CVE-2026-6039

CVE-2026-6039 affects LibreOffice DXF import: a heap buffer overflow occurs when importing a DXF polyline with a point count that exceeds 16-bit during buffer sizing, while the full count is used to fill the buffer. This mismatch allows writing past the end of the buffer. In fixed versions, such ...

Security update for libcaca

This update for libcaca fixes the following issue CVE-2026-42046: an integer overflow vulnerability in libcaca's canvas import functionality may allow an attacker to cause a controlled heap out-of-bounds write bsc1264984. Patch Instructions: To install this SUSE update use the SUSE recommended...

SUSE-SU-2026:2394-1 Security update for libcaca

This update for libcaca fixes the following issue - CVE-2026-42046: an integer overflow vulnerability in libcaca's canvas import functionality may allow an attacker to cause a controlled heap out-of-bounds write bsc1264984...

YesWiki < 4.6.4 - Unauthenticated SQL Injection

YesWiki before version 4.6.4 contains an unauthenticated SQL injection vulnerability in the Bazar form-import path. The bnidnature parameter in FormManager::create is concatenated into an INSERT statement without sanitization, allowing unauthenticated attackers to inject arbitrary SQL and read th...

PT-2026-49268

Name of the Vulnerable Software and Affected Versions LibreOffice Calc affected versions not specified Description A heap buffer overflow occurs during the import of tracked changes from a spreadsheet document. This happens when a document reuses the same change identifier for two different types...

Linux Distros Unpatched Vulnerability : CVE-2026-6047

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - LibreOffice can import documents in the OOXML format DOCX. A heap buffer overflow existed when replaying deferred parser events for a text box element. A handle...

PT-2026-49265

Name of the Vulnerable Software and Affected Versions LibreOffice affected versions not specified Description A heap buffer overflow occurs during the import of documents in the OOXML DOCX format. The issue arises when replaying deferred parser events for a text box element, where a handler objec...

CVE-2026-8356

LibreOffice can import presentations in the legacy binary PPT format. A stack buffer overflow existed when importing a colour-replacement record. Two fixed-size colour tables were filled from the file, but the write position was not reset between the two passes over the record, so a file whose...

PT-2026-49262

Name of the Vulnerable Software and Affected Versions LibreOffice affected versions not specified Description A heap buffer overflow occurs during the import of drawings in DXF format used by CAD software. The issue arises when importing a DXF polyline because the point count is truncated to a...

PT-2026-49264

Name of the Vulnerable Software and Affected Versions LibreOffice affected versions not specified Description A heap buffer overflow occurs during the import of EMF+ graphics, which can be embedded in documents. Specifically, the issue arises when importing an EMF+ gradient brush. The software...

Linux Distros Unpatched Vulnerability : CVE-2026-8358

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - LibreOffice Calc can import tracked changes from a spreadsheet document. A heap buffer overflow existed when a document reused the same change identifier for tw...

Malicious code in salesforce-sysutils-diagnostics (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59e4ce1338f2439a1a5b2d257b96aadaef4a9c2883f6787343856728514bd148 setup.py unconditionally invokes curl at install time to POST the contents of /tmp/fake-keys.json to...

MAL-2026-5725 Malicious code in dash-grid-normalizer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 362011eafffa765e7f6c24df4ec2c7bb8f9fb6b6414570a5d193e6ea90e1250a On import, src/dashgridnormalizer/init.py calls hydrateremotelayoutprofile, which reassembles a payload from four string segments, base64-decodes and...

CVE-2026-45012

ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29.0 contain an authenticated server-side request forgery SSRF in the rich-text widget import flow. An authenticated user who can submit/edit rich-text widget content can cause the server to fetch...

MAL-2026-5722 Malicious code in textwrap-toolkit-stager (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9fc85924d5672f7c91c2dd5e97c46cc48e3ae48084f906b7b0ba9d606c433fa4 On import textwraptoolkitstager, the package's init.py unconditionally fetches Python source from...

CVE-2026-45012 Apostrophe has authenticated SSRF in rich-text widget import via @apostrophecms/area/validate-widget

ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29.0 contain an authenticated server-side request forgery SSRF in the rich-text widget import flow. An authenticated user who can submit/edit rich-text widget content can cause the server to fetch...

CVE-2026-45012 Apostrophe has authenticated SSRF in rich-text widget import via @apostrophecms/area/validate-widget

ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29.0 contain an authenticated server-side request forgery SSRF in the rich-text widget import flow. An authenticated user who can submit/edit rich-text widget content can cause the server to fetch...

Malicious code in nagios-xi (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c11c80cc2d314460d61a649c84fd75881388470382be8183b77b362e562a5c7f On import nagiosxi, the package's init.py lines 5-8 invokes socket.gethostbyname"atlass-check.autaeqjhfowvnnmkwhxjtq8x39d8nder1.oast.fun" inside a...

OESA-2026-2645 assimp security update

Assimp is a library to load and process geometric scenes from various data formats. Assimp aims to provide a full asset conversion pipeline for use in game engines and real-time rendering systems of any kind, but is not limited to this purpose. Security Fixes: A vulnerability, which was classifie...

WordPress WordPress & WooCommerce Scraper Plugin, Import Data from Any Site plugin <= 1.0.7 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by Bonds in WordPress Plugin WordPress & WooCommerce Scraper Plugin, Import Data from Any Site versions = 1.0.7...