GHSA-M44R-7C5H-M6MJ Medplum: Improper Validation of Redirect URI in External Auth Callback allows Authorization Code Leakage

Summary The external identity provider callback at GET /auth/external accepts attacker-controlled redirect URIs that only need to start with a registered client redirect URI, rather than matching exactly. After a successful external IdP login, the server appends Medplum login and code values to...

Medplum: Improper Validation of Redirect URI in External Auth Callback allows Authorization Code Leakage

Summary The external identity provider callback at GET /auth/external accepts attacker-controlled redirect URIs that only need to start with a registered client redirect URI, rather than matching exactly. After a successful external IdP login, the server appends Medplum login and code values to...

CVE-2026-19968 Open Asset Import Library Assimp 3DGS MDL7 Model LWOLoader.h ReadFaces_3DGS_MDL7 heap-based overflow

A weakness has been identified in Open Asset Import Library Assimp 17c12da. The affected element is the function Assimp::MDLImporter::ReadFaces3DGSMDL7 in the library code/AssetLib/LWO/LWOLoader.h of the component 3DGS MDL7 Model Parser. Executing a manipulation can lead to heap-based buffer...

PacketSender v8.11.1

Introduction https://packetsender.com Read this in other languages:English, Español, Deutsch, Français, italiano 简体中文. Packet Sender is an open source utility to allow sending and receiving TCP, UDP, and SSL encrypted TCP packets as well as HTTP/HTTPS requests and panel generation. The mainline...

PT-2026-76784

OpenEMR before 8.2.0 contains a path traversal vulnerability in the standard tables manage.php interface where the db GET parameter is passed without validation to temp dir cleanup, which joins the value to the PHP temporary directory path and recursively deletes the resulting directory. Attacker...

openSUSE 16 Security Update : open-iscsi (openSUSE-SU-2026:21580-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21580-1 advisory. Update to version 2.1.12.suse+0.8f77cf16: - CVE-2026-44943: improper limitation of pathname to a restricted directory allows remote MITM attacke...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099908)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099908 advisory. In the Linux kernel, the following vulnerability has been resolved: net: ftgmac100: fix ring allocation unwind on open failure ftgmac100allocrings allocates rxskbs,...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100346)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100346 advisory. In the Linux kernel, the following vulnerability has been resolved: openvswitch: validate MPLS set/setmasked payload length validateset accepted OVSKEYATTRMPLS as...

A Calibrated and Explainable Bimodal Machine Learning Framework for Hybrid Intrusion Detection

Modern communication systems face critical gaps in detecting unknown attacks and rare threat classes due to extreme data imbalance and black-box decision logic. We propose a bimodal framework of calibrated and explainable machine learning ML for network security, unifying known-class precision wi...

PT-2026-76718

Name of the Vulnerable Software and Affected Versions Medplum versions prior to 5.1.6 Description An issue exists in the external identity provider callback at the 'GET /auth/external' endpoint. The system accepts redirect URIs that only need to start with a registered client redirect URI rather...

CVE-2026-19999: Buffer Copy without Checking Size of Input

A security vulnerability has been detected in Open Asset Import Library Assimp Assimp 17c12da. The affected element is the function Assimp::MDLImporter::ParseBoneTrafoKeys3DGSMDL7 of the file code/AssetLib/MDL/MDLLoader.cpp of the component 3DGS MDL7 Bone Transformation Key Parser. The manipulati...

Important: isns-utils

Issue Overview: A Double Free vulnerability in open-iscsi allows an unauthenticated MITM attacker to cause DoS. This issue affects open-iscsi: from ? through 56718d4e9d1a4f51c30697b5c0534144bb41c9bb. CVE-2026-55995 Affected Packages: isns-utils Issue Correction: Run dnf update isns-utils...

Important: isns-utils

Issue Overview: A Double Free vulnerability in open-iscsi allows an unauthenticated MITM attacker to cause DoS. This issue affects open-iscsi: from ? through 56718d4e9d1a4f51c30697b5c0534144bb41c9bb. CVE-2026-55995 Affected Packages: isns-utils Note: This advisory is applicable to Amazon Linux 2...

CVE-2026-19967: Heap-based Buffer Overflow

A security flaw has been discovered in Open Asset Import Library Assimp 17c12da. Impacted is the function Assimp::Compression::decompressBlock of the file code/Common/Compression.cpp of the component File Parser. Performing a manipulation results in heap-based buffer overflow. The attack may be...

PT-2026-82816

Name of the Vulnerable Software and Affected Versions iscsiuio versions prior to 0.7.8.8-114.1 Description Security issues were identified and resolved in the iscsiuio package. Recommendations Update to version 0.7.8.8-114.1...

Important: iscsi-initiator-utils

Issue Overview: An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in open-iscsi allows remote MITM attackers to create root-owned files outside the database and inject lines into the record. This issue affects open-iscsi: from through...

PT-2026-82815

Name of the Vulnerable Software and Affected Versions open-iscsi iscsi-initiator-utils affected versions not specified Description A stack buffer overflow occurs in the idbm recinfo config function within the iscsi-initiator-utils component. An attacker can exploit this by crafting a malicious...

SUSE CVE-2026-41479

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.10 and 1.7.1, Authlib's OAuth 2.0 authorization endpoint can be turned into an unauthenticated open redirect when a request uses an unsupported responsetype and supplies an attacker-controlled redirecturi. The...

CVE-2026-19926

A vulnerability has been found in Evergreen up to 3.14.11/3.15.11/3.16.5/3.17-beta1. The affected element is an unknown function of the file /osrf-gateway-v1 of the component open-ils.fielder OpenSRF Service. Such manipulation leads to sql injection. The attack can be executed remotely. The explo...

CVE-2026-19926

A vulnerability has been found in Evergreen up to 3.14.11/3.15.11/3.16.5/3.17-beta1. The affected element is an unknown function of the file /osrf-gateway-v1 of the component open-ils.fielder OpenSRF Service. Such manipulation leads to sql injection. The attack can be executed remotely. The explo...