PT-2026-120802

Name of the Vulnerable Software and Affected Versions Django REST framework versions 3.6.4 through 3.18.1 Description The JSONParser.parse function in rest framework/parsers.py uses the client-supplied Content-Type charset value with codecs.getreader. This allows the use of byte-transform codecs,...

Red Hat: CVE-2026-96644: pillow: Pillow: Denial of Service via out-of-bounds read in metafile parser

Pillow is a Python imaging library. Prior to 13.0.0 on Windows, src/PIL/WmfImagePlugin.py passes unchecked 32-bit WMF or EMF dimensions to the native drawwmf handler in src/display.c. The handler sizes a DIB allocation from 16-bit-truncated bcWidth and bcHeight fields but copies pixel data using...

PT-2026-120822

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 13.0.0 Description On Windows, the src/PIL/WmfImagePlugin.py component passes unchecked 32-bit WMF or EMF dimensions to the native drawwmf handler in src/display.c. The handler determines the size of a Device Independe...

PT-2026-120818

Name of the Vulnerable Software and Affected Versions Pillow versions 9.1.0 through 12.x Description The BmpRleDecoder.decode function in src/PIL/BmpImagePlugin.py allows crafted RLE BMP delta escapes and absolute-mode runs to append data beyond the remaining dest length because it lacks a...

Red Hat: CVE-2026-96638: pillow: pillow: Denial of Service via crafted RLE BMP image

Pillow is a Python imaging library. From 9.1.0 until 13.0.0, BmpRleDecoder.decode in src/PIL/BmpImagePlugin.py permits crafted RLE BMP delta escapes and absolute-mode runs to append beyond the remaining destlength without a per-branch cap. A delta can add roughly 255 image rows in one iteration, ...

PT-2026-120169

FreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipboard PNG-to-CF DIB synthesis because winpr read png from buffer allocates a bit-packed buffer for PNGs with bit depth below 8, while winpr bitmap write buffer copies rows assuming one byte per pixel. A malicious RDP...

Linux Distros Unpatched Vulnerability : CVE-2026-113131

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML...

Linux Distros Unpatched Vulnerability : CVE-2026-113022

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in PDFium in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a...

Linux Distros Unpatched Vulnerability : CVE-2026-113199

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Out of bounds read in Payments in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-113007

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via...

Linux Distros Unpatched Vulnerability : CVE-2026-113296

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML...

Linux Distros Unpatched Vulnerability : CVE-2026-113301

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox v...

PT-2026-120155

Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls appear inside tuples or nested calls. Contracts using such calls as tuple elements, call arguments, or builtin arguments like concat or ecrecover can...

Linux Distros Unpatched Vulnerability : CVE-2026-113139

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in Autofill in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML...

PT-2026-120542

Uncontrolled resource consumption in the HTTP/2 h2 receive path of Apache bRPC version 1.18.0 on all platforms allows a remote unauthenticated attacker to crash the server or grow its memory without bound by sending crafted HTTP/2 frames. Root Cause: The h2 parser, enabled by default on every bRP...

Linux Distros Unpatched Vulnerability : CVE-2026-113125

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML...

Linux Distros Unpatched Vulnerability : CVE-2026-113132

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a...

Linux Distros Unpatched Vulnerability : CVE-2026-113279

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in Accessibility in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox vi...

Linux Distros Unpatched Vulnerability : CVE-2026-113144

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in Speech in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. Chromiu...

ALSA-2026:86983 Important: openexr security update

OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR. Security Fixes:...