CVE-2026-59980: Uncontrolled Resource Consumption

hpack is an HTTP/2 Header Encoding for Python. Prior to version 4.2.0, unbounded variable integer decoding can cause run-away computation on malformed input leading to On^2 runtime, effectively blocking further processing with large enough unsanitized input. A fix is available in python-hyper/hpa...

The vulnerability of the Skia graphic library used by Google Chrome and Microsoft Edge web browsers allows a hacker to induce a service failure.

The vulnerability of the Skia graphics library in Google Chrome and Microsoft Edge browsers is related to errors during variable initialization. Exploiting this vulnerability can allow an attacker to cause service interruptions...

ROS-20260923-73-0100

The vulnerability of the openbyhandleat function in the Linux operating system’s kernel is related to the use of an uninitialized variable. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-97121

Name of the Vulnerable Software and Affected Versions SourceCodester Online Reviewer Management System version 1.0 Description Remote SQL injection is possible through the manipulation of the difficulty id variable within an unknown function of the '/reviewer 0/admins/assessments/databank/btn...

Linux Distros Unpatched Vulnerability : CVE-2026-95332

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use of uninitialized variable in Tint. CVE-2026-95332 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C...

PT-2026-97617

Name of the Vulnerable Software and Affected Versions GitLab EE versions 18.7 through 19.2.6 GitLab EE versions 19.3 through 19.3.2 GitLab EE versions 19.4 Description An issue exists where an authenticated user can access sensitive CI/CD variable values through the Duo AI troubleshooting feature...

The vulnerability of the Skia graphic library used by Google Chrome and Microsoft Edge web browsers allows a hacker to induce a service failure.

The vulnerability of the Skia graphics library in Google Chrome and Microsoft Edge browsers is related to errors during variable initialization. Exploiting this vulnerability can allow an attacker to cause service interruptions...

RHEL 10 / 9 : Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update (Critical) (RHSA-2026:71113)

The remote Redhat Enterprise Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:71113 advisory. Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT...

GitLab 18.7 < 19.2.7 / 19.3 < 19.3.3 / 19.4 < 19.4.1 (CVE-2026-92470)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated...

PT-2026-97329

Name of the Vulnerable Software and Affected Versions REDAXO versions prior to 5.21.2 Description A stored cross-site scripting XSS issue exists in the REDAXO content management system. The mediaIsInUse function in redaxo/src/addons/media manager/lib/media manager.php, when invoked through the...

Linux Distros Unpatched Vulnerability : CVE-2026-63278

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server o...

PT-2026-97157

Name of the Vulnerable Software and Affected Versions Newsletters WordPress plugin versions prior to 4.18.1 Description The plugin fails to perform ownership checks on certain subscriber management actions and grants management sessions to unauthenticated visitors upon request. This allows...

PT-2026-97539

Name of the Vulnerable Software and Affected Versions Klever-Go versions prior to 1.7.20 Description An issue exists in the Elasticsearch indexer component where the serializedDataForUpdateAccounts function in indexer/common.go fails to escape the acc.Name variable when constructing bulk JSON and...

Malicious code in @memtensor/memos-cloud-openclaw-plugin (npm)

On September 23, 2026, an attacker published malicious versions of two MemTensor packages. The affected packages are the OpenClaw plugin @memtensor/memos-cloud-openclaw-plugin on npm and the MemOS Python library MemoryOS on PyPI. Both versions contain the same Go implant, sckit. The binary runs i...

Malicious code in memoryos (PyPI)

On September 23, 2026, an attacker published malicious versions of two MemTensor packages. The affected packages are the OpenClaw plugin @memtensor/memos-cloud-openclaw-plugin on npm and the MemOS Python library MemoryOS on PyPI. Both versions contain the same Go implant, sckit. The binary runs i...

PT-2026-97320

Name of the Vulnerable Software and Affected Versions sudo affected versions not specified Description A flaw exists in the evaluation of time-based access restrictions in sudoers rules. When NOTBEFORE or NOTAFTER timestamps omit the trailing 'Z' timezone indicator, the system relies on the TZ...

PT-2026-97540

Name of the Vulnerable Software and Affected Versions Ansible Automation Platform automation-controller affected versions not specified Description A flaw exists in the custom Credential Type environment-variable injector. The system validates variable names using a deny-list consisting of an...

PT-2026-97214

Name of the Vulnerable Software and Affected Versions Foxit PDF Editor/Reader affected versions not specified Description The FileOpen plugin fails to properly validate encryption metadata within specially crafted PDF files. This flaw can leave an internal pointer in an invalid state, leading to...

PT-2026-97550

Name of the Vulnerable Software and Affected Versions Ansible Automation Platform automation-controller affected versions not specified Description An argument-injection flaw exists in the system-job subsystem. The system-job template launch endpoint fails to perform integer validation on the...

PT-2026-97330

Name of the Vulnerable Software and Affected Versions REDAXO versions prior to 5.21.2 Description REDAXO is a PHP-based content management system. The Mediapool Sync page, located at the endpoint redaxo/src/addons/mediapool/pages/sync.php, fails to apply the rex escape function which performs HTM...