CVE-2026-61721

A flaw was found in FluidSynth, a software synthesizer. The native DLS Downloadable Sounds loader, responsible for processing sound samples, does not properly validate certain values within crafted DLS files. This oversight allows an attacker to define sample loop points that extend beyond the...

CVE-2026-95897

A flaw was found in Dask, specifically within the fromnpystack function of the Loader component. A remote attacker could exploit this deserialization vulnerability through manipulation, potentially leading to a low impact on the confidentiality, integrity, and availability of data. Mitigation...

CVE-2026-95897

A security vulnerability has been detected in Dask up to 2026.8.0. This affects the function fromnpystack of the file dask/array/core.py of the component Loader. Such manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed publicly and may be use...

CVE-2026-95897

A security vulnerability has been detected in Dask up to 2026.8.0. This affects the function fromnpystack of the file dask/array/core.py of the component Loader. Such manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed publicly and may be use...

UBUNTU-CVE-2026-95897

A security vulnerability has been detected in Dask up to 2026.8.0. This affects the function fromnpystack of the file dask/array/core.py of the component Loader. Such manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed publicly and may be use...

CVE-2026-95897 Dask Loader core.py from_npy_stack deserialization

A security vulnerability has been detected in Dask up to 2026.8.0. This affects the function fromnpystack of the file dask/array/core.py of the component Loader. Such manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed publicly and may be use...

EUVD-2026-84993

A security vulnerability has been detected in Dask up to 2026.8.0. This affects the function fromnpystack of the file dask/array/core.py of the component Loader. Such manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed publicly and may be use...

CVE-2026-95897 Dask Loader core.py from_npy_stack deserialization

A security vulnerability has been detected in Dask up to 2026.8.0. This affects the function fromnpystack of the file dask/array/core.py of the component Loader. Such manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed publicly and may be use...

CVE-2026-95897

A security vulnerability exists in Dask up to version 2026.8.0 within the Loader component. The flaw is located in the from_npy_stack function of the dask/array/core.py file, where improper handling leads to deserialization issues. This vulnerability can be exploited via a remote attack . While t...

CVE-2026-95897

A security vulnerability has been detected in Dask up to 2026.8.0. This affects the function fromnpystack of the file dask/array/core.py of the component Loader. Such manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed publicly and may be use...

CVE-2026-95897 Dask Loader core.py from_npy_stack deserialization

A security vulnerability has been detected in Dask up to 2026.8.0. This affects the function fromnpystack of the file dask/array/core.py of the component Loader. Such manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed publicly and may be use...

CVE-2026-79310: Improper Control of Generation of Code

webpy web.py 0.76 is vulnerable to server-side template injection SSTI. The template engine can be tricked into executing attacker-controlled template code that built-in security checks are designed to reject. When an application precompiles templates from a directory the attacker can write to an...

CVE-2026-79310

webpy web.py 0.76 is vulnerable to server-side template injection SSTI. The template engine can be tricked into executing attacker-controlled template code that built-in security checks are designed to reject. When an application precompiles templates from a directory the attacker can write to an...

CVE-2026-79310

webpy web.py 0.76 is vulnerable to server-side template injection (SSTI) . The vulnerability exists because the template engine can be manipulated into executing attacker-controlled code that bypasses built-in security checks. Specifically, if an application precompiles templates from a directory...

CVE-2026-96545: Out-of-bounds Read

An out-of-bounds heap read flaw was found in GIMP's TIM image loader. When a user opens a crafted 4bpp TIM image that causes promotion to an RGBA layer, the file-tim plug-in allocates an undersized row buffer but processes it using the larger RGBA row size. This can copy adjacent heap contents in...

PT-2026-97540

Name of the Vulnerable Software and Affected Versions Ansible Automation Platform automation-controller affected versions not specified Description A flaw exists in the custom Credential Type environment-variable injector. The system validates variable names using a deny-list consisting of an...

PT-2026-97119

Name of the Vulnerable Software and Affected Versions Dask versions prior to 2026.8.1 Description A remote deserialization issue exists within the Loader component. The flaw is located in the from npy stack function of the dask/array/core.py file, where improper handling of input can lead to the...

PT-2026-97519

Name of the Vulnerable Software and Affected Versions GIMP versions prior to 3.2.6-3.1 Description An out-of-bounds heap read flaw exists in the TIM image loader. When processing a specially crafted 4bpp TIM image that triggers promotion to an RGBA layer, the file-tim plug-in allocates a row buff...

OPENSUSE-SU-2026:11859-1 gdk-pixbuf-loader-libheif-1.23.5-1.1 on GA media

These are all security issues fixed in the gdk-pixbuf-loader-libheif-1.23.5-1.1 package on the GA media of openSUSE Tumbleweed...

MAL-2026-16419 Malicious code in @gsutevil/hta-stage (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 590b3432b8d849d5772e3be7a4fbc7daeca4aa927be2d411aaf3054d9a223dc9 The package ships a Windows HTA/WSH loader that installs a remote MSI on the victim host under the control of a base URL supplied at runtime via...