Traefik: HTTP/2 frames can cause a running server to panic

Summary More Details: - https://nvd.nist.gov/vuln/detail/CVE-2026-27141 - https://pkg.go.dev/golang.org/x/net/http2?tab=versions Patches - https://github.com/traefik/traefik/releases/tag/v3.6.10 - https://github.com/traefik/traefik/releases/tag/v2.11.40 For more information If you have any...

GHSA-4HJQ-9H5C-252J Traefik: HTTP/2 frames can cause a running server to panic

Summary More Details: - https://nvd.nist.gov/vuln/detail/CVE-2026-27141 - https://pkg.go.dev/golang.org/x/net/http2?tab=versions Patches - https://github.com/traefik/traefik/releases/tag/v3.6.10 - https://github.com/traefik/traefik/releases/tag/v2.11.40 For more information If you have any...

ffmpeg:ffmpeg_BSF_EXTRACT_EXTRADATA_fuzzer: Heap-buffer-overflow in extract_extradata_filter

Project: https://git.ffmpeg.org/ffmpeg.git https://github.com/FFmpeg/FFmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5705993148497920 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegBSFEXTRACTEXTRADATAfuzzer Job Type: libfuzzerasani386ffmpeg Platform Id: linux Crash Typ...

wamr:wamr_fuzz_llvm_jit: Null-dereference READ in wasm_runtime_invoke_native

Project: https://github.com/bytecodealliance/wasm-micro-runtime.git Detailed Report: https://oss-fuzz.com/testcase?key=4776431766011904 Project: wamr Fuzzing Engine: libFuzzer Fuzz Target: wamrfuzzllvmjit Job Type: libfuzzerasanwamr Platform Id: linux Crash Type: Null-dereference READ Crash...

harfbuzz:hb-raster-fuzzer: Use-of-uninitialized-value in OT::COLR::paint_glyph

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=4659742604853248 Project: harfbuzz Fuzzing Engine: libFuzzer Fuzz Target: hb-raster-fuzzer Job Type: libfuzzermsanharfbuzz Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

PT-2026-25006

Name of the Vulnerable Software and Affected Versions Veeam Backup and Recovery affected versions not specified Description A flaw exists that allows a Backup Viewer to execute code remotely as the postgres user. This issue has a CVSS score of 10.0 and is considered critical. The vulnerability...

PT-2026-24952

Name of the Vulnerable Software and Affected Versions Veeam Backup & Replication affected versions not specified Description The software contains a flaw that allows an authenticated domain user to perform remote code execution RCE on the Backup Server. This could lead to compromise of backup...

PT-2026-25057

Name of the Vulnerable Software and Affected Versions Graphiti versions prior to 0.28.2 Description Graphiti, a framework for building and querying temporal context graphs for AI agents, had a Cypher injection issue in shared search-filter construction for non-Kuzu backends. Attacker-controlled...

PT-2026-25042

ZeptoClaw is a personal AI assistant. Prior to 0.7.6, the generic webhook channel trusts caller-supplied identity fields sender, chat id from the request body and applies authorization checks to those untrusted values. Because authentication is optional and defaults to disabled auth token: None, ...

PT-2026-25012

Summary The TinaCMS CLI dev server combines a permissive CORS configuration Access-Control-Allow-Origin: with the path traversal vulnerability previously reported to enable a browser-based drive-by attack. A remote attacker can enumerate the filesystem, write arbitrary files, and delete arbitrary...

PT-2026-25013

Tina is a headless content management system. Prior to 2.1.8, the TinaCMS CLI development server exposes media endpoints that are vulnerable to path traversal, allowing attackers to read and write arbitrary files on the filesystem outside the intended media directory. When running tinacms dev, th...

PT-2026-24955

Name of the Vulnerable Software and Affected Versions Veeam Backup and Replication affected versions not specified Description The software contains a flaw that allows a user with domain access to execute code remotely on the Backup Server. The issue enables remote code execution RCE...

PT-2026-24953

CVE: CVE-2026-21667 PT-Identifier: PT-2026-24953 Vendor: Veeam Product: Backup and Replication CVSS: 10.0 Credits: n/a Description: A vulnerability allowing an authenticated domain user to perform remote code execution RCE on the Backup Server. References: • https://t.co/jp2KMmocwj •...

PT-2026-24950

Name of the Vulnerable Software and Affected Versions Microsoft 365 Copilot affected versions not specified Description An AI command injection issue exists in Microsoft 365 Copilot, potentially allowing an unauthorized attacker to disclose information over a network. This issue is related to...

PT-2026-25083

Summary In affected versions of openclaw, browser-originated WebSocket connections could bypass origin validation when gateway.auth.mode was set to trusted-proxy and the request arrived with proxy headers. A page served from an untrusted origin could connect through a trusted reverse proxy, inher...

PT-2026-25043

CVE-2026-32232 ZeptoClaw is a personal AI assistant. Prior to 0.7.6, there is a Dangling Symlink Component Bypass, TOCTOU Between Validation and Use, and Hardlink Alias Bypass. This… https://t.co/rVG7NT7AHt...

libpng:libpng_colormap_fuzzer: Use-of-uninitialized-value in png_image_read_background

Detailed Report: https://oss-fuzz.com/testcase?key=6440452420337664 Project: libpng Fuzzing Engine: libFuzzer Fuzz Target: libpngcolormapfuzzer Job Type: libfuzzermsanlibpng Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: pngimagereadbackground...

u-boot:fuzz_fit_image_load: Heap-buffer-overflow in fdt_check_full

Detailed Report: https://oss-fuzz.com/testcase?key=5208350320295936 Project: u-boot Fuzzing Engine: libFuzzer Fuzz Target: fuzzfitimageload Job Type: libfuzzerasanu-boot Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address: 0x7898b90e750c Crash State: fdtcheckfull fitcheckform...

u-boot:fuzz_image_decomp: Heap-buffer-overflow in lzmaBuffToBuffDecompress

Detailed Report: https://oss-fuzz.com/testcase?key=5019466785423360 Project: u-boot Fuzzing Engine: libFuzzer Fuzz Target: fuzzimagedecomp Job Type: libfuzzerasanu-boot Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x7726fc3e00b6 Crash State: lzmaBuffToBuffDecompress...

Contagious Interview: Malware delivered through fake developer job interviews

Microsoft Defender Experts has observed the Contagious Interview campaign, a sophisticated social engineering operation active since at least December 2022. Microsoft continues to detect activity associated with this campaign in recent customer environments, targeting software developers at...