Linux Distros Unpatched Vulnerability : CVE-2026-78475

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the file-pix ESM plugin in GIMP. When processing a specially crafted PIX image file, the plugin allocates a Variable-Length Array VLA on the...

MiracleLinux 8 : python-urwid-1.3.1-5.el8_10 (AXSA:2026-1644:01)

The remote MiracleLinux 8 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1644:01 advisory. urwid: Urwid: Predictable session IDs lead to remote code execution and information disclosure CVE-2026-9323 Tenable has extracted the preceding description...

RHEL 8 : python-urwid (RHSA-2026:59198)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:59198 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...

RHEL 9 : python-urwid (RHSA-2026:58953)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:58953 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...

CVE-2026-59640

A flaw was found in Bouncy Castle for Java. A remote attacker can exploit an OpenPGP Open Pretty Good Privacy Cipher Feedback CFB quick-check oracle vulnerability. This oracle, active on symmetric and session-key paths, could allow an attacker to gain sensitive information by observing the result...

AZL-97929 CVE-2026-56136 affecting package ntfs-3g 2022.10.3-3

In NTFS-3G through 2026.2.25, an out-of-bounds read exists in ntfsirnill in libntfs-3g/index.c that allows an attacker to read possibly confidential information in an ntfs-3g process by crafting a malicious NTFS image. This read operation is triggered by creation of a file with a crafted name...

CVE-2026-56136

In NTFS-3G through 2026.2.25, an out-of-bounds read exists in ntfsirnill in libntfs-3g/index.c that allows an attacker to read possibly confidential information in an ntfs-3g process by crafting a malicious NTFS image. This read operation is triggered by creation of a file with a crafted name...

CVE-2026-55468

Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines, the internal Pages admin API returns page fields declared in apifields without sufficient access control, allowing a user with Wagtail admin...

CVE-2026-16782

A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process...

urwid: Urwid: Predictable session IDs lead to remote code execution and information disclosure

A flaw was found in the urwid web display backend. This vulnerability arises from the use of a cryptographically insecure pseudo-random number generator PRNG for web session identifiers, making them predictable. An attacker could either observe enough session IDs to reconstruct the PRNG state or,...

Important: Red Hat Security Advisory: python-urwid security update

An update for python-urwid is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common...

CVE-2025-42558

creationtimestamp| type| source ---|---|--- 2026-08-24 21:00:05+00:00| seen| Telegram/0Lzh2WjQOWsuTydOWekHZzZKDiwWQ3jcpMbWJHlr9UUA 2026-08-25 00:00:08+00:00| published-proof-of-concept| Telegram/0Lzh2WjQOWsuTydOWekHZzZKDiwWQ3jcpMbWJHlr9UUA...

EUVD-2026-65150

A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process...

CVE-2026-55468 Wagtail: Improper restriction handling on Pages admin API

Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines, the internal Pages admin API returns page fields declared in apifields without sufficient access control, allowing a user with Wagtail admin...

CVE-2026-55468 Wagtail: Improper restriction handling on Pages admin API

Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines, the internal Pages admin API returns page fields declared in apifields without sufficient access control, allowing a user with Wagtail admin...

CVE-2026-55468

CVE-2026-55468 affects the internal Pages admin API in Wagtail , an open-source CMS built on Django. The API returns page fields declared in api_fields without sufficient access control , allowing any user with Wagtail admin access to retrieve restricted draft and live page content , including ba...

CVE-2026-78555

RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface displayed only a shortened representation of each key, the full token was embedded in hidden form fields used by the enable/disable, private-access, and delete...

GHSA-FWJF-M4QW-9F2X django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)

Summary The CMS page cache key ignores the request headers that plugins declare via getvarycacheon. The header is added to the response Vary header, but the CMS's own cache key does not incorporate the header values, so the first visitor's variant is served to all subsequent visitors regardless o...

django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)

Summary The CMS page cache key ignores the request headers that plugins declare via getvarycacheon. The header is added to the response Vary header, but the CMS's own cache key does not incorporate the header values, so the first visitor's variant is served to all subsequent visitors regardless o...

CVE-2026-78555 RansomLook API Key Disclosure Through /admin/apikeys HTML Source

RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface displayed only a shortened representation of each key, the full token was embedded in hidden form fields used by the enable/disable, private-access, and delete...