EUVD-2026-16614

GlobaLeaks is free and open-source whistleblowing software. Prior to version 5.0.89, the /api/support endpoint of GlobaLeaks performs minimal validation on user-submitted support requests. As a result, arbitrary URLs can be included in support emails sent to administrators. Version 5.0.89 patches...

CVE-2026-33871 vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-4.0, kayenta, knative-kafka-broker, hono, management-api-for-apache-cassandra-4.1, tinkerpop, zipkin, druid, grpc-java-fips, kafbat-ui, elasticsearch-fips, spark, kafka-bridge, pinot, apicurio-registry, infinispan, sonarqube,...

OESA-2026-1749 edk2 security update

EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications. Security Fixes: Issue summary: Writing large, newline-free data into a BIO chain using the line-buffering filter where the next BIO performs short writes can trigger a heap-based...

OESA-2026-1713 gimp security update

The GIMP is an image composition and editing program, which can be used for creating logos and other graphics for Web pages. The GIMP offers many tools and filters, and provides a large image manipulation toolbox, including channel operations and layers, effects, subpixel imaging and antialiasing...

OESA-2026-1718 ImageMagick security update

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats over 200 including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images,...

CLSA-2026-1774605210 expat: Fix of 2 CVEs

CVE-2026-32777: fix infinite loop while parsing DTD content - CVE-2026-32778: fix NULL pointer dereference in setContext on retry after OOM...

EUVD-2026-16573

If authusernamechars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. This leads to potentially bypassing restrictions and allows probing of LDAP structure. Do not clear out authusernamechars, or install fixed version. No publicly available exploits are...

Squid has issues in ICP message handling

...

BIT-DISCOURSE-2026-33291 Discourse user can create Zendesk tickets even when it does not have access to topic

Discourse is an open-source discussion platform. Prior to versions 2026.3.0, 2026.2.1, and 2026.1.2, moderators can create Zendesk tickets for topics they do not have access to view. This affects all forums that use the Zendesk plugin. Versions 2026.3.0, 2026.2.1, and 2026.1.2 contain a patch. No...

BELL-CVE-2026-33179

Bulletin has no description...

The vulnerability of the nft_meta_get_eval_ifname() function in the net/netfilter/nft_meta.c module of the netfilter component of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the nftmetagetevalifname function in the net/netfilter/nftmeta.c module of the netfilter component of the Linux operating system is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to compromise the...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : Mbed TLS vulnerabilities (USN-8123-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8123-1 advisory. It was discovered that Mbed TLS incorrectly handled memory allocation failures. A remote attacker could possibly use...

SUSE SLES15 Security Update : systemd (SUSE-SU-2026:1061-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1061-1 advisory. - CVE-2026-4105: privilege escalation due to improper access control in RegisterMachine D-Bus method bsc1259650. - CVE-2026-29111:...

AlmaLinux 10 : golang (ALSA-2026:5941)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:5941 advisory. cmd/go: cmd/go: Arbitrary file write via malicious pkg-config directive CVE-2025-61731 net/url: Incorrect parsing of IPv6 host literals in net/url...

PT-2026-28722

Name of the Vulnerable Software and Affected Versions Wavlink WL-WN579X3-C version 231124 Description A stack-based buffer overflow exists in the UPNP Handler component of the Wavlink WL-WN579X3-C. The issue is located in the sub 4019FC function of the /cgi-bin/firewall.cgi file. Manipulation of...

CVE-2026-24031

Dovecot SQL based authentication can be bypassed when authusernamechars is cleared by admin. This vulnerability allows bypassing authentication for any user and user enumeration. Do not clear authusernamechars. If this is not possible, install latest fixed version. No publicly available exploits...

Tenda AC5 安全漏洞

Tenda AC5 is a wireless router produced by the Chinese company Tenda. Version 15.03.06.47 of Tenda AC5 contains a security vulnerability. This vulnerability stems from improper handling of parameters in the file/goform/setcfm, specifically funcpara1, which may lead to a stack buffer overflow...

The vulnerability of the aspeedsocinfo_init() function in the drivers/soc/aspeed/aspeed-socinfo.c module of the Linux operating system’s SOC (on-chip system) kernel driver allows a attacker to cause a service failure.

The vulnerability of the aspeedsocinfoinit function in the drivers/soc/aspeed/aspeed-socinfo.c module of the Linux SOC processor kernel driver is related to improper memory release. Exploiting this vulnerability can allow an attacker to cause a system failure...

PT-2026-28741

Name of the Vulnerable Software and Affected Versions Langflow versions prior to 1.9.0 Description Langflow contains a path traversal flaw where the 'POST /api/v2/files' endpoint fails to sanitize the filename parameter within multipart form data. This allows an attacker to use path traversal...

SUSE SLES15 Security Update : kernel (Live Patch 35 for SUSE Linux Enterprise 15 SP5) (SUSE-SU-2026:1060-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:1060-1 advisory. This update for the SUSE Linux Enterprise Kernel 5.14.21-150500.55.136 fixes one security issue The following security issue was fixed: - CVE-2025-2173...