CVE-2026-46993

creationtimestamp| type| source ---|---|--- 2026-07-23 16:45:40+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9 2026-07-27 13:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mrmxn4eu5m2m...

CVE-2026-46992

creationtimestamp| type| source ---|---|--- 2026-07-23 16:45:38+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...

CVE-2026-46990

creationtimestamp| type| source ---|---|--- 2026-07-23 16:45:35+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...

CVE-2026-46988

creationtimestamp| type| source ---|---|--- 2026-07-23 16:45:30+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...

CVE-2026-46987

creationtimestamp| type| source ---|---|--- 2026-07-23 16:45:26+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...

CVE-2026-46981

creationtimestamp| type| source ---|---|--- 2026-07-23 16:45:19+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...

CVE-2026-46954

creationtimestamp| type| source ---|---|--- 2026-07-23 16:45:17+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...

CVE-2026-46943

creationtimestamp| type| source ---|---|--- 2026-07-23 16:45:14+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...

CVE-2026-46941

creationtimestamp| type| source ---|---|--- 2026-07-23 16:45:12+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...

CVE-2026-46923

creationtimestamp| type| source ---|---|--- 2026-07-23 16:45:07+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...

pypdf: Possible infinite loop for not terminated inline images

Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page with a not terminated inline image, as done when extracting the page text for example. Patches This has been fixed in pypdf==6.14.1. Workarounds If yo...

pypdf: Possible large memory usage for wrong image dimensions

Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires loading images where the declared size values are much too large compared to the actual data. Patches This has been fixed in pypdf==6.14.0. Workarounds If you cannot upgrade yet, consid...

Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass

Summary The default email-address normalizer used by the email/magic-link sign-in flow validates the address before applying Unicode normalization. An address can contain a Unicode character that is not an ASCII @ U+0040 but canonicalizes to one under NFKC/NFKD normalization the normalization...

GHSA-X445-F3H2-J279 Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them

Summary Auth.js stores the OAuth/OIDC anti-CSRF checks state, nonce, and the PKCE verifier in global cookies that are not bound to the provider that created them. On callback, a check value minted during a sign-in started with one provider can satisfy the callback for a different provider, becaus...

Security update for gawk

This update for gawk fixes the following issue: CVE-2026-40468: integer overflow in the builtin.c program file bsc1271352. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the command...

Security update for python-urllib3

This update for python-urllib3 fixes the following issues: CVE-2025-66471: excessive resource consumption via decompression of highly compressed data in Streaming API bsc1254867. CVE-2025-66418: resource exhaustion via unbounded number of links in the decompression chain bsc1254866. Patch...

LiteLLM: Local file read via request-supplied OIDC file references

ImpactLiteLLM's /health/testconnection endpoint resolved request-supplied environment and OIDC file references in litellmparams. A proxy administrator, or another privileged caller with permission to test model connections, could cause LiteLLM to read files from the local filesystem via an...

dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS

ImpactDatadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing item-count or byte-size limits on the extract path. The DDTRACEBAGGAGEMAXITEMS default 64 and DDTRACEBAGGAGEMAXBYTES default 8192 limits were applied only to baggage...

Anki's local HTTP server does not sufficiently validate requests

SummaryAnki launches a local HTTP server to serve media files and web pages for parts of its interface. While the server has a CORS setup, requests from other origins were not blocked, allowing malicious websites to potentially trigger side-effecting requests. Browser impactThe severity varies by...

PraisonAI: AgentOS remains unauthenticated after incomplete fix version and allows remote agent invocation

AgentOS remains unauthenticated after GHSA-pm96 patched version and allows remote agent invocation SummaryPraisonAI's AgentOS FastAPI deployment surface remains unauthenticated incurrent main and in releases after the published patched version forGHSA-pm96-6xpr-978x / CVE-2026-40151.The public...