CVE-2026-63667 ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal

ApostropheCMS is an open-source Node.js content management system. Prior to 3.6.2, the import-export module in packages/import-export/lib/formats/gzip.js constructs an attachment source path from the attacker-controlled id, name, and extension fields in aposAttachments.json without ensuring that...

CVE-2026-72057

A flaw was found in the Linux kernel's networking subsystem, specifically within the actct module. This vulnerability occurs when the kernel processes fragmented network traffic, failing to correctly preserve essential packet metadata. An attacker could exploit this by sending specially crafted...

UBUNTU-CVE-2026-68520

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, asdictsecure in glances/config.py checks only option names and exposes publicusername and credentials embedded in publicapi values through unauthenticated GET /api/4/config and GET /api/4/config/ip requests. This iss...

Incomplete List of Disallowed Inputs

Overview openssl-encrypt is an A package for secure file encryption and decryption based on modern ciphers using heavy-compute-load chaining of hashing and KDF to generate strong encryption password based on users provided password to ensure secure encryption of files Affected versions of this...

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Overview openssl-encrypt is an A package for secure file encryption and decryption based on modern ciphers using heavy-compute-load chaining of hashing and KDF to generate strong encryption password based on users provided password to ensure secure encryption of files Affected versions of this...

CVE-2026-72029

A flaw was found in the Linux kernel's Wireless Wide Area Network WWAN module, specifically within the iosm component. A remote attacker, by manipulating a connected modem, could provide malformed data containing crafted offsets and lengths. This could lead to an out-of-bounds read, potentially...

CVE-2026-54284

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, TokenList construction and string conversion in sqlparse/sql.py repeatedly flatten nested token subtrees constructed by groupparenthesis and groupcase, causing quadratic CPU consumption through sqlparse.parse,...

Incorrect Permission Assignment for Critical Resource

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource in the NodeVM configuration when builtin: '' is used, which exposes the os and dns modules to...

NPM: vm2: NodeVM `builtin: ['*']` exposes `os` and `dns` — process-wide observability reads AND writes that hijack the host (sibling class of GHSA-9g8x-92q2-p28f)

NPM: vm2: NodeVM builtin: '' exposes os and dns — process-wide observability reads AND writes that hijack the host sibling class of GHSA-9g8x-92q2-p28f vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.5...

Terragrunt: Arbitrary File Deletion via Malicious Module Manifest

Summary Terragrunt is vulnerable to an arbitrary file deletion flaw when downloading external modules. If a remote module contains a maliciously crafted .terragrunt-module-manifest file, Terragrunt can be tricked into deleting files anywhere on the local filesystem that the Terragrunt process has...

GHSA-8394-6F8R-WHXG Terragrunt: Arbitrary File Deletion via Malicious Module Manifest

Summary Terragrunt is vulnerable to an arbitrary file deletion flaw when downloading external modules. If a remote module contains a maliciously crafted .terragrunt-module-manifest file, Terragrunt can be tricked into deleting files anywhere on the local filesystem that the Terragrunt process has...

SUSE CVE-2026-68152

In the Linux kernel, the following vulnerability has been resolved: amt: fix use-after-free in AMT delayed works When an AMT device is removed, pending delayed works can still access the freed amtdev structure, which may result in kernel crashes or memory corruption. amtdevstop cancels reqwq and...

CVE-2026-68479

A flaw was found in the Linux kernel's Bluetooth btrtl module. This vulnerability allows a local attacker to provide a specially crafted firmware patch during Bluetooth setup. This can cause an integer underflow, leading to an oversized read and write operation. Such an operation can result in...

CVE-2026-74442

A flaw was found in the Linux kernel's drm/vmwgfx driver. This vulnerability occurs when the vmwvkmsinit function fails to initialize a workqueue, leaving a pointer as NULL. During module unload, the vmwvkmscleanup function attempts to destroy this NULL workqueue, leading to a kernel panic. A loc...

CVE-2026-74471

A flaw was found in the Linux kernel's tracing subsystem. The tracemoduleaddevents function does not properly check the return value of registerevent. If event registration fails, a pointer to an event can still be created and retained even after the associated module memory is freed. This can le...

CVE-2026-74887

opensslencrypt before 1.4.0 imports Python's non-cryptographic 'random' module Mersenne Twister PRNG at line 15 of opensslencrypt/modules/pqc.py. No direct calls to random. were present in the code, so no cryptographic operation is currently affected; however, the import creates a hazard that...

CVE-2026-74885

opensslencrypt versions before 1.4.0 contain a logging bug in restorehiddenmodules that logs module counts after clearing, always showing zero restored modules and corrupting audit trails. Additionally, a race condition exists between module hiding and import hook installation where another threa...

CVE-2026-74886

opensslencrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where the PluginImportGuard blocks a different set of modules than the AST analyzer's DANGEROUSMODULES set. Attackers can bypass AST analysis through string obfuscation or encoding to import unblocked dangerous...

PYSEC-2026-3762

opensslencrypt versions before 1.4.0 contain a logging bug in restorehiddenmodules that logs module counts after clearing, always showing zero restored modules and corrupting audit trails. Additionally, a race condition exists between module hiding and import hook installation where another threa...

PYSEC-2026-3745

opensslencrypt before 1.4.0 imports Python's non-cryptographic 'random' module Mersenne Twister PRNG at line 15 of opensslencrypt/modules/pqc.py. No direct calls to random. were present in the code, so no cryptographic operation is currently affected; however, the import creates a hazard that...