PT-2026-65372

Gitea: SSRF via HTTP Redirect in Repository Migration in code.gitea.io/gitea...

PT-2026-65382

Gitea: Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access in gitea.dev...

PT-2026-65367

Gitea: GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public-private in gitea.dev...

PT-2026-65355

Improper parsing of W3C baggage headers may lead to DoS in github.com/DataDog/dd-trace-go...

PT-2026-65352

Providing a specially crafted dictionary to s2.NewDict and using it to encode data can make the encoder read out of bounds...

PT-2026-65360

Gitea: Private Repository Metadata Remains Accessible After Access Revocation in gitea.dev...

PT-2026-65351

Ollama is Vulnerable to Path Traversal in github.com/ollama/ollama...

PT-2026-65349

Buildah allows a build-time breakout when using a malicious Containerfile or a malicious Git HTTP server. A crafted Git URL or Containerfile can cause Buildah to access files outside of the build context during an ADD or COPY operation...

PT-2026-65359

Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc...

PT-2026-65366

Gitea: Private org member list leaked via /members API endpoint — incomplete fix for PR 38145 in gitea.dev...

PT-2026-64858

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INIT FAILED before nvmet req uninit in digest error path In nvmet tcp try recv ddgst, when a data digest mismatch is detected, nvmet req uninit is called unconditionally. However, if the command arrived via the...

PT-2026-65346

The Avro array and map decoders loop over an attacker-controlled block-count value without checking the underlying reader's error state inside the loop body. Reader.ReadBlockHeader returns the count as a Go int, which is 64-bit on amd64 and arm64 targets. A producer can declare a block of up to...

PT-2026-65383

Gitea: Public-only repository tokens can update private PR head branches in gitea.dev...

PT-2026-65354

Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser in github.com/aquasecurity/trivy...

PT-2026-65364

Gitea: Private Repository Existence Disclosure via go-get Meta Endpoint in gitea.dev...

PT-2026-65347

Several Avro decoder paths read attacker-controlled 64-bit values from the wire format and either narrowed them to platform-sized int before bounds-checking, or summed them with overflow-prone signed-int arithmetic. On 32-bit targets, the truncation paths can silently bypass byte-slice limits,...

ALSA-2026:46391 Important: grafana security, bug fix, and enhancement update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation CVE-2026-44740 Bug Fixes and Enhancements: grafana / almalinux-8.10.z...

Linux Distros Unpatched Vulnerability : CVE-2026-13073

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authenticated user with read-only privileges can cause the mongod process to terminate abnormally by issuing a crafted aggregation command, resulting in deni...

Linux Distros Unpatched Vulnerability : CVE-2026-13058

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authenticated user with basic write privileges can cause the mongod process to terminate abnormally by sending a crafted transaction command with an incomple...

Siemens SIMATIC S7-1500 CPU 1518 MFP NULL Pointer Dereference (CVE-2025-23143)

"In the Linux kernel, the following vulnerability has been resolved: net: Fix null-ptr-deref by socklockinitclassandname and rmmod. When I ran the repro 0 and waited a few seconds, I observed two LOCKDEP splats: a warning immediately followed by a null-ptr-deref. 1 Reproduction Steps: 1 Mount CIF...