USN-8536-1 mariadb vulnerabilities

It was discovered that MariaDB did not properly validate parameters supplied by a joiner node during a State Snapshot Transfer using the mariabackup method. An attacker could possibly use this issue to execute arbitrary shell commands on the donor node. CVE-2026-44168 It was discovered that Maria...

python-pillow: Pillow: Denial of Service via crafted GD 2.x image file

A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit this vulnerability by providing a specially crafted GD 2.x image file. The GdImageFile.open function reads image dimensions without proper validation, leading to excessive memory allocation. This can result in a...

BIT-COMPOSER-2026-59946 Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a Composer package bin entry containing .. path segments can resolve outside the package install directory and cause Composer's binary installation flow to chmod an existing host file to a world-readable and...

EUVD-2026-43624

The Word Count and Social Shares WordPress plugin through 1.0 does not validate a user-supplied file path before deletion, nor does it have proper authorization or CSRF checks, allowing any authenticated user, such as a Subscriber, to delete arbitrary files on the server, which can lead to a full...

CVE-2026-11563

The Word Count and Social Shares WordPress plugin through 1.0 does not validate a user-supplied file path before deletion, nor does it have proper authorization or CSRF checks, allowing any authenticated user, such as a Subscriber, to delete arbitrary files on the server, which can lead to a full...

MAL-2026-10549 Malicious code in abi-encode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector afc61427f74a028242a032b9436c09c43b1df60fef5688aa5389ef107e899259 The package advertises ABI encoding but on require schedules a 37-second timer that decodes test/fixtures/keypairs.dat base64-encoded stealer, staged...

EUVD-2026-43545

AnyDesk Screen Recording Link Following Denial-of-Service Vulnerability. This vulnerability allows local attackers to create a denial-of-service condition on affected installations of AnyDesk. An attacker must first obtain the ability to execute low-privileged code on the target system in order t...

EUVD-2026-43541

Glarysoft Glary Utilities Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Glarysoft Glary Utilities. An attacker must first obtain the ability to execute low-privileged code on the target system...

PT-2026-58192

Name of the Vulnerable Software and Affected Versions Windows Kernel affected versions not specified Description An issue in the Windows Kernel allows an authorized attacker to disclose sensitive information locally by inserting it into a log file. Recommendations At the moment, there is no...

PT-2026-58662

Name of the Vulnerable Software and Affected Versions Windows Cloud Files Mini Filter Driver affected versions not specified Description A use-after-free issue exists in the Windows Cloud Files Mini Filter Driver, specifically within the CldiStreamCompleteRequest function. This flaw allows an...

PT-2026-58720

Name of the Vulnerable Software and Affected Versions Podlove Podcast Publisher versions prior to 4.5.2 Description Missing file type validation in the podlove handle cache files function allows unauthenticated attackers to upload arbitrary files to the server. This flaw in the image cache can le...

PT-2026-58062

Name of the Vulnerable Software and Affected Versions DBD::File versions prior to 1.651 Description The software fails to verify if a table file is a symbolic link to an untrusted location. The complete table name function constructs the absolute path to the table file without checking for symbol...

PT-2026-58649

Name of the Vulnerable Software and Affected Versions Windows Cloud Files Mini Filter Driver affected versions not specified Description A use-after-free condition in the Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally. Use-after-free is a memory...

PT-2026-58009

Name of the Vulnerable Software and Affected Versions 1715-AENTR EtherNet/IP Adapter versions prior to 3.011 Description The 1715-AENTR EtherNet/IP Adapter exposes a network-accessible debug port that lacks proper privilege controls. This allows unauthenticated remote access to intrusive...

PT-2026-58380

Name of the Vulnerable Software and Affected Versions Windows Cloud Files Mini Filter Driver affected versions not specified Description An out-of-bounds read in the Windows Cloud Files Mini Filter Driver allows an authorized attacker to disclose information locally. An out-of-bounds read occurs...

Oracle Linux 9 : vim (ELSA-2026-38511)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-38511 advisory. - RHEL-186659 CVE-2026-47162 vim: code injection via NetrwBookHistSave - RHEL-186646 CVE-2026-52858 vim: possible code execution with python3complete ...

FreeBSD : ocaml-opam -- opam install sandbox escape using symlinks (b478ff13-7f6e-11f1-b594-3c7c3fba4204)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the b478ff13-7f6e-11f1-b594-3c7c3fba4204 advisory. The OCaml Team reports: Installing files through .install files do not check symlinks resolution of the...

ALSA-2026:39127 Important: python-pillow security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

CVE-2026-15684

Glarysoft Glary Utilities Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Glarysoft Glary Utilities. An attacker must first obtain the ability to execute low-privileged code on the target system...

CVE-2026-15681 AnyDesk Screen Recording Link Following Denial-of-Service Vulnerability

AnyDesk Screen Recording Link Following Denial-of-Service Vulnerability. This vulnerability allows local attackers to create a denial-of-service condition on affected installations of AnyDesk. An attacker must first obtain the ability to execute low-privileged code on the target system in order t...