CVE-2026-58081

A flaw was found in iconv. Several encoding modules, including HZ, UTF-7, VIQR, and ZW, did not properly validate the size of the provided output buffer before writing converted characters. This oversight could allow an application using iconv to convert untrusted input with one of the affected...

Malicious Package

Overview modules-newline is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Linux Distros Unpatched Vulnerability : CVE-2026-58081

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Several encoding modules, including HZ, UTF-7, VIQR, and ZW, did not properly check the size of the caller-supplied output buffer before writing converted...

nginx: Fix of CVE-2026-49975

CVE-2026-49975: improve the maxheaders patch to preserve binary compatibility with externally-built nginx modules...

EUVD-2026-63115

In Splunk Enterprise versions below 10.4.2 and 10.2.6, a user who does not hold the "admin" or "power" Splunk roles could delete Splunk Processing Language version 2 SPL2 modules belonging to other users through the data management orchestrator interface. The vulnerability does not affect Splunk...

CVE-2026-76336

In Splunk Enterprise versions below 10.4.2 and 10.2.6, a user who does not hold the "admin" or "power" Splunk roles could delete all Search Processing Language 2 SPL2 modules across all apps and users on the instance through the SPL2 module management Representational State Transfer REST API. Thi...

CVE-2026-76263

In Splunk Enterprise versions below 10.4.2 and 10.2.6, a user who does not hold the "admin" or "power" Splunk roles could delete Splunk Processing Language version 2 SPL2 modules belonging to other users through the data management orchestrator interface. The vulnerability does not affect Splunk...

CVE-2026-76336

Splunk Enterprise versions below 10.4.2 (mainline) and 10.2.6 (LTS) are affected: the SPL2 module management REST API lacks sufficient authorization and validation on module deletion, letting any non-admin/non-power user delete all SPL2 modules instance-wide, wiping exported datasets/functions, c...

CVE-2026-76336 Improper Access Control through the REST API in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2 and 10.2.6, a user who does not hold the "admin" or "power" Splunk roles could delete all Search Processing Language 2 SPL2 modules across all apps and users on the instance through the SPL2 module management Representational State Transfer REST API. Thi...

CVE-2026-76263 Improper Access Control through the REST API in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2 and 10.2.6, a user who does not hold the "admin" or "power" Splunk roles could delete Splunk Processing Language version 2 SPL2 modules belonging to other users through the data management orchestrator interface. The vulnerability does not affect Splunk...

CVE-2026-76263

Splunk Enterprise versions below 10.4.2 and 10.2.6 have a broken object-level authorization flaw in the data management orchestrator REST API, allowing low-privilege users to delete SPL2 modules owned by other users. CVSS 5.4 (MEDIUM). Patch to 10.4.2 or 10.2.6; see advisory SVD-2026-0801. No in-...

CVE-2026-76263 Improper Access Control through the REST API in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2 and 10.2.6, a user who does not hold the "admin" or "power" Splunk roles could delete Splunk Processing Language version 2 SPL2 modules belonging to other users through the data management orchestrator interface. The vulnerability does not affect Splunk...

Duplicate Advisory: GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitPython

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-hmq2-w58f-27jc. This link is maintained to preserve external references. Original Description GitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing attackers to create Git...

CVE-2019-25766

Renovate versions = 13.87.0 and = 19.38.6 leak temporary repository tokens into pull request comments during certain Go Modules update failure scenarios. The issue is fixed in version 19.38.7. Anyone able to view the affected pull request comments could obtain the exposed tokens...

CVE-2019-25766 Renovate before 19.38.7 Credential Exposure via Go Modules

Renovate versions = 13.87.0 and = 19.38.6 leak temporary repository tokens into pull request comments during certain Go Modules update failure scenarios. The issue is fixed in version 19.38.7. Anyone able to view the affected pull request comments could obtain the exposed tokens...

CVE-2019-25766 Renovate before 19.38.7 Credential Exposure via Go Modules

Renovate versions = 13.87.0 and = 19.38.6 leak temporary repository tokens into pull request comments during certain Go Modules update failure scenarios. The issue is fixed in version 19.38.7. Anyone able to view the affected pull request comments could obtain the exposed tokens...

EUVD-2019-20202

Renovate versions = 13.87.0 and = 19.38.6 leak temporary repository tokens into pull request comments during certain Go Modules update failure scenarios. The issue is fixed in version 19.38.7. Anyone able to view the affected pull request comments could obtain the exposed tokens...

SUSE-SU-2026:3649-1 Security update for python313

This update for python313 fixes the following issues: - CVE-2025-15366: user-controlled command can allow additional commands injected using newlines bsc1257044. - CVE-2025-15367: control characters may allow the injection of additional commands bsc1257041. - CVE-2026-0864: improper handling of...

CVE-2026-58081

Several encoding modules, including HZ, UTF-7, VIQR, and ZW, did not properly check the size of the caller-supplied output buffer before writing converted characters. An application that uses iconv3 to convert untrusted input to or from one of the affected encodings may be vulnerable to buffer...

CVE-2026-58081 Heap based buffer overflow in iconv(3)

Several encoding modules, including HZ, UTF-7, VIQR, and ZW, did not properly check the size of the caller-supplied output buffer before writing converted characters. An application that uses iconv3 to convert untrusted input to or from one of the affected encodings may be vulnerable to buffer...