CVE-2026-59136

Use of uninitialized resource in Microsoft COM for Windows allows an authorized attacker to disclose information locally...

bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java

A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The LDAPStoreHelper implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying...

PT-2026-70620

Name of the Vulnerable Software and Affected Versions Microsoft Office affected versions not specified Description An out-of-bounds read allows an unauthorized attacker to locally disclose sensitive information, which can impact the system. Recommendations At the moment, there is no information...

PT-2026-70410

Name of the Vulnerable Software and Affected Versions AMD Zen affected versions not specified Description An issue in AMD Zen allows an authorized attacker to locally disclose sensitive information, which can affect the system. Recommendations At the moment, there is no information about a newer...

PT-2026-70472

Name of the Vulnerable Software and Affected Versions Windows GDI+ affected versions not specified Description The use of an uninitialized resource in Windows GDI+ allows an authorized attacker to disclose information locally. Recommendations At the moment, there is no information about a newer...

PT-2026-70759

Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally...

PT-2026-69984

Name of the Vulnerable Software and Affected Versions Mastodon versions 4.6.0-beta.1 through 4.6.3 Mastodon version 4.7.0-beta.1 Description An incorrect access control validation in the show action within app/controllers/admin/collections controller.rb allows any logged-in local user to access...

CVE-2026-56847

A flaw in Node.js Permission Model enforcement allows traceevents.createTracing.enable Writes Trace Logs Outside --allow-fs-write. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js 22.x, 24.x, and...

CVE-2026-6390

A flaw was found in GNU nano's multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specially crafted filename containing printf format specifiers can be reinterpreted. This format string vulnerability may allow an attacker to...

Exposure of Sensitive Information Through Metadata

Overview Affected versions of this package are vulnerable to Exposure of Sensitive Information Through Metadata via the EarlyResponseForGoGetMeta function. An attacker can obtain sensitive repository metadata, such as the existence of private repositories, their clone URLs, and default branch...

CVE-2026-16201

A vulnerability was found in zevorn rt-claw up to 0.2.0. Affected is the function clawnetget/clawnetpost of the file claw/services/tools/net.c of the component httprequest. The manipulation results in information disclosure. The attack can be executed remotely. The exploit has been made public an...

Important: container-tools:rhel8 security update

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fixes: net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME CVE-2026-33811 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial o...

GHSA-PW9Q-PQ7C-RFQW Apache Camel-Iggy: The inbound consumer maps externally-supplied Iggy message user-headers into the Exchange without a HeaderFilterStrategy

Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery SSRF vulnerability in Apache Camel in Iggy component. The camel-iggy consumer mapped the user-headers of inbound Iggy messages into the Camel Exchange header map without applying any...

AZL-91442 CVE-2026-58013 affecting package glib for versions less than 2.78.6-11

A flaw was found in GLib. A buffer over-read can occur in giochannelreadlinebackend in the giochannel.c file when a custom line terminator with a length greater than one is set, causing memcmp to read past the GString buffer. This vulnerability can cause a minor information disclosure of 7 bytes ...

kernel: smb: client: validate the whole DACL before rewriting it in cifsacl

A flaw was found in the Linux kernel's Server Message Block SMB client, specifically within the cifsacl functionality. A malicious SMB server could provide a malformed Discretionary Access Control List DACL that claims to contain more Access Control Entries ACEs than are actually present. This...

TencentOS Server 4: dnsmasq (TSSA-2026:0344)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0344 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

USN-8386-1: Nano vulnerabilities

Michał Majchrowicz and Marcin Wyczechowski discovered that Nano created the /.local directory with incorrect permissions. In environments with permissive umask settings, a local attacker could possibly use this issue to inject a malicious launcher file, resulting in information disclosure or othe...

Linux Distros Unpatched Vulnerability : CVE-2026-4893

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An information disclosure vulnerability in dnsmasq allows remote attackers to bypass source checks via a crafted DNS packet with RFC 7871 client subnet...

Unity Linux 20.1070e Security Update: netty (UTSA-2026-017767)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017767 advisory. Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. I...

GHSA-3F29-PQWF-V4J4 Grav Vulnerable to Sensitive Information Disclosure via Accounts Service Bypass

Summary Information disclosure exists in Grav CMS v1.8.0-beta.29. Despite previous security patches notably in v1.8.0-beta.27/28 aimed at restricting sensitive object access within the Twig environment, the Accounts Service remains exposed. A low-privileged user EX: Content Editor with only...