PT-2026-69753

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the ath6kl wmi tx complete event rx function. The issue occurs because the num msg field, which is controlled by the firmware, drives a loop without being...

EUVD-2026-54935

Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in Sregmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject...

EUVD-2026-54723

Ruby LSP is an implementation of the language server protocol for Ruby. Several workspace-level settings in the Ruby LSP VS Code extension prior to version 0.10.4 could override the path to the Ruby executable, the version manager executables, or the Bundler Gemfile used at startup. A malicious...

DEBIAN-CVE-2026-54338

JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and...

CVE-2026-50540

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines VMs that perform like containers. Prior to version 4.0.0, kata-runtime is vulnerable to host code execution via an unvalidated configuration path annotation. The runtime accepts an...

CVE-2026-54338

JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and...

CVE-2026-54338

JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and...

CVE-2026-62293 HAPI FHIR: Stored XSS in scan report via unescaped IG and profile titles

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the hidden scan command concatenates attacker-controlled Implementation Guide titles, profile titles, and source references into scan.html without escaping in Scanner.java. As...

EUVD-2026-54609

gopacket provides packet processing capabilities for Go. Through version 1.7.0, multiple layer decoders use attacker-controlled lengths, counts, or offsets before validating them against packet buffers, allowing a crafted packet decoded through DecodingLayerParser or DecodeFromBytes to trigger an...

Directory Traversal

Overview github.com/go-git/go-git/plumbing is a highly extensible git implementation library written in pure Go. Affected versions of this package are vulnerable to Directory Traversal via the processing of reference names in dotgit. An attacker can modify or overwrite files outside the intended...

Arbitrary Code Injection

Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Arbitrary Code Injection via the Repo.init process. An attacker can execute arbitrary code by supplying a malicious template parameter that points to a directory...

GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks

Summary Repo.init forwards kwargs verbatim to git init with no unsafe-option guard and no allowunsafeoptions parameter. git init --template= copies /hooks/ into the new repo's .git/hooks, so an attacker-controlled template kwarg plants a hook that executes on the next git operation → arbitrary co...

CVE-2026-16637

OPeNDAP Hyrax allows SSRF and credential disclosure via unvalidated HTTP redirects that bypass the AllowedHosts allowlist and leak Earthdata headers User-Id, Echo-Token to attacker-controlled endpoints...

CVE-2026-54202

Tobit Laboratories AG TeamDavid's Webbox is vulnerable to a path traversal vulnerability in the archive creation functionality. Because the archive path is user-controlled and insufficiently validated, an attacker can manipulate the input to traverse directories. This allows the creation of folde...

CVE-2026-54202 TeamDavid: Path Traversal in the archive creation functionality

Tobit Laboratories AG TeamDavid's Webbox is vulnerable to a path traversal vulnerability in the archive creation functionality. Because the archive path is user-controlled and insufficiently validated, an attacker can manipulate the input to traverse directories. This allows the creation of folde...

CVE-2026-54202 TeamDavid: Path Traversal in the archive creation functionality

Tobit Laboratories AG TeamDavid's Webbox is vulnerable to a path traversal vulnerability in the archive creation functionality. Because the archive path is user-controlled and insufficiently validated, an attacker can manipulate the input to traverse directories. This allows the creation of folde...

CVE-2026-16262 Estatik < 4.3.3 - Login CSRF

The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not bind its OAuth social login flow to the initiating user session, allowing an unauthenticated attacker to log a victim into an attacker-controlled account login CSRF, so that the victim's subsequent activity is stored under and...

CVE-2026-14205 WP Events Manager < 2.2.5 - Subscriber+ Payment Bypass via 'qty' Parameter

The WP Events Manager WordPress plugin before 2.2.5 does not validate the requested quantity when registering for a paid event and computes the price from the attacker-controlled quantity, allowing any authenticated user to create a completed booking for a paid event without making a payment...

EUVD-2026-54310

Opening a crafted DICOM file containing malicious JPEG-compressed pixel data triggers an attacker-controlled heap out-of-bounds write, which may allow an attacker to remotely execute arbitrary code...

EUVD-2026-54276

llama.cpp builds b1886 through b7445 contain an integer overflow vulnerability in the LLaMA-Android JNI wrapper where the new1batch function multiplies sizeofllamaseqid by an attacker-controlled nseqmax parameter without overflow validation, causing heap buffer allocation to wrap and allocate...