CVE-2026-19353: External Control of File Name or Path

A vulnerability has been found in DedeCMS up to 5.7.118 UTF8SP2. The affected element is the function 4Setup of the file install/index.php of the component Installation Wizard. Such manipulation leads to file inclusion. The attack can be executed remotely. This attack is characterized by high...

CVE-2026-19352: Server-Side Request Forgery (SSRF)

A vulnerability was determined in mifi lossless-cut up to 3.69.0. Affected by this issue is some unknown functionality of the file src/main/httpServer.ts of the component Built-in HTTP API Service. Executing a manipulation can lead to server-side request forgery. The attack requires access to the...

MiracleLinux 9 : gimp-3.0.4-4.el9_8.5 (AXSA:2026-1494:07)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1494:07 advisory. gimp: gimp: Heap buffer overflow in readchanneldata CVE-2026-58379 Tenable has extracted the preceding description block directly from the MiracleLinux...

RCE (Remote Code Execution) org.bouncycastle:bcprov-jdk18on Dependency in Bamboo Data Center

This High severity RCE Remote Code Execution vulnerability was introduced in versions 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0 of Bamboo Data Center. This RCE Remote Code Execution vulnerability, with a CVSS Score of 8.7 and a CVSS Vector of...

Cryptographic Failure org.bouncycastle:bcpkix-jdk18on Dependency in Bamboo Data Center

This High severity Cryptographic Failure vulnerability was introduced in versions 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.0 and 12.1.0 of Bamboo Data Center. This Cryptographic Failure vulnerability, with a CVSS Score of 8.7 and a CVSS Vector of...

EulerOS 2.0 SP11 : bind (EulerOS-SA-2026-3058)

According to the versions of the bind packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack. If a victim resolver makes a query to a specially crafted zone...

SUSE CVE-2026-19151

Use after free in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-19156

Heap buffer overflow in Base in Google Chrome prior to 151.0.7922.109 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. Chromium security severity: High...

SUSE CVE-2026-19166

Use after free in Web Authentication in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-19173

Out of bounds write in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-19177

Insufficient validation of untrusted input in UI in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

CVE-2025-71409

Lack of authentication for Very High Frequency Data Link messages allows rogue ground stations to inject CPDLC messages leading to unexpected or misleading clearances and potential pilot confusion. This type of attack can be carried out remotely over radio frequency...

CVE-2025-71409 No Authentication for Very High Frequency Data Link messages used in CPDLC

Lack of authentication for Very High Frequency Data Link messages allows rogue ground stations to inject CPDLC messages leading to unexpected or misleading clearances and potential pilot confusion. This type of attack can be carried out remotely over radio frequency...

CVE-2025-71409

The CVE-2025-71409 entry describes a lack of authentication for Very High Frequency Data Link CPDLC messages, allowing rogue ground stations to inject messages remotely over radio frequency. The root cause is missing auth for VHF Datalink CPDLC, which can lead to unexpected or misleading clearanc...

CVE-2025-71409

Lack of authentication for Very High Frequency Data Link messages allows rogue ground stations to inject CPDLC messages leading to unexpected or misleading clearances and potential pilot confusion. This type of attack can be carried out remotely over radio frequency...

EUVD-2025-210653

Unnumbered Disconnect U DISC and malformed Aviation Very High Frequency Link Control frames can terminate sessions and lead to a loss of CPDLC functions requiring a reversion to voice communication and increased controller workload. This type of attack can be carried out remotely over radio...

CVE-2025-71413 In CPDLC, Malformed or Out of Sequence Frames Can Cause Resets

Malformed or out-of-sequence frames at the Aviation Very High Frequency Link Control X.25 layers cause repeated resets which may result in increased workload and reduced situational awareness. This type of attack can be carried out remotely over radio frequency...

pypdf: Possible long runtimes/large memory usage for large CID font width ranges

Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires parsing the font width entries of a font with unusually large values, for example during text extraction. Patches This has been fixed in pypdf==6.15.0. Workaroun...

CVE-2026-71852 pypdf: Possible long runtimes/large memory usage for large CID font width ranges

pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause long runtimes and large memory consumption when pypdf/font.py function Font.collectcidcharacterwidths expands unusually large CID font /W width ranges or excessive width entries during text extractio...

SUSE CVE-2026-71439

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.6.0 until 11.16.1, Mermaid Radar Diagrams allow arbitrary large values for the ticks parameter, which can cause high CPU usage and freeze the rendering webpage or JavaScript...