GHSA-GM3R-Q2WP-HW87 Shescape: Quadratic-time denial of service in the flag-protection

Impact This impacts users of Shescape that have flag protection enabled, which is on by default, regardless of the API being used. An attacker can cause a runtime quadratic in the input size, causing denial of service for large inputs. javascript import Shescape from "shescape"; // 1. Prerequisit...

GHSA-HP6V-6JW7-GV2F Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified

Summary Budibase's OIDC SSO login links an incoming SSO identity to an existing Budibase account by email address alone, without ever checking the emailverified claim of the OIDC ID token. Budibase first tries to match the IdP sub; when that misses any fresh attacker IdP account it silently falls...

GHSA-RQJ7-6WRP-6G2G Open WebUI: POST /api/v1/images/edit bypasses the global image-edit switch and the per-user image-generation permission

Summary POST /api/v1/images/edit performed no authorization beyond requiring a verified account. Every other image-editing surface in Open WebUI enforces the global image-edit switch and the per-user image-generation permission — the /api/v1/images/generations route, the built-in editimage tool,...

CVE-2026-64253

In the Linux kernel, the following vulnerability has been resolved: kernel/fork: clear PFBLOCKTS in copyprocess PFBLOCKTS is only set in blktimegetns when current-plug is non-NULL, and blkfinishplug clears it via blkflushplug before NULLing the plug pointer. copyprocess breaks the invariant by...

UBUNTU-CVE-2026-64253

In the Linux kernel, the following vulnerability has been resolved: kernel/fork: clear PFBLOCKTS in copyprocess PFBLOCKTS is only set in blktimegetns when current-plug is non-NULL, and blkfinishplug clears it via blkflushplug before NULLing the plug pointer. copyprocess breaks the invariant by...

CVE-2026-64253

CVE-2026-64253 affects the Linux kernel and relates to process creation via fork. The root cause is that in copy_process(), PF_BLOCK_TS can be inherited from the parent while the child’s plug pointer is cleared, breaking the invariant that PF_BLOCK_TS set implies current->plug != NULL. The fix...

CVE-2026-64253

In the Linux kernel, the following vulnerability has been resolved: kernel/fork: clear PFBLOCKTS in copyprocess PFBLOCKTS is only set in blktimegetns when current-plug is non-NULL, and blkfinishplug clears it via blkflushplug before NULLing the plug pointer. copyprocess breaks the invariant by...

EUVD-2026-48662

In the Linux kernel, the following vulnerability has been resolved: kernel/fork: clear PFBLOCKTS in copyprocess PFBLOCKTS is only set in blktimegetns when current-plug is non-NULL, and blkfinishplug clears it via blkflushplug before NULLing the plug pointer. copyprocess breaks the invariant by...

CVE-2026-65704

A flaw was found in FFmpeg. A remote attacker can exploit this vulnerability by providing a specially crafted ffconcat file, which, when processed with the -safe 0 flag, triggers an out-of-bounds write. This occurs due to improper bounds checking in the TY demuxer's demuxaudio function, leading t...

CVE-2026-65704

FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demuxaudio function decrements packet size without bounds checking, producing a negative size...

CVE-2026-65704

FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demuxaudio function decrements packet size without bounds checking, producing a negative size...

CVE-2026-65704

CVE-2026-65704 affects FFmpeg up to version 8.1.2, where the TY demuxer’s demux_audio() decrements packet size without bounds checking, producing a negative size that, when passed to memcpy in shorten_decode_frame(), wraps to near SIZE_MAX and causes heap corruption from reads beyond the source a...

EUVD-2026-48371

FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demuxaudio function decrements packet size without bounds checking, producing a negative size...

CVE-2026-65704 FFmpeg 8.1.2 Out-of-Bounds Write via TY Demuxer and Shorten Decoder

FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demuxaudio function decrements packet size without bounds checking, producing a negative size...

CVE-2026-65704 FFmpeg 8.1.2 Out-of-Bounds Write via TY Demuxer and Shorten Decoder

FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demuxaudio function decrements packet size without bounds checking, producing a negative size...

CVE-2026-61140

creationtimestamp| type| source ---|---|--- 2026-07-23 18:15:38+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9 2026-07-23 18:56:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrdjbga3p72j 2026-07-25 09:37:07+00:00| seen|...

n8n: computer-use Shell Sandbox Not Enforced on Linux and Windows

Impact The shell tool in the @n8n/computer-use package applied its sandbox restrictions only on macOS. On Linux and Windows, shell commands executed by the tool ran without any filesystem or network restrictions, allowing unrestricted access to the host filesystem and network from within the...

n8n: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner

Impact n8n's Enterprise SSO instance-role provisioning maps a role claim asserted by the configured Identity Provider IdP to an n8n global role and applies it during authentication. The provisioning path did not prevent assignment of the global:owner role, unlike the token-exchange identity path,...

Netty: [SpdyHttpDecoder] ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion

The SpdyHttpDecoder handler in Netty's SPDY-to-HTTP codec allocates a pooled ByteBuf when processing a client-initiated SYNSTREAM frame with FLAGFIN=0, storing the partially-constructed FullHttpRequest in an internal map messageMap to accumulate subsequent DATA frames. When the remote peer sends ...

CVE-2026-55990

In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when the 'dnscrypt:' clause lists more 'dnscrypt-provider-cert:' files than there are matching 'dnscrypt-secret-key:' files, Unbound fills only the matched prefix and leaves the tail slots at the '0xdb' fill that libsodium's allocator writes...