PT-2026-60187

When NGINX Plus is configured to use the Message Queuing Telemetry Transport MQTT filter module ngx stream mqtt filter module, unauthenticated attackers can send requests with conditions beyond the attacker's control to cause a heap buffer over-read in the NGINX worker process, leading to a...

PT-2026-60207

Nixpkgs is a collection of software packages that can be installed with the Nix package manager. Prior to the 25.11 and 26.05 channel fixes, the NixOS module for MySQL services.mysql initializes the MySQL database in a way that allows local users, such as unprivileged web or CGI processes on the...

ProfMalPlus: Agent-Coordinated Detection of Malicious NPM Packages Via Static-Dynamic Analysis Synergy

Open source software is vulnerable to supply-chain attacks through transitive dependencies, especially malicious code injected into NPM packages. Existing detectors often inadequately model obfuscated behavior, overlook JavaScript's object-centric features, poorly coordinate static and dynamic...

CVE-2026-61828: Incorrect Default Permissions

Nixpkgs is a collection of software packages that can be installed with the Nix package manager. Prior to the 25.11 and 26.05 channel fixes, the NixOS module for MySQL services.mysql initializes the MySQL database in a way that allows local users, such as unprivileged web or CGI processes on the...

CVE-2026-33213: URL Redirection to Untrusted Site

Redash is a package for data visualization and sharing. From 5.0.2 to 26.3.0, the getnextpath function in Redash's authentication module stripped the scheme and netloc from user-supplied next parameters but did not normalize multiple leading slashes, allowing a crafted login URL such as...

CVE-2026-58556: Undefined Security Weakness

Permission control vulnerability in the Bluetooth module. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-58555: Undefined Security Weakness

Permission bypass vulnerability in the card module. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-58554: Exposure of Sensitive Information to an Unauthorized Actor

Permission control vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2026-58553: Buffer Copy without Checking Size of Input

Out-of-bounds read vulnerability in the image codec module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2026-58552: Buffer Copy without Checking Size of Input

Out-of-bounds read vulnerability in the image codec module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

PT-2026-108667

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-m6wp-h223-4c8g. This link is maintained to preserve external references. Original Description PraisonAI praisonaiagents before 1.6.78 contains a remote code execution vulnerability in the plugin manager, which...

Apache HTTP Server mod_http2 DoS

The vulnerability of the modhttp2 module in the Apache HTTP Server is related to the possibility of using memory after it is released. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

Apache HTTP Server modheaders mod_mime Data Compromise

The vulnerability of the modheaders and modmime modules in the Apache HTTP Server relates to reading data beyond the permitted range of memory. Exploiting this vulnerability can allow an attacker to compromise the confidentiality and integrity of the protected information...

Apache HTTP Server mod_lda Module RCE

The vulnerability of the modlda module in the Apache HTTP Server is related to the ability to utilize memory after it is freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code or cause a denial-of-service attack...

Python pip Code Execution

The vulnerability of the Python programming language’s pip module is related to the inclusion of functions from an unverified and uncontrolled area. Exploiting this vulnerability can allow a perpetrator to execute arbitrary code...

RHEL 10 : perl-XML-LibXML (RHSA-2026:39547)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:39547 advisory. This module implements a Perl interface to the GNOME libxml2 library which provides interfaces for parsing and manipulating XML files. This module...

Drupal core - Moderately critical - Information disclosure - SA-CORE-2026-010

The Image module allows you to define and configure image fields. The module doesn't sufficiently check access to image style derivatives when those files are served via a file stream other than private://. This vulnerability is mitigated by the fact that Drupal must be configured to use a...

CVE-2026-58549: Buffer Copy without Checking Size of Input

Out-of-bounds read vulnerability in the image codec module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

PT-2026-60206

Name of the Vulnerable Software and Affected Versions NGINX Plus affected versions not specified NGINX Open Source affected versions not specified Description A flaw exists in the ngx http slice module module. When the slice directive is used with unnamed regex captures or during a background cac...

CPython Webbrowser Command Execution

The vulnerability of the webbrowser module in the CPython interpreter is related to the lack of measures taken to protect data at the operating level. Exploiting this vulnerability allows an attacker to execute arbitrary commands...