CVE-2026-94636

The Apache Thrift py bindings are vulnerable to improper handling of highly compressed data (data amplification), function calls with incorrectly specified arguments, and improper validation of specified quantities in input. Specifically, the Python TZlibTransport stops enforcing its decompressed...

EUVD-2026-91560

Improper handling of highly compressed data data amplification, Function call with incorrectly specified arguments, Improper validation of specified quantity in input vulnerability in Apache Thrift py bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to...

ROS-20261002-73-0089

The vulnerability of the ascii function in the PostgreSQL database management system is related to reading data beyond the allowed range of memory. Exploiting this vulnerability can allow an attacker to disclose sensitive information...

ROS-20261002-73-0035

The vulnerability of the EXTRACT function in the PostgreSQL database management system is related to the lack of protective measures for SQL query structures. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code...

PT-2026-104077

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.316 via the parse request function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can...

PT-2026-104296

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description The Apache Thrift Python bindings contain an issue involving the improper handling of highly compressed data, which can lead to data amplification. This occurs due to improper validation of th...

PYSEC-2026-4059 JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)

Description A language pack ships a Plural-Forms header saying how the language counts, for example nplurals=2; plural=n != 1;. JupyterLab turns that string into a function with new Function, so the header gets executed. The check that meant to keep it safe was a regular expression. The regex was...

JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)

DescriptionA language pack ships a Plural-Forms header saying how the language counts, for example nplurals=2; plural=n != 1;. JupyterLab turns that string into a function with new Function, so the header gets executed. The check that meant to keep it safe was a regular expression. The regex was...

JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)

DescriptionA language pack ships a Plural-Forms header saying how the language counts, for example nplurals=2; plural=n != 1;. JupyterLab turns that string into a function with new Function, so the header gets executed. The check that meant to keep it safe was a regular expression. The regex was...

CVE-2026-59797 Apache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-function

Improper Privilege Management vulnerability in Apache HTTP Server's modssl via SSLRequire and file-related expressions. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...

EUVD-2026-89337

JupyterLab: Cross-site scripting XSS in JupyterLab via crafted language package jupyterlab.json...

JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)

Description A language pack ships a Plural-Forms header saying how the language counts, for example nplurals=2; plural=n != 1;. JupyterLab turns that string into a function with new Function, so the header gets executed. The check that meant to keep it safe was a regular expression. The regex was...

CLEANSTART-2024-DF90388 export function in libavfilter/vf_signature

Security vulnerability affects the ffmpeg4 package. The export function in libavfilter/vfsignature...

Cross-Site Scripting (XSS)

serialize-javascript is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper sanitization of attacker-influenced function source when serialized for embedding in a...

CLEANSTART-2026-MW22726 Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL

Security vulnerability affects the cri-tools package. The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL...

CentOS Linux 8 [TuxCare] Security Update: platform-python / platform-python-debug / platform-python-devel / etc (CENTOS-STREAM8:CLSA-2026:1776958842)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1776958842 advisory. - The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attacke...

CentOS Linux 6 [TuxCare] Security Update: glib2 / glib2-devel / glib2-doc / glib2-static (CENTOS6:CLSA-2025:1758709468)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2025:1758709468 advisory. - A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out. Directory...

AlmaLinux 9.2 [TuxCare] Security Update: gstreamer1 / gstreamer1-devel (ALMALINUX9.2:CLSA-2025:1764774571)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1764774571 advisory. - GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function...

PT-2026-103684

Name of the Vulnerable Software and Affected Versions Hitachi Coding Software Suite versions prior to 3.3.0 Description Missing Authentication for Critical Function allows an unauthenticated attacker to invoke a critical API. This could lead to unauthorized manipulation or the retrieval and...

CentOS Linux 7 [TuxCare] Security Update: libssh2 / libssh2-devel / libssh2-docs (CENTOS7:CLSA-2026:1787064509)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1787064509 advisory. - libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftpopen function in src/sftp.c that allows a...