UBUNTU-CVE-2026-119283

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to 1.7.5, joserfc.jwe.decryptjson accepts a JWE General JSON Serialization recipients array without a count limit and calls decryptcek for every entry. An unauthenticate...

PT-2026-134205

Name of the Vulnerable Software and Affected Versions ThingLinks versions prior to 1.4.0 Description An authenticated attacker can achieve arbitrary server-side code execution via the rule engine's Groovy script test/register flow. The '/groovyScriptTest/registerScript' endpoint accepts...

PT-2026-134234

Name of the Vulnerable Software and Affected Versions Netopeer2 versions prior to 2.8.8 Description A low-privileged authenticated NETCONF user can remotely crash the netopeer2-server by sending a get RPC containing an invalid subtree filter with format specifiers. The issue occurs because np2srv...

PT-2026-133787

Name of the Vulnerable Software and Affected Versions mouse07410/asn1c versions prior to 1.2.5 Description An issue exists in the decoding of OPEN TYPE where the program may dereference an unallocated member pointer, leading to a segmentation fault and causing the consuming program to crash. This...

PT-2026-134229

Name of the Vulnerable Software and Affected Versions uhttpd affected versions not specified Description The client poll post data function in client.c fails to properly handle invalid chunk-length lines, such as sizes exceeding INT MAX. When this occurs, the server clears r-content length and...

PT-2026-134230

Name of the Vulnerable Software and Affected Versions uhttpd affected versions not specified Description The client parse header function in client.c lowercases header names but uses a case-sensitive strcmp to compare the Transfer-Encoding value to chunked. Because transfer-coding tokens are...

PT-2026-134182

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.4.2 until 6.5, the root-run advanced/Scripts/updatecheck.sh cron job applies truncate -s 0 and chmod 644 to /etc/pihole/versions while following symbolic links in a directory...

PT-2026-134186

Tesseract is an open source OCR engine. Prior to 5.5.4, GENERIC 2D ARRAY::DeSerializeSize in src/ccstruct/matrix.h reads matrix dimensions as signed int32 t values and compares them only with UINT16 MAX, allowing negative values to reach ResizeNoInit. Negative dimensions or a 65535 by 65535 produ...

PT-2026-134193

SNARK Verifier is a generic SNARK verifier. Prior to 0.2.5, the Halo 2 aggregation circuit can mishandle proof points encoded as the point at infinity. EcPointLoader::multi scalar multiplication places a Value::Assigned base paired with Value::ConstantONE into its unscaled variable-base list and...

PT-2026-134176

OSAC operator is a Kubernetes operator. In the affected revision identified as 8220502, the console-proxy RemoteConfigResolver parses Kubernetes Secret kubeconfig data with clientcmd.RESTConfigFromKubeConfig without sanitizing the resulting rest.Config. An attacker who can create or modify a Secr...

PT-2026-134167

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.0, the shared-link creation API accepted albumId and assetIds as independent fields in server/src/services/shared-link.service.ts but authorized only the resource selected by the requested link type. An...

PT-2026-134172

SNARK Verifier is a generic SNARK verifier. Prior to 0.2.5, KZG accumulator public-instance limbs are decoded without consistently enforcing canonical limb bounds before elliptic-curve coordinate reconstruction. PlonkProof::read selects scalars using accumulator indices and passes them to...

PT-2026-134181

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. Prior to 6.5, advanced/Scripts/utils.sh getFTLPID attempts to validate the pihole-owned /run/pihole-FTL.pid file with expr "$FTL PID" : "^:digit:", but this rejects only values whose...

PT-2026-134166

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.0.0, GET /api/map/markers used server/src/services/map.service.ts to add partner owner identifiers when withPartners=true, while server/src/repositories/map.repository.ts applied Archive visibility to every...

PT-2026-134245

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, an unauthenticated actor can query Query.allOrgs through /api/v1/graphql on a publicly accessible deployment and obtain data for all organizations, including organization IDs, names, email addresses, website URLs and...

PT-2026-134209

libriscv is a RISC-V sandbox and emulator. Prior to 1.18, a crafted ELF binary can cause out-of-bounds reads in the host emulator. Memory::binary loader checks PT LOAD program-header bounds, but Memory::serialize execute segment trusts section-header sh offset and sh size when locating .text...

PT-2026-134221

Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.1, the customer detail route /cpanel/customers/user/show in packages/admin/src/Livewire/Pages/Customers/Show.php checks read customers but looks up an arbitrary user ID without applying the customers role scope used by the listing...

PT-2026-134198

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 3.0.0, POST /api/v1/ai/tools/create-pdf-from-html-agent accepts attacker-controlled htmlContent and passes it to WeasyPrint without CustomHtmlSanitizer, unlike the sanitized...

PT-2026-134199

NovumOS is a custom 32-bit operating system written in Zig and x86 Assembly. Prior to version 0.25-beta.1, the Nova interpreter runs in Ring 0 with unrestricted kernel-memory access. Loading a malicious .nv script through the shell permits a local user to execute code with kernel privileges witho...

PT-2026-134247

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, the GraphQL Mutation.createOrg operation allows an unauthenticated actor to create arbitrary organizations on a publicly accessible instance. In addition to creating noise in the logs, the lack of rate limiting could...