OESA-2026-3137 python-pillow security update

Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging \ Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift. of CVE-2022-22815,CVE-2022-22816 Security Fixes: Pillow is a Python imaging library. Prior to 12.3.0,...

The vulnerability of the console-based graphic editor ImageMagick, related to insufficient protection of operational data, allows a intruder to gain unauthorized access to protected information.

The vulnerability of the console-based graphic editor ImageMagick is related to insufficient protection of service data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

CVE-2026-65607 SiYuan before v3.7.2 Path Traversal via /export/temp/

SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExport handler kernel/server/serve.go. Unlike the main export branch, this branch joins the raw, percent-decoded request path with util.TempDir and serves the file without the...

PYSEC-2026-3519 PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding

Jobs webhook SSRF protection bypass via DNS rebinding Summary PraisonAI's Async Jobs API validates webhookurl when a job request is parsed and again when the internal Job object is constructed. That validation blocks direct loopback/private targets, but it is not bound to the later network reques...

RLSA-2026:41897 Important: .NET 10.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.110 and .NET Runtime 10.0.10...

RockyLinux 9 : .NET 10.0 (RLSA-2026:41898)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:41898 advisory. dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM CVE-2026-50651 dotnet: .NET Core: Denial of Service via type...

The vulnerability of the Dovecot mail server, related to insufficient protection of service data, allows attackers to gain unauthorized access to protected information.

The vulnerability of the Dovecot mail server is related to insufficient protection of service data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the Zabbix Agent 2 component of the Zabbix IT-infrastructure monitoring system allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Zabbix Agent 2 component of the Zabbix IT infrastructure monitoring system is related to insufficient protection for registration data. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information...

Oracle Linux 10 : kernel (ELSA-2026-19569)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-19569 advisory. - crypto: ccp - copy IV using skcipher ivsize CKI Backport Bot RHEL-188463 CVE-2026-53016 - futex/requeue: Revert 'Prevent NULL pointer dereference i...

Server-side Request Forgery (SSRF)

Overview @n8n/n8n-nodes-langchain is a Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the MCP Client. An attacker can access internal or otherwise restricted network resources by supplying crafted endpoints, causing the server to connect to unintended host...

GO-2026-6030 Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter in code.gitea.io/gitea

Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter in code.gitea.io/gitea...

UBUNTU-CVE-2026-13059

An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insufficient validation of certain client-supplied command parameters. The issue affects find, update, delete, and aggregate commands ...

Important: Red Hat Security Advisory: Red Hat OpenShift API for Data Protection

A new version of OpenShift API for Data Protection OADP is now available. OpenShift API for Data Protection OADP enables you to back up and restore application resources, persistent volume data, and internal container images to external backup storage. OADP enables both file system-based and...

libssh2: Fix of CVE-2026-58050

CVE-2026-58050: cap publickey list attribute count to prevent 32-bit multiplication overflow in libssh2publickeylistfetch...

CVE-2026-44687

In NLnet Labs Unbound 1.13.2 up to and including 1.25.1, stub or forward zones where the name is below an intermediate labed below a DNSSEC signed zone could be shadowed by the intermediate label's secure NXDOMAIN answer from the parent. This is caused by an off-by-one error in...

CVE-2026-13204

CVE-2026-13204 affects BIND 9 up to 9.18.50, 9.20.24, 9.21.23 and related S1 variants. If a provably insecure domain is covered by both NSEC and NSEC3 at the parent and an RRSIG exists for only one type, BIND may exit unexpectedly with an assertion during proof validation. Mitigation is to upgrad...

CVE-2026-65593

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a server-side request forgery vulnerability in the dynamic-node-parameters endpoints that lack authorization scopes. Authenticated attackers can supply absolute URLs in routing configuration to override baseURL restrictions and make the n8n...

EUVD-2026-47637

n8n versions before 1.123.64 contain a server-side request forgery vulnerability in the dynamic-node-parameters endpoints that lack authorization scopes. Authenticated attackers can supply absolute URLs in routing configuration to override baseURL restrictions and make the n8n server issue HTTP...

CVE-2026-65593 n8n before 1.123.64, 2.29.8, and 2.30.1 SSRF via Dynamic Node Parameters

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a server-side request forgery vulnerability in the dynamic-node-parameters endpoints that lack authorization scopes. Authenticated attackers can supply absolute URLs in routing configuration to override baseURL restrictions and make the n8n...

Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities

Summary IBM Guardium Data Protection has addressed these vulnerabilities in an update. Vulnerability Details CVEID:CVE-2026-1933 DESCRIPTION: A flaw was found in Samba’s handling of NTFS-style reparse points on shares configured with read only = yes. Due to missing SMB-layer access checks,...