CVE-2026-42331

FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, the Guest API invoice/update endpoint is missing an authorization check present in other invoice-related endpoints, allowing an unauthenticated user with knowledge of an invoice hash to modify the...

OESA-2026-2798 nginx security update

NGINX is a free, open-source, high-performance HTTP server and reverse proxy, as well as an IMAP/POP3 proxy server. Security Fixes: NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpproxyv2module and ngxhttpgrpcmodule modules. This vulnerability exists when the proxyhttpversion ...

Security Bulletin: IBM Quantum Safe Remediator is affected by mutiple vulnerabilities

Summary The vulnerabilities are found in the dependent open source libraries used in IBM Quantum Safe Remediator code base. IBM Quantum Safe Remediator has addressed these vulnerabilities by updating the versions of the affected libraries. Vulnerability Details CVEID:CVE-2026-39824 DESCRIPTION:...

PT-2026-56007

Name of the Vulnerable Software and Affected Versions FOSSBilling versions 0.6.0 through 0.7.2 Description A SQL injection issue exists in the Massmailer module filter functionality. An authenticated administrator can provide crafted filter values during the update of a mass email message, which...

PT-2026-56027

Name of the Vulnerable Software and Affected Versions Coolify versions 4.0.0-beta.471 through 4.0.0-beta.473 Description A regression in the SHELL SAFE COMMAND PATTERN allows ampersands to be used in custom Docker Compose build, start, and pre/post-deployment command fields. This enables an...

PT-2026-56024

Name of the Vulnerable Software and Affected Versions Coolify versions prior to 4.0.0-beta.474 Description The application lacks authentication, rate limiting, and input validation at the 'POST /api/feedback' endpoint. This allows arbitrary content to be forwarded directly to a Discord webhook,...

Android Security Bulletin—July 2026Stay organized with collectionsSave and categorize content based on your preferences.

This Android Security Bulletin contains details of security vulnerabilities that affect Android devices. Security patch levels of 2026-07-05 or later address all of these issues. To learn how to check a device's security patch level, see Check and update your Android version. Within 48 hours afte...

[SECURITY] Fedora 44 Update: chromium-150.0.7871.46-1.fc44

Chromium is an open-source web browser, powered by WebKit Blink...

[SECURITY] Fedora 43 Update: chromium-150.0.7871.46-1.fc43

Chromium is an open-source web browser, powered by WebKit Blink...

MAL-2026-6789 Malicious code in @checkrhq/adjudication-api-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c52d9987ace09f0c48d8b0661bd1fcd3cf4e7e701b5e515810c7f32d99086cf package.json declares a preinstall lifecycle script that runs curl to POST installer reconnaissance data — hostname, current user whoami, working...

Security Bulletin: Parameter Injection Vulnerability in API Graph Execution Engine

Summary A parameter injection vulnerability existed in the API Graph Execution Engine's tweaks processing mechanism. The vulnerability allowed authenticated attackers to bypass security controls and inject malicious parameters into flow components at runtime. An attacker with valid API credential...

Security Bulletin: Remote Code Execution in CUGA Component CodeAgent

Summary An authenticated user could execute arbitrary commands on the server when the CUGA component is installed and a flow using CUGA's CodeAgent is created and executed. The vulnerability exists in the CodeAgent's Python code execution path, which permits object graph introspection to recover...

PYSEC-2026-707 Double Free in OpenCV

OpenCV 3.0.0 has a double free issue that allows attackers to execute arbitrary code. This issue was fixed in OpenCV version 3.3.1 corresponding to OpenCV-Python and and OpenCV-Contrib-Python 3.3.1.11...

CVE-2026-55597

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-26, an incorrect handling of arguments can cause a heap buffer over-write in the JP2 encoder. This issue has been fixed in version7.1.2-26...

CVE-2026-55595

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, when providing invalid arguments to the connected-components option an infinite loop will occur. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26...

CVE-2026-55594

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, a missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided. This issue has been fixed in versions 6.9.13-51 and...

CVE-2026-55510

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, when identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur. This issue has been fixed in versions 6.9.13-51...

MAL-2026-6703 Malicious code in @andes-tools/colors (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis eaa7ebbb428747d4b9b5ef497dd78f0bfe55f843a9ae526feaf96a788f4abdfb The OpenSSF Package Analysis project identified '@andes-tools/colors' @ 999.0.0 npm as malicious. It is considered malicious because: - The...

CVE-2026-13323

In Open VSX Registry before 1.0.2, the /vscode/unpkg/ endpoint serves user-supplied HTML files with Content-Type: text/html and without a Content-Security-Policy or Content-Disposition: attachment response header. An unauthenticated attacker can register a publisher account, upload a VSIX...

[SECURITY] Fedora 44 Update: maradns-3.5.0037-1.fc44

MaraDNS is a package that implements the Domain Name Service DNS, an essential internet service. MaraDNS has the following advantages: Secure. Supported. Easy to use. Small. Open Source...