PT-2026-118060

Vikunja: Denial of service via decompression bomb in the data import in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...

PT-2026-117428

libaribcaption 1.1.0 through 1.1.2 contains a global out-of-bounds read in DecoderImpl::HandleGLGR that reads past the 78-entry kLatinSpecialTable without an upper bound check. Attackers can supply crafted captions designating the Latin special set with ESC 28 4C followed by bytes 0x6F-0x7E to le...

PT-2026-117579

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions 4.42 through 4.79 Description Input chunking can alter the decoded value of top-level numbers within the incr parse function. Because allow nonref is enabled by default and inherited by incr parse, top-level numbers,...

PT-2026-132594

TuxCare rebuilt org.springframework.data:spring-data-keyvalue to address 1 CVE. Fixed in 2.7.16-tuxcare.3...

PT-2026-117346

Exposure of Data Element to Wrong Session vulnerability in Apache Camel Thrift component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The Thrift data format unmarshalled incoming data into the shared defaultInstance of the target type rather than into a...

CVE-2026-107084

Slims Senayan Library Management Systems 9 Bulian 9.8.0 allows cross-site request forgery CSRF against admin/modules/circulation/loanhistorymaintenance.php because the action=run GET parameter performs privileged, destructive operations with no CSRF token or POST confirmation, leading to data los...

AlmaLinux 9.2 [TuxCare] Security Update: webkit2gtk3 / webkit2gtk3-devel / webkit2gtk3-jsc / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792402249)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792402249 advisory. - Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross- origin data via a craft...

MiracleLinux 8 : python36:3.6 (AXSA:2026-2086:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-2086:01 advisory. pymongo: MongoDB Python Driver: Data disclosure and denial of service via query-operator injection CVE-2026-88029 Tenable has extracted the preceding...

ROS-20261019-73-0013

The vulnerability of the putqpelfallback function in the h.265 Libde265 implementation is related to writing beyond the buffer boundaries. Exploiting this vulnerability allows an attacker to access confidential data, compromise its integrity, and cause service failures...

ROS-20261019-73-0018

The vulnerability of the regexpnfa.c component in the text editor Vim is related to the use of memory after it is freed. Exploiting this vulnerability allows an attacker to gain access to confidential data, compromise its integrity, and cause service interruptions...

CVE-2026-107084

Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 is vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability affecting the admin/modules/circulation/loan_history_maintenance.php endpoint. The flaw exists because the action=run GET parameter performs privileged and destructive oper...

SLiMS 9 Bulian security vulnerability

SLiMS 9 Bulian version 9.8.0 contains a security vulnerability. This vulnerability stems from improper handling of the opachide and promoted GET parameters in admin/modules/bibliography/index.php. Values processed by escapestring are concatenated into SQL statements containing unquoted numeric...

Red Hat: CVE-2026-112395: pillow: pillow: Information disclosure via crafted tiled TIFF image

Pillow is a Python imaging library. From 8.2.0 until 13.0.0, Pillow's tiled-TIFF decoder can read past the tile buffer while copying four-byte pixels. In decodeTile, libtiff can return a tile allocation smaller than the required row stride multiplied by the tile length, and Pillow's stride-and-co...

CVE-2026-16460: Insufficient Verification of Data Authenticity

A flaw was found in bootc and ostree. Already-staged deployments are finalized without revalidating the deployment's container image against the current containers signature policy. Unsigned OS content staged under a prior permissive policy can remain bootable after policy is hardened to reject...

PT-2026-132651

TuxCare rebuilt org.springframework.data:spring-data-commons to address 1 CVE. Fixed in 3.3.12-tuxcare.3...

PT-2026-117542

CCC Attestation SIG attested-tls-poc through commit 731ca82 fails to bind early attestation Evidence to the TLS connection, allowing attackers to relay valid Evidence from a genuine attester. Attackers holding an extracted attested TLS private key can forward the relying party's nonce to a genuin...

CVE-2026-112268: Incorrect Authorization

sglang-router sgl-model-gateway through 0.3.2 contains an authorization bypass vulnerability that allows holders of the data-plane API key to access mesh HA management routes because /ha/ endpoints skip control-plane Admin role checks. Attackers can read cluster topology, write gossiped...

GitLab Access Control Issue

The vulnerability of the Git-based software platform for collaborative code development in GitLab EE/CE is related to deficiencies in the access control mechanism. Exploiting this vulnerability could allow an attacker, operating remotely, to gain access to modify and delete any data they wish...

Navigation section of Microsoft Data Compromise

The vulnerability in the Navigation section of Microsoft Edge and Google Chrome browsers is related to insufficient input validation. Exploitation of this vulnerability enables a remote attacker to compromise the integrity of protected information by using a specially crafted HTML page...

PT-2026-117302

Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7...