EUVD-2026-42556

GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified-diff patch file. Improper handling of consecutive end-of-file newline markers can corrupt internal hunk single block of changes in diff data structures, causing the application to pass a NULL pointer...

CVE-2026-56288 NULL Pointer Dereference in GNU patch

GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified-diff patch file. Improper handling of consecutive end-of-file newline markers can corrupt internal hunk single block of changes in diff data structures, causing the application to pass a NULL pointer...

CVE-2026-56288

CVE-2026-56288 affects GNU patch. A NULL pointer dereference can occur while processing specially crafted unified-diff patch files due to improper handling of consecutive end-of-file newline markers, leading to a crash and denial of service. The issue is mitigated by the fixed patch in commit e6d...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: mariadb11.8: mariadb-11.8.8-3.hum1 aarch64, x8664 mariadb-backup-11.8.8-3.hum1 aarch64, x8664 mariadb-client-utils-11.8.8-3.hum1 noarch mariadb-common-11.8.8-3.hum1 noarch...

PT-2026-56775

Name of the Vulnerable Software and Affected Versions GNU patch affected versions not specified Description Improper handling of consecutive end-of-file newline markers when processing a specially crafted unified-diff patch file can corrupt internal hunk data structures. A hunk is a single block ...

PT-2026-57012

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.1 Description In the Asset.render function within app/src/asset/index.ts, the unsanitized this.path variable is interpolated into HTML assigned to innerHTML. A crafted asset link containing a double quote can break...

PT-2026-57007

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.1 Description An authenticated user can read workspace secrets and the document database. This occurs because the /snippets/filepath endpoint uses the serveSnippets function in kernel/server/serve.go, which joins a...

PT-2026-57023

Name of the Vulnerable Software and Affected Versions psd-tools versions prior to 1.17.1 Description An issue exists where the SmartObject.save function writes embedded smart objects to a path taken directly from a PSD file without sanitization. This allows an attacker to use absolute paths or...

RHEL 9 : kernel (RHSA-2026:36767)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:36767 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: Bluetooth: Fix use-after-free...

Security update for transmission (moderate)

openSUSE Security Update: Security update for transmission Announcement ID: openSUSE-SU-2026:0237-1 Rating: moderate References: 1267404 Cross-References: CVE-2026-38978 Affected Products: openSUSE Backports SLE-15-SP7 An update that fixes one vulnerability is now available. Description: This...

dirmngr-2.5.21-1.1 on GA media (moderate)

dirmngr-2.5.21-1.1 on GA media Announcement ID: openSUSE-SU-2026:11213-1 Rating: moderate Cross-References: CVE-2026-57062 CVSS scores: CVE-2026-57062 SUSE : 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2026-57062 SUSE : 2.1 CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N...

CVE-2026-39245

decompress before 4.2.2 contains an improper path containment check that enables directory traversal and arbitrary file write. The safeMakeDir function index.js line 29 and the extraction path validation index.js line 106 use String.indexOf to verify the resolved path is within the output...

PT-2026-56996

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.6.0 Discourse versions prior to 2026.5.1 Discourse versions prior to 2026.4.2 Discourse versions prior to 2026.1.5 Description Regular users can route direct S3 multipart uploads through the ExternalUploadManag...

AlmaLinux 8 : kernel-rt (ALSA-2026:36348)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:36348 advisory. kernel: tcp: fix potential race in tcpv6synrecvsock CVE-2026-43198 kernel: netfilter: nfnetlinkcthelper: fix OOB read in nfnlcthelperdumptable...

OPENSUSE-SU-2026:11243-1 traefik2-2.11.52-1.1 on GA media

These are all security issues fixed in the traefik2-2.11.52-1.1 package on the GA media of openSUSE Tumbleweed...

UBUNTU-CVE-2026-59939

httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in decompressContent in httplib2/init.py, allowing a malicious or compromised HTTP server to return a small...

CVE-2026-39245

decompress before 4.2.2 contains an improper path containment check that enables directory traversal and arbitrary file write. The safeMakeDir function index.js line 29 and the extraction path validation index.js line 106 use String.indexOf to verify the resolved path is within the output...

PT-2026-56817

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.27.4 n8n versions 2.28.0 through 2.28.0 Description Instances configured with multiple trusted token-exchange issuers resolve external identities to local accounts using only the sub claim of the JSON Web Token JWT and...

nginx:1.24 security, bug fix, and enhancement update

1.24.0-7.0.1.3 - Reference oracle-indexhtml within Requires Orabug: 33802044 - Remove Red Hat references Orabug: 29498217 1:1.24.0-7.3 - Resolves: RHEL-191773 - nginx: 'HTTP/2 bomb' nginx fix breaks module ABI causing crashes - Resolves: RHEL-188413 - nginx: NGINX: Arbitrary code execution or...

PT-2026-56881

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.10.0 Description An issue exists in the channel thread parent and reply handling where the parent id is not bound to the channel in the URL. This allows an authenticated user to reference a message from a differe...