PT-2026-76643

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions prior to 1.6.18 Roundcube Webmail versions 1.7.x prior to 1.7.3 Description An unclosed url in a FuncIRI attribute of an SVG image allows the evasion of remote image blocking. This flaw could potentially lead to...

ALSA-2026:55858 Important: .NET 10.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework...

PT-2026-76641

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions prior to 1.6.18 Roundcube Webmail versions 1.7.x prior to 1.7.3 Description Improper HTML/CSS sanitization of the by attribute within the SVG animate element allows for a remote image blocking bypass. This failure to...

PT-2026-73274

Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network...

PT-2026-73264

Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099966)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099966 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: xtables: avoid leaking percpu counter pointers The native and compat get-entries paths...

The vulnerability of the nvme_pr_read_keys() function in the drivers/nvme/host/pr.c kernel of the Linux operating system allows a hacker to disclose sensitive information or cause service failures.

The vulnerability of the nvmeprreadkeys function in the drivers/nvme/host/pr.c module of the Linux operating system is related to unlimited distribution of resources. Exploiting this vulnerability can allow an attacker to disclose sensitive information or cause service failures...

The vulnerability in the driver/block/rnbd/rnbd-srv.c component of the Linux operating system allows a hacker to gain access to confidential data.

The vulnerability of the drivers/block/rnbd/rnbd-srv.c component in the Linux operating system’s kernel is related to the use of an uninitialized resource. Exploiting this vulnerability could allow a remote attacker to gain access to confidential data...

The vulnerabilities of the functions IndexFile.checkout() and TagReference.create() in the GitPython library for interacting with git repositories allow a malicious individual to gain unauthorized access to protected information.

The vulnerability of the functions IndexFile.checkout and TagReference.create in the GitPython library for interacting with git repositories is related to an incorrect path name limitation when processing the kwargs parameter. Exploiting this vulnerability could allow a malicious actor to gain...

The vulnerability of the Apache Tomcat application server, related to deficiencies in authentication procedures, allows attackers to gain unauthorized access to protected information.

The vulnerability of the Apache Tomcat application server is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

Unity Linux 20.1070e Security Update: rubygem-excon (UTSA-2026-099493)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099493 advisory. Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when following...

CVE-2026-51346

SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a remote attacker to execute arbitrary code and obtain sensitive information via the store functions...

EUVD-2026-60312

SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a remote attacker to execute arbitrary code and obtain sensitive information via the store functions...

PT-2026-76647

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, insufficient Cascading Style Sheets CSS sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts. This issue exists because of insufficient fixes for...

PT-2026-76664

Name of the Vulnerable Software and Affected Versions Dell ObjectScale versions prior to 4.3.0.1 Description A Path Traversal issue exists where a low privileged attacker with local access could potentially exploit the flaw to perform information tampering. Path Traversal is a vulnerability that...

EUVD-2026-60350

Directory Traversal vulnerability in Pronis Loisirs Billetterie CSE - 04/2026 allows a remote attacker to obtain sensitive information and execute arbitrary code...

PT-2026-76800

Name of the Vulnerable Software and Affected Versions phpIPAM versions prior to 1.8.2 Description An issue exists where the software fails to verify if a requested IP address belongs to the subnet for which a temporary share token was issued. In the endpoints 'app/temp share/index.php' and...

PT-2026-76682

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.1.6 Discourse versions prior to 2026.5.2 Discourse versions prior to 2026.6.1 Discourse versions prior to 2026.7.0 Description Users permitted to view group activity but restricted from seeing shared drafts can...

CVE-2026-67918

CVE-2026-67918 is a directory traversal vulnerability in hermes-studio v.0.6.26 , located in the validatePath() function within the api/hermes/download endpoint. A remote, unauthenticated attacker can exploit this flaw to access files and directories outside the intended folder, resulting in sens...

ALSA-2026:55432 Important: curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: Information disclosure due to uncleared proxy authentication state CVE-2026-8927 For more details about the security...