PT-2026-88278

Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability that allows attackers to execute denied shell commands by exploiting a word-boundary mismatch in comment handling between the approval gate's shell parser and bash. Attackers can craft a command string with an allowlisted word...

PT-2026-87066

XenForo before 2.3.13 contains an uncontrolled recursion vulnerability in the BBCode parser that allows authenticated attackers to cause persistent denial of service by submitting a post with deeply nested BBCode tags. Attackers can craft a single malicious post with sufficient nesting depth to...

CVE-2026-86513: Allocation of Resources Without Limits or Throttling

A security flaw has been discovered in java-json-tools jackson-coreutils 2.0. This vulnerability affects the function TreePointer.tokensFromInput of the file src/main/java/com/github/fge/jackson/jsonpointer/TreePointer.java of the component JSON Pointer parser. The manipulation results in...

CVE-2026-86510: Out-of-bounds Write

A vulnerability has been found in D-Link DIR-822A A101. Affected is the function tunnelsetparams of the component L2TP Control Message Parser. Such manipulation leads to out-of-bounds write. The attack can be launched remotely. The exploit has been disclosed to the public and may be used...

PT-2026-87147

Name of the Vulnerable Software and Affected Versions MongoDB server affected versions not specified Description A security issue exists in the JSON Pointer parser used during $jsonSchema query filter processing. When a find command contains a specially crafted $jsonSchema filter field, the parse...

EulerOS 2.0 SP12 : libsolv (EulerOS-SA-2026-3277)

According to the versions of the libsolv packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in libsolv. This heap buffer overflow vulnerability occurs when a victim processes a specially crafted .solv file containing...

RHEL 10 : expat (RHSA-2026:64810)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:64810 advisory. Expat is a C library for parsing XML documents. Security Fixes: expat: libexpat: Use-after-free vulnerability due to improper handler call...

ALSA-2026:64809 Moderate: expat security update

Expat is a C library for parsing XML documents. Security Fixes: expat: libexpat: Use-after-free vulnerability due to improper handler call depth tracking CVE-2026-50219 expat: libexpat: Arbitrary Code Execution via Heap-based Buffer Overflow CVE-2026-56132 For more details about the security...

ALSA-2026:64812 Moderate: expat security update

Expat is a C library for parsing XML documents. Security Fixes: expat: libexpat: Use-after-free vulnerability due to improper handler call depth tracking CVE-2026-50219 expat: libexpat: Arbitrary Code Execution via Heap-based Buffer Overflow CVE-2026-56132 For more details about the security...

Moderate: expat security update

Expat is a C library for parsing XML documents. Security Fixes: expat: libexpat: Use-after-free vulnerability due to improper handler call depth tracking CVE-2026-50219 expat: libexpat: Arbitrary Code Execution via Heap-based Buffer Overflow CVE-2026-56132 For more details about the security...

expat security update

2.7.3-59 - Fix CVE-2026-56132: out-of-bound scaffolding index store in doProlog 2.7.3-58 - Fix CVE-2026-50219: forbid XMLParserFree/Reset from handlers 2.7.3-57 - expat: backport CVE-2026-45186 fix attribute collision check DoS 2.7.3-56 - Rebase to 2.7.3 and add VCS tag Thu Jun 05 2025...

Linux Distros Unpatched Vulnerability : CVE-2026-77465

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - toml-node is a TOML parser for Node.js and the browser. Prior to 4.2.0, toml.parse uses a Peggy 5.1.0 generated recursive-descent parser in lib/parser.js whose...

EulerOS 2.0 SP12 : haproxy (EulerOS-SA-2026-3267)

According to the versions of the haproxy packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgiconn structure's drl field that allows buff...

RHEL 9 : expat (RHSA-2026:64812)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:64812 advisory. Expat is a C library for parsing XML documents. Security Fixes: expat: libexpat: Use-after-free vulnerability due to improper handler call...

CVE-2026-73321: Uncontrolled Recursion

XenForo before 2.3.13 contains an uncontrolled recursion vulnerability in the BBCode parser that allows authenticated attackers to cause persistent denial of service by submitting a post with deeply nested BBCode tags. Attackers can craft a single malicious post with sufficient nesting depth to...

PT-2026-88521

Name of the Vulnerable Software and Affected Versions go-attestation versions prior to 0.6.2 Description An uncontrolled recursion issue in the Windows SIPA event log parser allows a remote attacker to cause a denial of service DoS. The readELAMAggregation function in the WinEvents object recurse...

PT-2026-95045

Summary Nodemailer's email-address parser treats an RFC 5322 comment ... inside the domain as a point to concatenate the surrounding text, rather than as folding whitespace CFWS that terminates the domain. Consequently a recipient address such as [email protected] is parsed and delivere...

PT-2026-86983

A security vulnerability has been detected in vgmstream up to r2117. Impacted is the function add entry of the file src/meta/txtp parser.c of the component txtp. Such manipulation of the argument range start/range end leads to resource consumption. The attack may be performed from remote. The...

CVE-2026-82537: Interpretation Conflict

Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability that allows attackers to execute denied shell commands by exploiting a word-boundary mismatch in comment handling between the approval gate's shell parser and bash. Attackers can craft a command string with an allowlisted word...

CVE-2026-82054: Allocation of Resources Without Limits or Throttling

A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter processing. When a find command includes a specially crafted $jsonSchema filter field, the parser processes the input without enforcing adequate limits on iteration count or total allocation size,...