gstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux FUJIFILM strd parsing leading to out-of-bounds read/write

A flaw was found in GStreamer gst-plugins-good avidemux. When parsing FUJIFILM metadata in an AVI strd chunk, gstavidemuxparsestrd decrements a remaining-length counter by fixed offsets 98 and 10 bytes without verifying sufficient data remains. For crafted strd payloads of exactly 106 or 107 byte...

[SECURITY] [DLA 4743-1] ironic security update

Debian LTS Advisory DLA-4743-1 [email protected] https://www.debian.org/lts/security/ Carlos Henrique Lima Melara August 16, 2026 https://wiki.debian.org/LTS Package : ironic Version : 1:21.4.4-0+deb12u2 CVE ID : CVE-2026-43003 CVE-2026-54421 Debian Bug : 1140012 1140187 1144214 Multipl...

MINI-QVCP-G74M-VQX9

Bulletin has no description...

MINI-FV7X-HWF3-W93G

Bulletin has no description...

MINI-6RRP-65MC-GF26

Bulletin has no description...

MINI-FQVM-3WHV-PVMW

Bulletin has no description...

MINI-486Q-C5C7-P7RH

Bulletin has no description...

MINI-VFRJ-R9W8-43QW

Bulletin has no description...

MINI-3C85-HV46-C5G6

Bulletin has no description...

MINI-QX59-63Q9-XMM2

Bulletin has no description...

MINI-P338-JCXJ-XM9C

Bulletin has no description...

MINI-8FVP-8GC8-GQ83

Bulletin has no description...

MINI-67WR-P5XW-7349

Bulletin has no description...

MINI-RQXP-WWXH-CJFQ

Bulletin has no description...

CVE-2026-19965 automad Password Reset Endpoint UserController.php requestPasswordResetToken response discrepancy

A vulnerability was determined in automad up to 2.0.0-beta.32. This vulnerability affects the function requestPasswordResetToken of the file automad/src/server/Controllers/API/UserController.php of the component Password Reset Endpoint. This manipulation of the argument name-or-email causes...

PT-2026-76648

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions prior to 1.6.18 Roundcube Webmail versions 1.7.x prior to 1.7.3 Description An LDAP search filter injection exists due to unescaped %u, %fu, and %d substitutions. This flaw could allow an attacker to cause informatio...

PT-2026-76706

In JetBrains IntelliJ IDEA before 2026.1.5 git credentials were written in plaintext to the IDE log...

CVE-2026-67918

Directory Traversal vulnerability in hermes-studio v.0.6.26 allows a remote attacker to obtain sensitive information via the validatePath function in api/hermes/download endpoint...

PT-2026-76606

Name of the Vulnerable Software and Affected Versions openssl encrypt pip versions prior to 1.4.8 Description An information exposure issue exists where the diagnostic commands 'hsm fido2-test' and 'hsm onlykey-test' unconditionally print the full derived hardware pepper as hex to stdout/stderr v...

PT-2026-76686

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap passes attacker-controlled sourceMappingURL values to joindirnameopts.from, annotation, and loadFile permits traversed ...