PYSEC-2026-1957 TensorFlow has Null Pointer Error in TensorArrayConcatV2

Impact When ctx-stepcontainter is a null ptr, the Lookup function will be executed with a null pointer. python import tensorflow as tf tf.rawops.TensorArrayConcatV2handle='a', 'b', flowin = 0.1, dtype=tf.int32, elementshapeexcept0=1 Patches We have patched the issue in GitHub commit...

PYSEC-2026-1270 configobj ReDoS exploitable by developer using values in a server-side configuration file

All versions of the package configobj are vulnerable to Regular Expression Denial of Service ReDoS via the validate function, using .+?.. Note: This is only exploitable in the case of a developer, putting the offending value in a server side configuration file...

PYSEC-2026-910 pyRdfa3 Cross-site Scripting vulnerability

A vulnerability was found in RDFlib pyrdfa3 and classified as problematic. This issue affects the function getoption of the file pyRdfa/init.py. The manipulation leads to cross site scripting. The attack may be initiated remotely. The name of the patch is ffd1d62dd50d5f4190013b39cedcdfbd81f3ce3e...

PYSEC-2026-992 Heap overflow in `QuantizeAndDequantizeV2`

Impact The function MakeGrapplerFunctionItem takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater than or equal to the sizes of the outputs, an out-of-bounds memory read or a crash is triggered. python import tensorflow as tf @tf.function def test:...

PYSEC-2026-1021 `CHECK` fail via inputs in `PyFunc`

Impact An input token that is not a UTF-8 bytestring will trigger a CHECK fail in tf.rawops.PyFunc. python import tensorflow as tf value = tf.constantvalue=1,2 token = b'\xb0' dataType = tf.int32 tf.rawops.PyFuncinput=value,token=token,Tout=dataType Patches We have patched the issue in GitHub...

PYSEC-2026-994 TensorFlow vulnerable to null dereference on MLIR on empty function attributes

Impact When mlir::tfg::ConvertGenericFunctionToFunctionDef is given empty function attributes, it gives a null dereference. cpp // Import the function attributes with a tf. prefix to match the current // infrastructure expectations. for const auto& namedAttr : func.attr const std::string& name =...

PYSEC-2026-1015 TensorFlow vulnerable to assertion fail on MLIR empty edge names

Impact When mlir::tfg::ConvertGenericFunctionToFunctionDef is given empty function attributes, it crashes. cpp // We pre-allocate the array of operands and populate it using the // outputnametoposition and controloutputtoposition populated // previously. SmallVector retvalsfunc.retsize +...

CVE-2026-34037 Cross-Tenant Resource Cloning via Broken Object-Level Authorization in cloneTo()

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, the cloneTo Livewire action in ResourceOperations.php authorizes the source resource but resolves destination resources with unscoped Eloquent lookups, allowing an...

CVE-2026-34037 Cross-Tenant Resource Cloning via Broken Object-Level Authorization in cloneTo()

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, the cloneTo Livewire action in ResourceOperations.php authorizes the source resource but resolves destination resources with unscoped Eloquent lookups, allowing an...

[SECURITY] Fedora 43 Update: hplip-3.26.4-7.fc43

The Hewlett-Packard Linux Imaging and Printing Project provides drivers for HP printers and multi-function peripherals...

RHEL 10 : perl-HTTP-Daemon (RHSA-2026:36189)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:36189 advisory. The perl-HTTP-Daemon package includes the HTTP::Daemon class, a subclass of IO::Socket::IP. Instances of the HTTP::Daemon class are HTTP/1.1 server...

The vulnerability of the mport_cdev_open() function in the drivers/rapidio/devices/rio_mport_cdev.c module of the Linux kernel allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the mportcdevopen function in the drivers/rapidio/devices/riomportcdev.c module of the Linux kernel is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibilit...

Linux Distros Unpatched Vulnerability : CVE-2026-55798

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pillow is a Python imaging library. Prior to 12.3.0, WindowsViewer.getcommand constructed a cmd.exe shell command by directly embedding a file path into an...

CVE-2026-50811

FreeType 2.14.3 and earlier (before commit 5a280ecde6f324de0d226261036e736e0cb49a71) contain an out-of-bounds read in src/truetype/ttgxvar.c within TT_Get_Var_Design_Coordinates (used by TT_Get_Var_Design). Affected component: FreeType typography engine (ttgxvar.c). Root cause: out-of-bounds read...

The vulnerability of the usbhs_remove() function in the drivers/usb/renesas_usbhs/common.c driver module allows a hacker to cause a service failure.

The vulnerability of the usbhsremove function in the drivers/usb/renesasusbhs/common.c file of the Linux device driver module is related to state management errors. Exploiting this vulnerability could allow an attacker to cause a service failure...

PT-2026-56282

Name of the Vulnerable Software and Affected Versions GPAC versions prior to commit b35c61f104b85fbb16520ac2838d5d2ef70845b5 Description A NULL pointer dereference occurs in the smooth parse stream index function within the src/media tools/mpd.c file. This issue allows attackers to trigger a deni...

CVE-2026-50811

An out-of-bounds read vulnerability exists in FreeType 2.14.3 and versions before commit 5a280ecde6f324de0d226261036e736e0cb49a71 in src/truetype/ttgxvar.c, in the TTGetVarDesign implementation used by FTGetVarDesignCoordinates...

The vulnerability of the rmapremove() function in the KVM virtualization subsystem of the Linux operating system allows a attacker to cause a service failure or execute arbitrary code.

The vulnerability of the rmapremove function in the KVM virtualization subsystem of the Linux operating system is related to the use of memory after it is freed, as a result of a pointer that has reached its expiration time. Exploiting this vulnerability can allow an attacker to cause a service...

CVE-2026-59710

showdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/tables.js that fails to properly escape table header ID attributes. Attackers can inject arbitrary HTML and script-executing SVG elements through double-quote characters in markdo...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the getcommand function. An attacker can execute arbitrary commands by supplying a file path containing shell metacharacters. Remediation Upgrade pillow to version 12.3.0 or higher. References - GitHub Advisory -...