PT-2026-71627

rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operations beyond the intended destination subtree by sending a crafted file list that causes rsync to reclassify implied parent directory entries or treat synthetic...

FFmpeg 3.0 < 9.0 Multiple Vulnerabilities

The version of FFmpeg installed on the remote host is 3.0 or later but prior to 9.0. It is, therefore, affected by multiple vulnerabilities: - An uninitialized heap memory read vulnerability in the native RSCC decoder libavcodec/rscc.c allows attackers to disclose heap memory contents by supplyin...

UBUNTU-CVE-2026-73078

Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu...

CVE-2026-10543

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation with a specially crafted query...

CVE-2026-10543 IBM® Db2® is vulnerable to privilege escalation with a specially crafted query

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation with a specially crafted query...

CVE-2026-10543

IBM Db2 is vulnerable to privilege escalation via a specially crafted query (CVE-2026-10543) affecting IBM Db2 Server 11.5.0–11.5.9 and 12.1.0–12.1.5. The bulletin identifies CWE-285 (Improper Authorization) and lists a CVSSv3.1 base score of 8.2 (HIGH) with network attack vector, no user interac...

EUVD-2026-57617

A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during oversize-frame recovery can cause an invalid internal message length and terminate rsyslogd. No confidentiality or integrity impact, privilege escalation, or code...

CVE-2026-13267

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 could allow an authenticated user to gain privileges of another user via a specially crafted request...

CVE-2026-13267

CVE-2026-13267 affects IBM Security Verify Access and IBM Verify Identity Access (and their containers): authenticated users could escalate privileges to those of another user via a specially crafted request. Affected: IBM Security Verify Access 10.0–10.0.9.2; IBM Verify Identity Access 11.0–11.0...

EUVD-2026-57539

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 could allow an authenticated user to gain privileges of another user via a specially crafted request...

CVE-2026-19643

An out-of-bounds read issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862, on some platforms, might allow a remote authenticated user to crash an application that processes crafted Base64-encoded input. To remediate this issue, users should upgrade to version 1.11.862...

CVE-2026-19642 Out-of-bounds write in the Base64 decoder in Amazon aws-sdk-cpp

An out-of-bounds write issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862 might allow a remote authenticated user to cause a crash or heap memory corruption in an application that processes crafted Base64-encoded input. To remediate this issue, users should upgrade to version...

js-yaml: js-yaml: Denial of Service via crafted YAML documents

A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial o...

netty-codec-http2: netty-codec-http2: Denial of Service due to resource leak

A flaw was found in netty-codec-http2. A remote attacker could send specially crafted frames that cause a resource leak within the DelegatingDecompressorFrameListener class. This resource leak could lead to an Out Of Memory Error OOME, potentially causing a Denial of Service DoS by taking down th...

CVE-2026-19657

ScadaLTS 2.7.8.1 reflects user-supplied input into an HTML response without sanitization. An unauthenticated attacker who lures a victim into visiting a crafted URL can execute arbitrary JavaScript in the context of the victim's browser session...

EUVD-2026-57417

ScadaLTS 2.7.8.1 reflects user-supplied input into an HTML response without sanitization. An unauthenticated attacker who lures a victim into visiting a crafted URL can execute arbitrary JavaScript in the context of the victim's browser session...

CVE-2026-73434

A flaw was found in GStreamer gst-plugins-good avidemux. In gstavidemuxriffparsevprp, the number of available gstriffvprpvideofielddesc entries is calculated by dividing the remaining buffer size by the attacker-controlled vprp-fields value, rather than by sizeofgstriffvprpvideofielddesc. This ca...

CVE-2026-18952

Missing input validation in the threat intelligence feed parser in the OpenSearch Security Analytics plugin might allow an authenticated remote user to perform server-side request forgery and read local files via a crafted URL parameter to the threat intel source configuration endpoint...

EUVD-2026-57422

Missing input validation in the threat intelligence feed parser in the OpenSearch Security Analytics plugin might allow an authenticated remote user to perform server-side request forgery and read local files via a crafted URL parameter to the threat intel source configuration endpoint...

CVE-2026-19311

Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated remote user to read, modify, or delete arbitrary index data via a crafted inline monitor request with unintentional data source and input index parameters...