PT-2026-132499

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and dr...

UBUNTU-CVE-2026-118654

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static file handlers can normalize dot segments after route matching and serve a file through a public static route even though the corresponding direct path is protected by route-level middleware. An unauthenticated attacker can read...

UBUNTU-CVE-2026-118658

Echo is a Go web framework. Prior to 4.15.2 and 5.1.1, Context.Scheme returns values from X-Forwarded-Proto, X-Forwarded-Protocol, or X-Url-Scheme without validating that they are supported web schemes. WWWRedirect and NonWWWRedirect use that value to construct a Location header, so an attacker...

PT-2026-132439

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.12.0 until 3.17.0, the scorer invoke, register, and GenAI evaluate endpoints, including unauthenticated POST /ajax-api/3.0/mlflow/scorer/invoke, accept serialized third-party...

PT-2026-132348

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the volume artifact handler for GET /artifacts/get?source=volume did not confine a caller-supplied file path to the selected volume. A caller who can reach the route and identify a...

UBUNTU-CVE-2026-116078

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a request body sent as many 1-byte DATA frames. doreaddata/5 in lib/bandit/http2/stream.ex keeps every DATA...

CVE-2026-118263

Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's BodyDump middleware can discard a BodyLimit overflow error for an unknown-length request when BodyDump's capture limit is below the BodyLimit threshold. BodyDump drains the remaining body while ignoring read errors and replaces it with...

VMware ESX Code Execution

The vulnerability in the VMware ESX hypervisor is related to security configuration errors. Exploitation of this vulnerability may allow a remote attacker to execute arbitrary code...

UBUNTU-CVE-2026-118651

Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExtractor is not configured. A remote client can therefore make upstream services receive a spoofed client address,...

PT-2026-132491

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the stdlib venv creator reads generated pyvenv.cfg with str.splitlines and merges parsed keys over virtualenv's selected configuration. An untrusted caller who influences the destination pathname can include...

Important: kernel6.12

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF in sock clone early bailouts CVE-2026-68399 In the Linux kernel, the following vulnerability has been resolved: smb: client: fix busy dentry warning on unmount after DIO CVE-2026-72315 In the Linux...

PT-2026-132127

lwIP 2.0.0 through 2.2.1 built with the SNMP agent contains an out-of-bounds read vulnerability in snmp pbuf stream writeto that bounds copies by pbuf-len instead of remaining bytes. Remote unauthenticated attackers knowing the read community can send fragmented SNMP requests to receive adjacent...

PT-2026-132347

KeePassXC is a cross-platform community-driven port of the Windows application KeePass Password Safe. From 2.3.0 until 2.8.0, KeePassXC browser integration encrypts authorized responses in src/browser/BrowserMessageBuilder.cpp using a fixed 1 MiB output vector even though Botan::Sodium::crypto bo...

PT-2026-132404

Botan is a C++ cryptography library. From 1.11.22 until 3.13.0, Botan's Python binding converted Python strings containing U+0000 to const char values without consistently rejecting the embedded NUL, causing bcrypt and check bcrypt to process only the prefix before the NUL. Applications could...

PT-2026-132405

Botan is a C++ cryptography library. From 1.11.34 until 3.13.0, the botan ocsp check command requested an OCSP response from a certificate's Authority Information Access URL without verifying the response signature or authorizing the signer. A malicious responder or on-path attacker could return ...

PT-2026-132788

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used certificate.verifychild, verifySignature, lib/x509.js to process the relevant input or security decision. node-forge selected RSA padding and...

PT-2026-132790

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used decipher.finish, CBC and ECB modes, PKCS7 padding to process the relevant input or security decision. node-forge validated only the final byte of PKC...

PT-2026-132791

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the forge.http client stored cookie names and paths from Set-Cookie response headers in ordinary JavaScript objects. A malicious server could use the cookie name proto so that the...

PT-2026-132792

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection, c.session.serverCertificate, RSA key exchange to process the relevant input or security decision. node-forge's TLS client...

PT-2026-132793

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pem.decode, lib/pem.js, missing END line to process the relevant input or security decision. node-forge used polynomial-time regular expressions in...