CVE-2026-80353

Time-of-check time-of-use TOCTOU race condition vulnerability in Apa...

CVE-2026-114138

Django REST framework is a toolkit for building Web APIs. Prior to 3.1...

PT-2026-122135

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.08 to before version 26.05, the IIIF Auth 2.0 endpoints auth/login and auth/token in AuthorizationFlowResource accept an origin query parameter without validation and then 1 embe...

UBUNTU-CVE-2026-105959

A flaw was found in spice-server. The GLZ encoder dictionary restore p...

UBUNTU-CVE-2026-80353

Time-of-check time-of-use TOCTOU race condition vulnerability in Apa...

PT-2026-122441

Summary An incomplete header-value validation CWE-444 in the Twisted HTTP server lets a bare carriage return or line feed in a header value hide a following header from the parser. twisted.web.http.HTTPChannel.headerReceived rejects a NUL byte in a header value but not a bare CR or LF, even thoug...

PT-2026-121893

In the Linux kernel, the following vulnerability has been resolved: ovl: fix UAF in ovl do mkdir debug print ovl do mkdir prints the input dentry with %pd after vfs mkdir. Since commit fe497f0759e0 "VFS: change vfs mkdir to unlock on failure.", vfs mkdir calls end creating on the input dentry on...

PT-2026-122433

Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires opening a file with large/wrong upper limits in the xref table. Patches This has been fixed in pypdf==6.21.2. Workarounds If you cannot upgrade yet, consider applying the changes from PR 423...

PT-2026-122459

On Windows, ReadWriteLock and AsyncReadWriteLock the SQLite-backed reader/writer lock connect SQLite to the lock database by its path, in every directory. SQLite derives three side files from that path: -journal, the rollback journal pages saved to undo an interrupted write; -wal, the write-ahead...

PT-2026-122199

Fallow is a codebase intelligence tool for TypeScript and JavaScript. From 2.68.0 until 3.34.0, Fallow follows attacker-controlled Jest projects paths outside the project root through absolute paths, parent segments, dot-prefixed wildcard globs, or symlinks. In version 3.33.1, the same behavior...

CVE-2026-101356

Incorrect object recycling and re-use vulnerability in Apache Tomcat a...

CVE-2026-101296

A missing critical step in authentication vulnerability in Apache Tomc...

PT-2026-122458

On Windows the soft locks SoftFileLock, MarkerSoftFileLock, SoftFileLease, their async forms, and a FileLock that fell back to a soft lock read their marker by path. The marker is the lock file whose presence says a process holds the lock. Each acquire attempt that finds a marker opens it with...

Linux Distros Unpatched Vulnerability : CVE-2026-99081

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bnxten: fix DMA mapping length for padded small packets Stefan Fleischmann reported Intel IOMMU DMA Read faults on BCM57412 NetXtreme-E NICs when transmitting...

Linux Distros Unpatched Vulnerability : CVE-2026-99071

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv4: do not warn on route notification size race Commit 680aea08e78c net: ipv4: Emit notification when fib hardware flags are changed added asynchronous route...

Linux Distros Unpatched Vulnerability : CVE-2026-99036

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dm: fix reading free memory in doresume When doresume calls dmtablegetmodenewmap, the call is done without holding any locks it only holds a reference to the md...

CVE-2026-96424

Incorrect DBus policy for lomiri-upload-manager part of lomiri-downlo...

CVE-2026-74048

Not Failing Securely Failing Open vulnerability in Apache Tomcat...

Cisco IOS XR Software for ASR 9000 Series Routers IPv4 Unicast Packets DoS (cisco-sa-asr9k-tUyxcyXN)

According to its self-reported version, Cisco IOS XR is affected by a vulnerability. - A vulnerability in the IPv4 packet processing functionality of Cisco IOS XR Software that affects Cisco ASR 9000 and 9900 Series Aggregation Services Routers as well as Cisco ASR 9902 and 9903 Compact...

Linux Distros Unpatched Vulnerability : CVE-2026-99082

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: x86: Use active memslots for the per-vCPU MMIO cache KVM tags the per-vCPU MMIO cache with a memslot generation so that a memslot update invalidates cached...