CVE-2026-44018 Docling: Unsafe Archive Extraction and XML Parsing in METS-GBS Backend

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.45.0 until 2.91.0, the METS-GBS backend's XML parsing and the input document format detection lacked security controls. An attacker could craft malicious METS-GBS...

CVE-2025-11919

The Wolfram Cloud (specifically version 14.2 ) is vulnerable to a race condition where the default Java Virtual Machine (JVM) can access unprotected temporary directories in the shared /tmp/ space. Because the JVM initialization -init file resides in a directory accessible by other users on the s...

Security update for giflib

This update for giflib fixes the following issue CVE-2026-26740: heap out-of-bounds read when processing a specially crafted GIF file containing a GCE block with a truncated extension byte count bsc1259836. Patch Instructions: To install this SUSE update use the SUSE recommended installation...

SUSE-SU-2026:2667-1 Security update for giflib

This update for giflib fixes the following issue - CVE-2026-26740: heap out-of-bounds read when processing a specially crafted GIF file containing a GCE block with a truncated extension byte count bsc1259836...

SUSE CVE-2026-53168

In the Linux kernel, the following vulnerability has been resolved: fuse: reject fusenotify pagecache ops on directories The operations FUSENOTIFYSTORE and FUSENOTIFYRETRIEVE allow the FUSE daemon to actively write/read pagecache contents. For directories with FOPENCACHEDIR, the pagecache is used...

PT-2026-53013

Name of the Vulnerable Software and Affected Versions Incus affected versions not specified Description A flaw exists where a specially crafted container image or instance backup can be used to read or create and write arbitrary files on the host, potentially leading to arbitrary command executio...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : tar vulnerability (USN-8477-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8477-1 advisory. It was discovered that tar incorrectly handled certain crafted archive files. An attacker...

CVE-2026-36908

A stack overflow in the AP4Array::EnsureCapacity component of axiomatic-systems Bento4 before v1.8.9allows attackers to cause a Denial of Service DoS via a crafted MP4 file...

CVE-2026-36907

A stack overflow in the AP4StsdAtom::AP4StsdAtom component of axiomatic-systems Bento4 before v1.8.9allows attackers to cause a Denial of Service DoS via a crafted MP4 file...

SUSE SLES12 Security Update : libzypp (SUSE-SU-2026:2628-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2628-1 advisory. This update for libzypp fixes the following issue - CVE-2026-25707: Handcrafted repo metadata may cause arbitrary local files to be overwritten...

Deserialization of Untrusted Data

Overview picklescan is a Security scanner detecting Python Pickle files performing suspicious actions Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the idlelib.pyshell.ModifiedInterpreter.runcode process. An attacker can execute arbitrary commands by...

GO-2026-5670 Focalboard doesn't validate file ownership when serving uploaded files in github.com/mattermost/focalboard

Focalboard doesn't validate file ownership when serving uploaded files in github.com/mattermost/focalboard...

GO-2026-5668 Race condition in 'docker cp' in github.com/docker/docker allows creation of arbitrary files

A race condition in the Docker daemon allows an attacker to create arbitrary empty files on the host system during a "docker cp" operation by swapping a destination path with a symbolic link. The affected code is in the daemon package, specifically the openContainerFS and createIfNotExists method...

GO-2026-5545 Gogs: Overwriting critical files results in a denial of service in gogs.io/gogs

Gogs: Overwriting critical files results in a denial of service in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners,...

GO-2026-5460 Algernon: Host header path traversal in --domain mode reads files and runs Lua from parent dir in github.com/xyproto/algernon

Algernon: Host header path traversal in --domain mode reads files and runs Lua from parent dir in github.com/xyproto/algernon...

Malicious code in log-update-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8dbad34a92b1a5080681d7966e3c807324847605ee60f874076b85e336860def Package masquerades as Sindre Sorhus's popular 'log-update' library matching name and description claiming 'Log by overwriting the previous output in...

MAL-2026-6483 Malicious code in log-update-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8dbad34a92b1a5080681d7966e3c807324847605ee60f874076b85e336860def Package masquerades as Sindre Sorhus's popular 'log-update' library matching name and description claiming 'Log by overwriting the previous output in...

ImageMagick: Policy Bypass can read disallowed files via symlink

An incorrect parsing of the filename can result in a policy bypass and read files disallowed by a security policy using a symlink...

GHSA-XCJM-WQFF-M669 ImageMagick: Policy Bypass can read disallowed files via symlink

An incorrect parsing of the filename can result in a policy bypass and read files disallowed by a security policy using a symlink...

CVE-2025-71340 picklescan - Remote Code Execution via idlelib.pyshell.ModifiedInterpreter.runcode

picklescan through 0.0.26 fails to detect malicious pickle files that invoke idlelib.pyshell.ModifiedInterpreter.runcode in reduce methods. Attackers can embed undetected code in pickle files that executes arbitrary commands when the file is loaded via pickle.load, enabling supply chain attacks o...