CVE-2026-67324

GitPython 3.1.50 contains a vulnerability where joined short options like -u are not recognized when enforcing the default unsafe-option gate. This allows an attacker-controlled clone to supply -u and bypass the gate that blocks --upload-pack/-u, causing Git to execute the specified helper during...

SUSE CVE-2026-58424

Permanent Fork PR Workflow Approval Gate Bypass...

EUVD-2026-50068

datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.62.0, XML Schema parsing in src/datamodelcodegenerator/parser/xmlschema.py for --input-file-type xmlschema resolves xs:include, xs:import, xs:redefine, and xs:override schemaLocation values outside...

MAL-2026-11122 Malicious code in @crbrc/xbt (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 179d74e089794cb517fcb4030021310137bedcc72f0ef49362b4ce1724cb5ac3 dist/index.js contains a startControlClient routine that reads OxaPay payment-gateway secrets OXAPAYGENERALAPIKEY, OXAPAYMERCHANTAPIKEY,...

CVE-2026-66397

phpMyFAQ before 4.1.6 fails to validate path traversal sequences in the existingimage field during category updates, allowing authenticated attackers to delete arbitrary files by exploiting insufficient sanitization in Image::delete. Attackers can delete the database.php configuration file to...

PT-2026-64998

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.6 Description Authenticated attackers can delete arbitrary files due to insufficient sanitization of path traversal sequences in the existing image field during category updates. This issue occurs within the...

Experimental Protocol Fingerprinting in Quantum Networks Via Physical Layer Side Channel Analysis

Quantum communication is a key enabler of next-generation networks, leveraging quantum entanglement to enable a new class of information exchange. While prior work has focused on the theoretical analysis of communication protocols, their exposure to physical layer side channel analysis remains...

UBUNTU-CVE-2026-64280

In the Linux kernel, the following vulnerability has been resolved: fpga: dfl-afu: validate DMA mapping length in afudmamapregion afuioctldmamap accepts a 64-bit length from userspace via DFLFPGAPORTDMAMAP ioctl without an upper bound check. The value is passed to afudmapinpages where npages is...

UBUNTU-CVE-2026-64514

In the Linux kernel, the following vulnerability has been resolved: userfaultfd: gate mustwait writability check on ptepresent userfaultfdmustwait and userfaultfdhugemustwait read the PTE without taking the page table lock and then apply ptewrite / hugeptewrite to it. Those accessors decode bits...

CVE-2026-64514

In the Linux kernel, the following vulnerability has been resolved: userfaultfd: gate mustwait writability check on ptepresent userfaultfdmustwait and userfaultfdhugemustwait read the PTE without taking the page table lock and then apply ptewrite / hugeptewrite to it. Those accessors decode bits...

CVE-2026-64438 crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - fix VF2PF work teardown race in adfdisablesriov The VF2PF interrupt handler queues PF-side response work that stores a raw pointer to per-VF state struct adfaccelvfinfo. Currently, adfdisablesriov destroys per-VF...

UBUNTU-CVE-2026-64249

In the Linux kernel, the following vulnerability has been resolved: fpga: region: fix use-after-free in childregionswithfirmware Move ofnodeputchildregion after the error print to avoid accessing freed memory when prerr references childregion. Yilun: Fix the Fixes tag...

EUVD-2026-48596

Unchecked input for loop condition CWE-606 in the SNMP agent in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to cause persistent denial of service CPU exhaustion via a crafted SNMP GETNEXT request with...

CVE-2026-65698 Void 1.3.4 Path Traversal via AI Agent File-Reading Tools

Void through 1.3.4 contains a path traversal vulnerability in the AI agent file-reading tools that allows network-adjacent attackers to read arbitrary host files outside the open workspace by injecting instructions into content the agent processes. Attackers can supply absolute paths or file://...

EUVD-2026-48312

Void through 1.3.4 contains a path traversal vulnerability in the AI agent file-reading tools that allows network-adjacent attackers to read arbitrary host files outside the open workspace by injecting instructions into content the agent processes. Attackers can supply absolute paths or file://...

PT-2026-64186

Name of the Vulnerable Software and Affected Versions 9router versions prior to 0.4.60 Description An issue exists involving a chain of security flaws. A hardcoded default password allows authentication on fresh installations. Additionally, the LOCAL ONLY network gate can be bypassed using a...

EUVD-2026-47663

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, when downstream DNS-over-QUIC DoQ is enabled, the first two bidirectional streams on a new QUIC connection streamid 0 and 4 bypass the per-stream 'quic-size' gate entirely, and large input buffers are allocated later, after only the 2-byte...

EUVD-2026-46802

Vulnerability in Oracle GoldenGate component: Admin Server Executable. Supported versions that are affected are 19.1.0.0.0-19.30.0.0, 21.3-21.21 and 23.4-23.26.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle GoldenGate...

EUVD-2026-46801

Vulnerability in Oracle GoldenGate component: Receiver Service Executable. Supported versions that are affected are 19.1.0.0.0-19.30.0.0, 21.3-21.21 and 23.4-23.26.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle GoldenGate...

EUVD-2026-46800

Vulnerability in Oracle GoldenGate component: Oracle GoldenGate Microservices. Supported versions that are affected are 19.1.0.0.0-19.30.0.0, 21.3-21.21 and 23.4-23.26.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle GoldenGate...