ImageMagick Code Execution

The vulnerability of the Sun console-based graphic editor ImageMagick relates to a numerical overflow condition. Exploiting this vulnerability allows an attacker to execute arbitrary code...

PT-2026-56579

Name of the Vulnerable Software and Affected Versions Plate versions 53.0.0 through 53.1.3 Description The media embed renderer trusts serialized provider or sourceUrl metadata in useMediaState and skips parseMediaUrl protocol validation. This allows a crafted document to specify a known video...

aprsd (>=2.3.0, <=2.5.9), cacaodocs (>=0.1.3, <=0.1.14) +19 more potentially affected by CVE-2026-21860 via werkzeug (2.0.0)

werkzeug PYPI version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - aprsd =2.3.0, =0.1.3, =1.9.4rc2, =0.1.1, =1.5.3, =0.12.0, =1.0.0, =2.9.1, =0.28.1, =1.0.0, =0.3.0.0, =4.2.11.10, =4.2.11.11 - quickboard 0.1.1 a...

PYSEC-2026-1991 trytond does not enforce access rights for the route of the HTML editor.

Tryton trytond 6.0 before 7.6.11 does not enforce access rights for the route of the HTML editor. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70...

trytond does not enforce access rights for the route of the HTML editor.

Tryton trytond 6.0 before 7.6.11 does not enforce access rights for the route of the HTML editor. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70...

Apache Superset's chart visualization has a stored Cross-Site Scripting (XSS) vulnerability

A stored Cross-Site Scripting XSS vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they...

Exploit for CVE-2026-48611

CVE-2026-48611-phpBB simple poc bypass auth if you want to acc...

CVE-2026-58384 Gimp: gimp: integer overflow in read_rle_channel()

A flaw was found in GIMP's PSD parser. An integer overflow in readRLEchannel can cause an undersized heap allocation for the RLE row-length table, after which subsequent per-row writes corrupt heap memory. This could lead to memory corruption, potentially resulting in denial of service or arbitra...

CVE-2026-58386

A flaw was found in GIMP's TIM loader. File-controlled width, height, and palette size values are used directly in multiple variable-length array declarations in loadimage, allowing a crafted TIM file to force oversized stack allocations and memory corruption. This could lead to denial of service...

SUSE CVE-2026-14620

webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state-changing actions on any GET request without verifying that the request originated from the dev server's own page. Any websi...

XDECAF: An Extensible Data Flow Diagram Analysis Framework for Information Security

xDECAF is an extensible tool for architecture-based data flow analysis with a focus on information security. It combines an extended data flow diagram metamodel of labeled flows and nodes, a domain-specific constraint language with different flow operations, and a browser-based editor backed by a...

PT-2026-56168

Name of the Vulnerable Software and Affected Versions GIMP affected versions not specified Description A flaw in the PSD parser allows an integer overflow in the read RLE channel function. This overflow can lead to an undersized heap allocation for the RLE row-length table, causing subsequent...

Linux Distros Unpatched Vulnerability : CVE-2026-14620

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev- server/open-editor and /webpack-dev-server/invalidate, that...

CVE-2026-58380

A flaw was found in GIMP's PNM file format parser. When parsing a specially crafted PNM file, the pnmscannergettoken function writes a null terminator one byte past the end of a stack-allocated buffer due to an off-by-one error in the loop boundary check. This could lead to memory corruption,...

CVE-2026-58380 Gimp: gimp: stack buffer overflow in pnmscanner_gettoken()

A flaw was found in GIMP's PNM file format parser. When parsing a specially crafted PNM file, the pnmscannergettoken function writes a null terminator one byte past the end of a stack-allocated buffer due to an off-by-one error in the loop boundary check. This could lead to memory corruption,...

CVE-2026-58380

A flaw was found in GIMP's PNM file format parser. When parsing a specially crafted PNM file, the pnmscannergettoken function writes a null terminator one byte past the end of a stack-allocated buffer due to an off-by-one error in the loop boundary check. This could lead to memory corruption,...

CVE-2026-14620

A flaw was found in webpack-dev-server. This vulnerability allows a remote attacker to exploit exposed internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, through cross-origin requests. By visiting a malicious website while the development server is...

UBUNTU-CVE-2026-58379

A flaw was found in GIMP's Paint Shop Pro PSP file format parser. This heap buffer overflow vulnerability allows a remote attacker to cause arbitrary code execution or a denial of service DoS by tricking a user into opening a specially crafted PSP image file. The vulnerability occurs because the...

Cross-site Request Forgery (CSRF)

Overview org.webjars.npm:webpack-dev-server is an Uses webpack with a development server that provides live reloading. It should be used for development only. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the open-editor and invalidate endpoints. An...

Cross-site Request Forgery (CSRF)

Overview webpack-dev-server is an Uses webpack with a development server that provides live reloading. It should be used for development only. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the open-editor and invalidate endpoints. An attacker can open...