PT-2026-60167

Permission control vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

PT-2026-60207

Nixpkgs is a collection of software packages that can be installed with the Nix package manager. Prior to the 25.11 and 26.05 channel fixes, the NixOS module for MySQL services.mysql initializes the MySQL database in a way that allows local users, such as unprivileged web or CGI processes on the...

ProfMalPlus: Agent-Coordinated Detection of Malicious NPM Packages Via Static-Dynamic Analysis Synergy

Open source software is vulnerable to supply-chain attacks through transitive dependencies, especially malicious code injected into NPM packages. Existing detectors often inadequately model obfuscated behavior, overlook JavaScript's object-centric features, poorly coordinate static and dynamic...

CVE-2026-61828: Incorrect Default Permissions

Nixpkgs is a collection of software packages that can be installed with the Nix package manager. Prior to the 25.11 and 26.05 channel fixes, the NixOS module for MySQL services.mysql initializes the MySQL database in a way that allows local users, such as unprivileged web or CGI processes on the...

CVE-2026-33213: URL Redirection to Untrusted Site

Redash is a package for data visualization and sharing. From 5.0.2 to 26.3.0, the getnextpath function in Redash's authentication module stripped the scheme and netloc from user-supplied next parameters but did not normalize multiple leading slashes, allowing a crafted login URL such as...

CVE-2026-58556: Undefined Security Weakness

Permission control vulnerability in the Bluetooth module. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-58555: Undefined Security Weakness

Permission bypass vulnerability in the card module. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-58554: Exposure of Sensitive Information to an Unauthorized Actor

Permission control vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2026-58553: Buffer Copy without Checking Size of Input

Out-of-bounds read vulnerability in the image codec module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2026-58552: Buffer Copy without Checking Size of Input

Out-of-bounds read vulnerability in the image codec module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

PT-2026-108667

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-m6wp-h223-4c8g. This link is maintained to preserve external references. Original Description PraisonAI praisonaiagents before 1.6.78 contains a remote code execution vulnerability in the plugin manager, which...

PT-2026-60168

Permission control vulnerability in the Bluetooth module. Impact: Successful exploitation of this vulnerability may affect availability...

PT-2026-60187

When NGINX Plus is configured to use the Message Queuing Telemetry Transport MQTT filter module ngx stream mqtt filter module, unauthenticated attackers can send requests with conditions beyond the attacker's control to cause a heap buffer over-read in the NGINX worker process, leading to a...

Important: perl-XML-LibXML security update

This module implements a Perl interface to the GNOME libxml2 library which provides interfaces for parsing and manipulating XML files. This module allows Perl programmers to make use of the highly capable validating XML parser and the high performance DOM implementation. Security Fixes:...

PT-2026-60353

Name of the Vulnerable Software and Affected Versions Drupal core versions 0.0.0 through 10.6.13 Drupal core versions 11.3.0 through 11.3.14 Drupal core versions 11.4.0 through 11.4.4 Drupal core versions 0.0.0 through 11.0.x Drupal core versions 0.0.0 through 11.1.x Drupal core versions 0.0.0...

CVE-2026-58549: Buffer Copy without Checking Size of Input

Out-of-bounds read vulnerability in the image codec module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

PT-2026-60206

Name of the Vulnerable Software and Affected Versions NGINX Plus affected versions not specified NGINX Open Source affected versions not specified Description A flaw exists in the ngx http slice module module. When the slice directive is used with unnamed regex captures or during a background cac...

Microsoft PowerShell Help Directory Traversal Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft PowerShell. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing o...

Apache HTTP Server modheaders mod_mime Data Compromise

The vulnerability of the modheaders and modmime modules in the Apache HTTP Server relates to reading data beyond the permitted range of memory. Exploiting this vulnerability can allow an attacker to compromise the confidentiality and integrity of the protected information...

CPython Webbrowser Command Execution

The vulnerability of the webbrowser module in the CPython interpreter is related to the lack of measures taken to protect data at the operating level. Exploiting this vulnerability allows an attacker to execute arbitrary commands...