PT-2026-60821

Summary When Deno was run in BYONM mode nodeModulesDir: "manual", the module resolver did not validate that a package's resolved entrypoint stayed within its node modules// directory. A malicious package.json whose main field contained .. segments was able to resolve to an arbitrary path on disk,...

PT-2026-56190

Name of the Vulnerable Software and Affected Versions OPNsense versions prior to 26.1.10 Description The Trust module contains a stored XPath injection flaw. A user with CA Manager or Certificate Manager privileges can submit a crafted refid value that is interpolated into XPath expressions withi...

ALSA-2026:36331 Important: nginx security, bug fix, and enhancement update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fixes: nginx: NGINX: Arbitrary code execution or Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers CVE-2026-42055 Bug Fixes...

ALSA-2026:36364 Important: nginx security, bug fix, and enhancement update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fixes: nginx: NGINX: Arbitrary code execution or Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers CVE-2026-42055 Bug Fixes...

Important: nginx security, bug fix, and enhancement update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fixes: nginx: NGINX: Arbitrary code execution or Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers CVE-2026-42055 Bug Fixes...

PT-2026-56167

EEPROM firmware on Raspberry Pi 5 and Compute Module 5 devices produced non-random KASLR and RNG seed values. This resulted in consistent kernel addresses across boots and devices, potentially making it easier to exploit other vulnerabilities. Additionally, the low-quality RNG seed may affect the...

PT-2026-56229

Name of the Vulnerable Software and Affected Versions Joomla! CMS versions 4.0.0 through 5.4.6 Joomla! CMS versions 6.0.0 through 6.1.1 Description Improper access control in the com modules component allows users to display a list of modules in the frontend that they should not be able to see...

CVE-2011-10043: Improper Neutralization of Section Delimiters

Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded. Module names starting with "::" could be passed to the load function to specify arbitrary module paths. Attackers able to influence module names passed to load could use that bug to execute arbitrary...

CVE-2026-48956: Improper Access Control

An improper access check allows users to display a list of modules in the frontend...

CVE-2026-23698: Unrestricted Upload of File with Dangerous Type

Vtiger CRM through 8.4.0 contains an authenticated remote code execution vulnerability in the admin module import feature that allows administrator-level attackers to upload arbitrary PHP files by submitting a crafted zip archive through the ModuleManager import function, which extracts contents...

CVE-2026-13199: Insufficient Entropy

EEPROM firmware on Raspberry Pi 5 and Compute Module 5 devices produced non-random KASLR and RNG seed values. This resulted in consistent kernel addresses across boots and devices, potentially making it easier to exploit other vulnerabilities. Additionally, the low-quality RNG seed may affect the...

Linux SMB Server Buffer Overflow DoS

The vulnerability of the smb2sesssetup function in the fs/smb/server/smb2pdu.c module of the SMB server implementation in Linux operating systems is related to errors during link counters updates. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-56207

Vtiger CRM before 8.4.0 contains an authenticated file upload vulnerability that allows low-privileged users to achieve remote code execution by uploading a .phar file containing arbitrary PHP code through the Documents module, bypassing the extension denylist in config.inc.php which omits the...

PT-2026-56208

Vtiger CRM through 8.4.0 contains an authenticated remote code execution vulnerability in the admin module import feature that allows administrator-level attackers to upload arbitrary PHP files by submitting a crafted zip archive through the ModuleManager import function, which extracts contents...

PT-2026-56223

Name of the Vulnerable Software and Affected Versions Joomla! Core affected versions not specified Description Lack of escaping in the file management view of the com templates component leads to a Cross-Site Scripting XSS issue. XSS is a flaw that allows an attacker to inject malicious scripts...

CVE-2026-23697: Unrestricted Upload of File with Dangerous Type

Vtiger CRM before 8.4.0 contains an authenticated file upload vulnerability that allows low-privileged users to achieve remote code execution by uploading a .phar file containing arbitrary PHP code through the Documents module, bypassing the extension denylist in config.inc.php which omits the...

PT-2026-56182

Name of the Vulnerable Software and Affected Versions Module::Load versions prior to 0.22 Description Module::Load for Perl allows the loading of arbitrary modules outside of the @INC array, which is the default list of directories Perl searches for modules. This occurs because module names...

CVE-2026-44454: Improper Neutralization of Special Elements used in an OS Command

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7 and 2.30.2, the dotfiles registry module passed unsanitized user input to shell commands, allowing arbitrary code execution inside a provisioned workspace. Any user who supplied a craft...

kernel security, bug fix, and enhancement update

5.14.0-687.19.1 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug:...

QUBO Modeling of Module Learning with Errors: Stability and Scaling in Post-Quantum Cryptography

Lattice-based post-quantum cryptography relies on the hardness of the Learning With Errors LWE and Module Learning With Errors MLWE problems. This work introduces a constructive framework for encoding small MLWE instances as Quadratic Unconstrained Binary Optimization QUBO models suitable for...