CVE-2026-64070

A flaw was found in the Linux kernel's powerpc/hv-gpci component. This vulnerability allows a local attacker to cause a denial of service DoS by repeatedly reading from specific sysfs files. The flaw is due to a preemption count leak, where successful reads from sysfs show functions fail to...

CVE-2026-63729

The SyncTeX parser synctexparser.c shipped with TeX Live and embedded by downstream consumers such as GNOME Evince contains a heap use-after-free vulnerability that allows attackers to crash applications or potentially execute arbitrary code by supplying a malformed .synctex or .synctex.gz file. ...

CVE-2026-63729

The SyncTeX parser synctexparser.c shipped with TeX Live and embedded by downstream consumers such as GNOME Evince contains a heap use-after-free vulnerability that allows attackers to crash applications or potentially execute arbitrary code by supplying a malformed .synctex or .synctex.gz file. ...

EUVD-2026-46144

The SyncTeX parser synctexparser.c shipped with TeX Live and embedded by downstream consumers such as GNOME Evince contains a heap use-after-free vulnerability that allows attackers to crash applications or potentially execute arbitrary code by supplying a malformed .synctex or .synctex.gz file. ...

[SECURITY] Fedora 43 Update: libtiff-4.7.2-1.fc43

The libtiff package contains a library of functions for manipulating TIFF Tagged Image File Format image format files. TIFF is a widely used file format for bitmapped images. TIFF files usually end in the .tif extension and they are often quite large. The libtiff package should be installed if yo...

vim security update

9.1.083-9.0.1.el102.7 - Remove upstream references Orabug: 31197557 2:9.1.083-9.7 - RHEL-186660 CVE-2026-47162 vim: netrw code injection via NetrwBookHistSave - RHEL-186671 CVE-2026-52858 vim: possible code execution with python3complete 2:9.1.083-9.6 - RHEL-185867 CVE-2026-47167 vim: Code...

📄 WordPress FormGent 1.6.0 Unauthenticated Arbitrary File Deletion

WordPress FormGent plugin version 1.6.0 contains an unauthenticated arbitrary file deletion vulnerability. A remote attacker can delete arbitrary files accessible to the affected WordPress installation. This proof of concept exploit demonstrates the vulnerable request flow against the affected...

PT-2026-62174

Name of the Vulnerable Software and Affected Versions Oracle Agile PLM version 9.3.6 Description An issue exists in the Folders, Files & Attachments component of the Oracle Agile PLM product. An unauthenticated attacker with network access via HTTP can compromise the system, provided there is hum...

PT-2026-75932

Home Assistant Core before 2026.6.0 contains a path traversal vulnerability that allows unauthenticated attackers to write arbitrary files to any directory on the host filesystem by uploading a crafted backup archive during the initial onboarding window. Attackers can manipulate the 'name' field...

ROS-20260721-73-0001

The vulnerability of the ANGLE library in Google Chrome and Microsoft Edge relates to insufficient validation of input data. Exploiting this vulnerability allows an attacker to read and write arbitrary files remotely...

PT-2026-61819

Name of the Vulnerable Software and Affected Versions TeX Live affected versions not specified GNOME Evince affected versions not specified Description The SyncTeX parser synctex parser.c contains a heap use-after-free issue. This occurs when a malformed .synctex or .synctex.gz file constructs a...

CVE-2026-47009: Exposure of Sensitive Information to an Unauthorized Actor

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain component: Folders, Files & Attachments. The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful...

PT-2026-67411

Name of the Vulnerable Software and Affected Versions Grav CMS version 2.0.10 Description A path traversal issue exists in the ImageMedium::watermark function, which passes an unsanitized $image argument to RocketThemeToolboxResourceLocatorUniformResourceLocator::findResource. The file:// scheme...

EulerOS Virtualization 2.12.1 (EulerOS-SA-2026-2754)

According to the versions of the package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Requests is a HTTP library. Prior to version 2.33.0, the requests.utils.extractzippedpaths utility function uses a predictable filename whe...

PT-2026-63314

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description An authenticated user with package publishing permissions can cause resource amplification by uploading a specially crafted Arch package archive. The system records non-dot regular file entries...

Linux Distros Unpatched Vulnerability : CVE-2026-49145

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc. ack searches up the directory hierarchy from the current...

PT-2026-67410

Name of the Vulnerable Software and Affected Versions Grav CMS versions 2.0.7 through 2.0.10 Description Insufficient validation of fully-qualified static method calls Class::method in blueprint dynamic-field directives occurs because the Blueprint::isSafeDynamicCall function only applies its...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the reverse DNS lookup process. An attacker can bypass hostname-based access controls by connecting from a hostname that should be denied, if the chroot environment lacks required resolution files. Remediation...

DEBIAN-CVE-2026-64624

FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files. Attackers can craft malicious RDP files with /rdp2tcp, /cert:ignore, or /drive options to execute arbitrary commands, bypass...

CVE-2026-64624

FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files. Attackers can craft malicious RDP files with /rdp2tcp, /cert:ignore, or /drive options to execute arbitrary commands, bypass...