CVE-2026-23949

A flaw was found in jaraco.context. The jaraco.context.tarball function is vulnerable to a Zip Slip path traversal when processing malicious tar archives. A remote attacker can exploit this by crafting a specially designed tar file, which, when extracted, allows files to be written outside the...

CVE-2026-22770

A flaw was found in ImageMagick. The BilateralBlurImage method improperly initializes a memory buffer. This can lead to the release of an invalid pointer if memory allocation fails. A remote attacker could exploit this vulnerability to cause a Denial of Service DoS by providing a specially crafte...

Improper Handling of Unicode Encoding

Overview org.webjars.npm:tar is a full-featured Tar for Node.js. Affected versions of this package are vulnerable to Improper Handling of Unicode Encoding in Path Reservations via Unicode Sharp-S ß Collisions on macOS APFS. An attacker can overwrite arbitrary files by exploiting Unicode...

Integer Overflow or Wraparound

Overview Magick.NET-Q16-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

MiracleLinux 7 : kernel-3.10.0-1160.83.1.el7 (AXSA:2023-4929:03)

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-4929:03 advisory. kernel: memory corruption in AX88179178A based USB ethernet device. CVE-2022-2964 hw: cpu: LFENCE/JMP Mitigation Update for CVE-2017-5715...

Python -- poplib module, when passed a user-controlled command, can have additional commands injected using newlines

Python Software Foundation Security Developer reports: The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters...

MiracleLinux 8 : kernel-4.18.0-147.8.1.el8 (AXSA:2020-750:12)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2020-750:12 advisory. kernel: powerpc: local user can read vector registers of other users' processes via a Facility Unavailable exception CVE-2019-15030 kernel: powerpc:...

CVE-2026-23837 MyTube has an Authorization Bypass vulnerability

MyTube is a self-hosted downloader and player for several video websites. A vulnerability present in version 1.7.65 and poetntially earlier versions allows unauthenticated users to bypass the mandatory authentication check in the roleBasedAuthMiddleware. By simply not providing an authentication...

CVE-2025-68616

A Server-Side Request Forgery SSRF Protection Bypass exists in WeasyPrint's defaulturlfetcher. The vulnerability allows attackers to access internal network resources such as localhost services or cloud metadata endpoints even when a developer has implemented a custom urlfetcher to block such...

CVE-2026-0943

HarfBuzz::Shaper versions before 0.032 for Perl contains a bundled library with a null pointer dereference vulnerability. Versions before 0.032 contain HarfBuzz 8.4.0 or earlier bundled as hbsrc.tar.gz in the source tarball, which is affected by CVE-2026-22693. Mitigation Mitigation for this issu...

CVE-2026-1200

A flaw was found in the rgaufman/live555 fork of live555. A remote attacker could exploit a segmentation fault, in the increaseBufferTo function. This vulnerability can lead to memory corruption problems and potentially other consequences. Mitigation Mitigation for this issue is either not...

CVE-2026-1190

A flaw was found in Keycloak's SAML brokering functionality. When Keycloak is configured as a client in a Security Assertion Markup Language SAML setup, it fails to validate the NotOnOrAfter timestamp within the SubjectConfirmationData. This allows an attacker to delay the expiration of SAML...

CVE-2026-0603

A flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing specially crafted, unsanitized non-alphanumeric characters in the ID column when the InlineIdsOrClauseBuilder is used. This could lead to sensitive informatio...

CVE-2025-15537

A flaw was found in Mapnik. A local attacker can exploit a heap-based buffer overflow vulnerability by manipulating the mapnik::dbffile::stringvalue function in plugins/input/shape/dbfile.cpp. This vulnerability can lead to information disclosure, data integrity issues, and denial of service. A...

CVE-2025-15533

A flaw was found in raylib. A local user could exploit a heap-based buffer overflow vulnerability by manipulating data within the GenImageFontAtlas function. This could lead to information disclosure, data corruption, or denial of service. Mitigation Mitigation for this issue is either not...

CVE-2025-15534

A flaw was found in raylib. A local user could exploit an integer overflow vulnerability in the LoadFontData function. This flaw may lead to information disclosure, data modification, or denial of service, impacting the availability, integrity, and confidentiality of the application. Mitigation...

Techniques of Modern Attacks

The techniques used in modern attacks have become an important factor for investigation. As we advance further into the digital age, cyber attackers are employing increasingly sophisticated and highly threatening methods. These attacks target not only organizations and governments but also extend...

PT-2026-3495

Name of the Vulnerable Software and Affected Versions MyTube versions prior to 1.7.66 Description MyTube is a self-hosted downloader and player for several video websites. A flaw allows unauthenticated users to bypass the authentication check in the roleBasedAuthMiddleware. By not providing an...

FreeBSD : Mozilla -- multiple vulnerabilities (06061c59-f212-11f0-9ca3-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 06061c59-f212-11f0-9ca3-b42e991fc52e advisory. Incorrect boundary conditions in the Graphics component. Use-after-free in the IPC component...

OESA-2026-1087 firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. %if 0 %global mozdebugprefix /lib/debug %global mozdebugdir /lib/debug/ %global unamem %uname -m %global symbolsfilename -.en-US.-%uname.crashreporter-symbols.zip %global symbolsfilepath...