EUVD-2026-38273

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, a Denial of Service DoS vulnerability exists in the @angular/common package of the Angular framework. The formatDate function,...

CVE-2026-54268

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, a Denial of Service DoS vulnerability exists in the @angular/common package of the Angular framework. The formatDate function,...

Security Bulletin: Vulnerability in Ruby affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in Ruby has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information. Vulnerability...

postgresql: PostgreSQL: Information disclosure via externally-controlled format string in timeofday() function

A flaw was found in PostgreSQL. This vulnerability, an externally-controlled format string in the timeofday function, allows a remote attacker to craft specific timezone zones. Successful exploitation can lead to the retrieval of sensitive portions of server memory, potentially disclosing...

postgresql: PostgreSQL: Information disclosure via externally-controlled format string in timeofday() function

A flaw was found in PostgreSQL. This vulnerability, an externally-controlled format string in the timeofday function, allows a remote attacker to craft specific timezone zones. Successful exploitation can lead to the retrieval of sensitive portions of server memory, potentially disclosing...

postgresql: PostgreSQL: Information disclosure via externally-controlled format string in timeofday() function

A flaw was found in PostgreSQL. This vulnerability, an externally-controlled format string in the timeofday function, allows a remote attacker to craft specific timezone zones. Successful exploitation can lead to the retrieval of sensitive portions of server memory, potentially disclosing...

poppler: Integer overflow in Poppler SplashOutputDev::tilingPatternFill leads to heap buffer overflow via unchecked dimension multiplication

A flaw was found in Poppler's Splash backend. A remote attacker could exploit this vulnerability by crafting a malicious PDF file that, when rendered, triggers an integer overflow in the tilingPatternFill function. This overflow leads to an undersized heap memory allocation, allowing a subsequent...

PT-2026-55397

Summary The default formatGroup and formatResult functions in devbridge-autocomplete concatenate values into HTML without escaping, allowing XSS when an attacker controls or can taint the suggestion data source. Details 1. formatGroup — category is interpolated raw. src/format.ts: ts function...

CVE-2026-56367

ImageMagick before 7.1.2-15 and 6.9.x before 6.9.13-40 contains an integer overflow in the PSB PSD v2 RLE decoding path ReadPSDChannelRLE in coders/psd.c that causes a heap out-of-bounds read on 32-bit builds. Processing a crafted PSB file can lead to information disclosure or a crash...

CVE-2026-56367

ImageMagick before 7.1.2-15 and 6.9.x before 6.9.13-40 contains an integer overflow in the PSB PSD v2 RLE decoding path ReadPSDChannelRLE in coders/psd.c that causes a heap out-of-bounds read on 32-bit builds. Processing a crafted PSB file can lead to information disclosure or a crash...

[SECURITY] Fedora 44 Update: mingw-SDL2_image-2.8.12-1.fc44

Simple DirectMedia Layer SDL2 is a cross-platform multimedia library designed to provide fast access to the graphics frame buffer and audio device. This package contains a simple library for loading images of various formats BMP, PPM, PCX, GIF, JPEG, PNG as SDL2 surfaces...

Linux Distros Unpatched Vulnerability : CVE-2026-49271

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.1, the uncompressed HEIF decoder validates explicit icef compressed-unit offse...

CVE-2026-56218 Capgo - EXIF Metadata Exposure via Image Upload

Capgo before 12.128.2 fails to strip EXIF metadata including GPS geolocation data from uploaded images, allowing information disclosure. Attackers can download uploaded images and extract precise latitude and longitude coordinates revealing user physical location at capture time...

Denial Of Service (DoS)

angular/common is vulnerable to Denial of Service DoS. The vulnerability is due to improper validation of the digitsInfo parameter in the formatNumber function, which allows an attacker to supply excessively large fraction digit values that trigger an unbounded loop and excessive memory...

org.http4k:http4k-client-apache (1.10.0), org.http4k:http4k-contract (1.10.0) +6 more potentially affected by CVE-2026-100725 via org.http4k:http4k-core (1.10.0)

org.http4k:http4k-core MAVEN version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-client-apache 1.10.0 - org.http4k:http4k-contract 1.10.0 - org.http4k:http4k-format-argo 1.10.0 ...

org.http4k:http4k-aws (2.29.3), org.http4k:http4k-client-apache (2.29.3) +15 more potentially affected by CVE-2026-100725 via org.http4k:http4k-core (2.29.3)

org.http4k:http4k-core MAVEN version 2.29.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 2.29.3 - org.http4k:http4k-client-apache 2.29.3 - org.http4k:http4k-client-okhttp 2.29.3 -...

org.http4k:http4k-aws (2.26.2), org.http4k:http4k-client-apache (2.26.2) +14 more potentially affected by CVE-2026-100725 via org.http4k:http4k-core (2.26.2)

org.http4k:http4k-core MAVEN version 2.26.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 2.26.2 - org.http4k:http4k-client-apache 2.26.2 - org.http4k:http4k-client-okhttp 2.26.2 -...

org.http4k:http4k-client-apache (0.22.0), org.http4k:http4k-contract (0.22.0) +6 more potentially affected by CVE-2026-100725 via org.http4k:http4k-core (0.22.0)

org.http4k:http4k-core MAVEN version 0.22.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-client-apache 0.22.0 - org.http4k:http4k-contract 0.22.0 - org.http4k:http4k-format-argo 0.22.0 ...

org.http4k:http4k-aws (2.25.4), org.http4k:http4k-client-apache (2.25.4) +14 more potentially affected by CVE-2026-100725 via org.http4k:http4k-core (2.25.4)

org.http4k:http4k-core MAVEN version 2.25.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 2.25.4 - org.http4k:http4k-client-apache 2.25.4 - org.http4k:http4k-client-okhttp 2.25.4 -...

org.http4k:http4k-client-apache (1.31.0), org.http4k:http4k-client-okhttp (1.31.0) +8 more potentially affected by CVE-2026-100725 via org.http4k:http4k-core (1.31.0)

org.http4k:http4k-core MAVEN version 1.31.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-client-apache 1.31.0 - org.http4k:http4k-client-okhttp 1.31.0 - org.http4k:http4k-contract 1.31....