PT-2026-122210

Zephyr's OpenThread integration defined CONFIG OPENTHREAD JOINER PSKD with default "J01NME" in modules/openthread/Kconfig.thread previously subsys/net/l2/openthread/Kconfig, then subsys/net/l2/openthread/Kconfig.thread. J01NME is the example Joining Device Credential used throughout the public...

PT-2026-122204

Name of the Vulnerable Software and Affected Versions pypdf versions prior to 6.21.2 Description An attacker can craft a PDF file that repeatedly references the same nonexistent indirect object. When accessed, this causes relevant file parts, such as pages, to trigger repeated full-file recovery...

PT-2026-122199

Fallow is a codebase intelligence tool for TypeScript and JavaScript. From 2.68.0 until 3.34.0, Fallow follows attacker-controlled Jest projects paths outside the project root through absolute paths, parent segments, dot-prefixed wildcard globs, or symlinks. In version 3.33.1, the same behavior...

UBUNTU-CVE-2026-113730

OGNL is an Object Graph Navigation Library for Java. Prior to 3.4.13,...

CVE-2026-113730

OGNL is an Object Graph Navigation Library for Java. Prior to 3.4.13,...

UBUNTU-CVE-2026-101296

A missing critical step in authentication vulnerability in Apache Tomc...

CVE-2026-101296

A missing critical step in authentication vulnerability in Apache Tomc...

UBUNTU-CVE-2026-101356

Incorrect object recycling and re-use vulnerability in Apache Tomcat a...

CVE-2026-101356

Incorrect object recycling and re-use vulnerability in Apache Tomcat a...

UBUNTU-CVE-2026-114138

Django REST framework is a toolkit for building Web APIs. Prior to 3.1...

CVE-2026-114137

Django REST framework is a toolkit for building Web APIs. From 3.12.0...

UBUNTU-CVE-2026-114137

Django REST framework is a toolkit for building Web APIs. From 3.12.0...

CVE-2026-114136

Django REST framework is a toolkit for building Web APIs. From 3.6.4 u...

UBUNTU-CVE-2026-114136

Django REST framework is a toolkit for building Web APIs. From 3.6.4 u...

UBUNTU-CVE-2026-114135

Jupyter Server is the backend for Jupyter web applications. From 2.0.0...

CVE-2026-114038

A flaw was found in device-mapper-multipath. A local user can trigger...

PT-2026-122125

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, when a password reset link is visited, the application generates a replacement password in a predictable way and emails it to the account holder. The insufficient entropy...

PT-2026-122124

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the password reset token is predictably based on the time of the reset request. An attacker who knows the target's email address can request a reset and then brute-force...

PT-2026-122127

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, ExternalFilesDownloader.getFilename extracts the destination filename from a server-supplied Content-Disposition response header and passes it directl...

PT-2026-122126

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, the DownloadTaskEndpoint WebSocket endpoint /tasks/download/monitor.socket in goobi-viewer-core accepts download requests from unauthenticated users...