CVE-2026-119735

Munshi by Petpooja before 2026-07-13 contained a stored cross-site scripting vulnerability that allows authenticated users to inject malicious markup through item descriptions or messages submitted in the Purchase Inquiry thread /purchase-inquiry/thread/thread-id, which is assigned to innerHTML...

Exploit for CVE-2026-98432

🔥 CVE-2026-98432 — Linux Kernel IPv4 Use-After-Free...

EUVD-2026-115375

SQLSpecialColumns in psqlODBC splices the table and schema names it receives into its catalog query without escaping them, while the other catalog functions escape them. An application that passes an untrusted table or schema name to SQLSpecialColumns lets the caller execute arbitrary SQL with th...

CVE-2026-120497 Stored cross-site scripting in the HTML report generator of aidlc-traceability in AWS AI-DLC Workflows

Stored cross-site scripting XSS in the HTML report generator in the aidlc-traceability CLI in AWS AI-DLC Workflows before 2026-07-03 might allow an actor who can modify a project's AI-DLC artifact files to execute arbitrary script in the browser of a user who opens a generated HTML traceability...

EUVD-2026-115369

Stored cross-site scripting XSS in the HTML report generator in the aidlc-traceability CLI in AWS AI-DLC Workflows before 2026-07-03 might allow an actor who can modify a project's AI-DLC artifact files to execute arbitrary script in the browser of a user who opens a generated HTML traceability...

CVE-2026-120497 Stored cross-site scripting in the HTML report generator of aidlc-traceability in AWS AI-DLC Workflows

Stored cross-site scripting XSS in the HTML report generator in the aidlc-traceability CLI in AWS AI-DLC Workflows before 2026-07-03 might allow an actor who can modify a project's AI-DLC artifact files to execute arbitrary script in the browser of a user who opens a generated HTML traceability...

CVE-2026-119735 Munshi XSS via Purchase Inquiry Thread Rendering

Munshi by Petpooja before 2026-07-13 contained a stored cross-site scripting vulnerability that allows authenticated users to inject malicious markup through item descriptions or messages submitted in the Purchase Inquiry thread /purchase-inquiry/thread/thread-id, which is assigned to innerHTML...

EUVD-2026-115366

Munshi by Petpooja before 2026-07-13 contained a stored cross-site scripting vulnerability that allows authenticated users to inject malicious markup through item descriptions or messages submitted in the Purchase Inquiry thread /purchase-inquiry/thread/thread-id, which is assigned to innerHTML...

CVE-2026-119735

Munshi (by Petpooja) versions prior to 2026-07-13 are vulnerable to a stored cross-site scripting (XSS) vulnerability. The flaw exists in the Purchase Inquiry thread (/purchase-inquiry/thread/{thread-id}) where malicious markup can be injected via item descriptions or messages. The root cause is ...

bind: bind: Arbitrary code execution via GSS-TSIG UDP message replay

A flaw was found in BIND. This vulnerability may allow a remote attacker to achieve arbitrary code execution on the target server. An attacker who captures a valid User Datagram Protocol UDP message signed with Generic Security Service Transaction Signature GSS-TSIG can replay it while the...

Important: Red Hat Security Advisory: bind9.16 security update

An update for bind9.16 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

CVE-2026-111183

A flaw was found in GStreamer. A remote attacker can achieve arbitrary code execution by sending specially crafted Real-time Transport Protocol RTP stream packets to applications using the rtpL16depay plugin. This issue occurs due to a lack of proper validation on the length of incoming payload...

CVE-2026-120432

A flaw was found in Netpbm. An integer overflow in the winicontopam utility occurs when processing icon or cursor files with excessively large dimensions. By tricking a user or system into processing a specially crafted file, an attacker could corrupt memory, potentially leading to arbitrary code...

CVE-2026-120436

A flaw was found in Netpbm's jbigtopnm conversion utility. An integer overflow occurs when calculating output buffer dimensions for multi-plane JBIG Joint Bi-level Image Experts Group images with large header sizes, resulting in an undersized memory allocation. By convincing a user to process a...

bind: bind: Arbitrary code execution via GSS-TSIG UDP message replay

A flaw was found in BIND. This vulnerability may allow a remote attacker to achieve arbitrary code execution on the target server. An attacker who captures a valid User Datagram Protocol UDP message signed with Generic Security Service Transaction Signature GSS-TSIG can replay it while the...

Important: Red Hat Security Advisory: bind security, bug fix, and enhancement update

An update for bind is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

CVE-2026-119085

Improper neutralization of special elements used in a template engine in the publishing component of Amazon Virtual Engineering Workbench VEW could allow a remote authenticated third party to run arbitrary code with the permissions of the publishing Lambda's IAM role. This could allow access to...

ghostscript: Reintroduction of .charkeys -dSAFER bypass in RHEL 8

A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving privileged .forceput operations in the .charkeys procedure insufficiently protected. Processing a specially crafted...

Freeze

THIS REPOSITORY HAS BEEN ARCHIVED To view the latest version of Freeze or to submit an issue, reference https://github.com/Tylous/Freeze. Freeze More Information If you want to learn more about the techniques utilized in this framework, please take a look at SourceZero Blog Description Freeze is ...

brotli: Out-of-Bounds Write in Google Brotli Decoder

A flaw was found in the Google Brotli decoder. An out-of-bounds write in the block-type switch handling in c/dec/decode.c can be triggered by a crafted Brotli-compressed stream. When an application decompresses untrusted Brotli data, this can lead to memory disclosure, denial of service, or...