UBUNTU-CVE-2026-118651

Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExtractor is not configured. A remote client can therefore make upstream services receive a spoofed client address,...

CVE-2026-118651

Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExtractor is not configured. A remote client can therefore make upstream services receive a spoofed client address,...

PT-2026-132491

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the stdlib venv creator reads generated pyvenv.cfg with str.splitlines and merges parsed keys over virtualenv's selected configuration. An untrusted caller who influences the destination pathname can include...

Important: kernel6.12

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF in sock clone early bailouts CVE-2026-68399 In the Linux kernel, the following vulnerability has been resolved: smb: client: fix busy dentry warning on unmount after DIO CVE-2026-72315 In the Linux...

PT-2026-133254

Impact When the :preserve comments option is not enabled which is the default behavior, Crass discards CSS comments by recursively consuming the next token. An attacker who provides a stylesheet containing a very large number of adjacent comments can cause excessive recursion and trigger a...

PT-2026-133248

Impact When @sylphx/pdf-reader-mcp is run as an HTTP server MCP TRANSPORT=http, it reads the MCP API KEY environment variable and logs API key authentication enabled X-API-Key header at startup, but it never validated the X-API-Key header on incoming requests. The key was read into a variable and...

PT-2026-133239

Impact Crass recursively parses CSS simple blocks and functions without a depth guard. An attacker-controlled value containing many deeply nested blocks can recurse until Ruby raises SystemStackError: stack level too deep, or can cause excessive memory usage. Patches This is fixed in Crass 1.0.7,...

PT-2026-133242

Impact When parsing an input containing non-ASCII characters, inefficiencies in how Crass tracks the positions of multi-byte characters result in superlinear parsing time. An attacker-controlled input consisting of many non-ASCII characters could cause excessive CPU consumption and potentially...

PT-2026-132497

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, ViaTemplateActivator. generate removes an existing output only when Path.exists is true, allowing a dangling symlink to survive and redirect generated activation content, while PyEnvCfg.write opens pyvenv.cf...

PT-2026-132500

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the safe delete deletion error handler responds to a failed removal by reading mode bits with os.lstatpath and applying owner-write permission with os.chmodpath, ..., which follows a symlink. A planted link...

PT-2026-132504

virtualenv is a tool for creating isolated virtual python environments. From 20.26.6 until 21.14.2, ViaTemplateActivator.instantiate template replaces placeholders one key at a time across the complete activation template, so trigger names such as VIRTUAL NAME , VIRTUAL ENV , or VIRTUAL PROMPT...

PT-2026-132464

Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode while a later frame of the same dimensions changes the logical mode and decoder tiles to wider RGB or CMYK data. ImageFile.load prepare reuses the...

PT-2026-132469

Pillow is a Python imaging library. Prior to 13.0.0 on Windows, src/PIL/WmfImagePlugin.py passes unchecked 32-bit WMF or EMF dimensions to the native drawwmf handler in src/display.c. The handler sizes a DIB allocation from 16-bit-truncated bcWidth and bcHeight fields but copies pixel data using...

PT-2026-132462

Pillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.seek in src/PIL/SpiderImagePlugin.py reparses a later SPIDER stack frame and replaces self. size without rerunning Image. decompression bomb check. A tiny file can use a safe first frame to pass Image.open and then declare very...

PT-2026-132466

Pillow is a Python imaging library. Prior to 13.0.0, PILfont text-width accumulation in src/ imaging.c checks positive glyph advances against INT MAX but does not check negative advances against INT MIN. Repeating a signed 16-bit advance of -32768 can therefore execute a signed C integer overflow...

UBUNTU-CVE-2026-118754

Dolibarr ERP CRM before 24.0.2 contains a missing authorization vulnerability in htdocs/public/recruitment/view.php that allows unauthenticated attackers to view unpublished draft job positions. Attackers can enumerate sequential provisional references via the ref parameter to read titles,...

PT-2026-132495

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall. uninstall previous version accepts existing seed-package metadata and uninstall dist joins entries from top level.txt and RECORD to site-packages without checking containment. When a reused...

PT-2026-132413

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 0.9.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0, the repo-server evaluates .jsonnet files with an importer that does not confine import, importstr, or importbin to the repository root. Absolute paths, parent-directory...

PT-2026-132414

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.7.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0, Kustomize passes ref or version query values from remote resource, base, or component URLs to git fetch without an end-of-options separator. A leading-hyphen value can be...

PT-2026-132415

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.1.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0, when an operator has enabled --enable-helm for kustomize build, helmGlobals.configHome can point Helm's config and data directories at a repository-controlled location. Hel...