: libfuzzerasanlucene Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

PT-2026-30767

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 1.5.113 Description PraisonAI's recipe registry publish endpoint is susceptible to a path traversal issue. Prior to version 1.5.113, the endpoint writes uploaded recipe bundles to a filesystem path derived from the...

PT-2026-30763

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 1.5.113 Description PraisonAI is susceptible to a path traversal issue due to a flaw in the validate path function. This function first calls os.path.normpath, which collapses '..' sequences, and then checks for the...

PT-2026-30656

Name of the Vulnerable Software and Affected Versions: Fedify versions prior to 1.9.6, 1.10.5, 2.0.8, and 2.1.1 Description: Fedify does not enforce a maximum redirect count or visited-URL loop detection when following HTTP redirects in its remote and authenticated document loaders. An attacker...

PT-2026-30724

Name of the Vulnerable Software and Affected Versions Discount versions 1.3.1.1 through 2.2.7.3 Description A signed length truncation bug causes an out-of-bounds read in the default Markdown parse path. Inputs larger than INT MAX are truncated to a signed int before entering the native parser,...