CVE-2026-43820

NIOSSLCertificate.subjectAlternativeNames provides access to the raw bytes for a cert's SANs. NIOSSL provides access to a buffer assumed to be backed by an ASN1STRING, but not all SANs are backed by ASN1STRING, so accessing the buffer for such a type can lead to out-of-bounds memory access. This...

PYSEC-2026-3493 Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)

Summary When Pillow loads an uncompressed image whose tile uses the raw codec and a mode in Image.MAPMODES, and the image was opened from a filename, it memory-maps the file and builds the image's row pointers directly into the mapping via PyImagingMapBuffer src/map.c. The per-row spacing stride ...

Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)

SummaryWhen Pillow loads an uncompressed image whose tile uses the raw codec and a mode in Image.MAPMODES, and the image was opened from a filename, it memory-maps the file and builds the image's row pointers directly into the mapping via PyImagingMapBuffer src/map.c. The per-row spacing stride i...

PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools

HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools Summarypraisonai.bots.HTTPApproval renders pending tool approval arguments directlyinto the approval dashboard HTML. An attacker-controlled tool argument caninject JavaScript into that...

PT-2026-64102

Summary When Pillow loads an uncompressed image whose tile uses the raw codec and a mode in Image. MAPMODES, and the image was opened from a filename, it memory-maps the file and builds the image's row pointers directly into the mapping via PyImaging MapBuffer src/map.c. The per-row spacing strid...

SQL Injection

Overview n8n-nodes-base is a Base nodes of n8n Affected versions of this package are vulnerable to SQL Injection in the executeQuery. An attacker can execute arbitrary SQL commands by injecting untrusted expression data directly into a raw SQL query string. Note: This is only exploitable if a...

CVE-2026-64794

The Users Anywhere and Articles Anywhere Joomla extensions by regularlabs.com are vulnerable to restricted user-data exposure. The root cause is that user tags, filters, and conditions allow access to insufficiently restricted user fields. An attacker could use crafted content to expose sensitive...

CVE-2026-9737

During query planning when reading the sort pattern in raw BSONObj form, in some places we don’t explicitly handle the meta expression case. This may lead to incorrect transformations leading to invariant failure...

Vulnerabilities found in Oracle Communications

Oracle has identified vulnerabilities in its Communications products and underlying third-party software. There are a total of 213 vulnerabilities, of which 67 reside in Oracle products and 146 in third-party products that have already received updates. The most serious vulnerabilities, 12 in...

PT-2026-63505

Name of the Vulnerable Software and Affected Versions Users Anywhere affected versions not specified Articles Anywhere affected versions not specified Description User tags, filters, and conditions allow access to insufficiently restricted user fields. This could enable crafted content to expose...

PT-2026-63486

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description During query planning when reading the sort pattern in raw BSONObj form, the system fails to explicitly handle the meta expression case. This oversight can resul...

Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

Summary Gitea has robust SSRF protection via hostmatcher.NewDialContext for webhook and migration clone URLs, which validates resolved IPs at the TCP dial level. However, three code paths use raw http.Get Go's DefaultClient which completely bypasses this protection, enabling SSRF to internal...

CVE-2026-15793

BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git sources. If the Git source is malicious, this could lead to a crafted command invocation on the host...

CVE-2026-15793

BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git sources. If the Git source is malicious, this could lead to a crafted command invocation on the host...

UBUNTU-CVE-2026-15793

BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git sources. If the Git source is malicious, this could lead to a crafted command invocation on the host...

EUVD-2026-46312

BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git sources. If the Git source is malicious, this could lead to a crafted command invocation on the host...

SUSE-SU-2026:3156-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues The following security issues were fixed: - CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock bsc1264484. - CVE-2026-46052: ceph: only dadd negative dentries when they are unhashed bsc1267494....

SUSE CVE-2026-64114

In the Linux kernel, the following vulnerability has been resolved: ipv4: raw: reject IPHDRINCL packets with ihl ihl 4; err = -EINVAL; if iphlen length goto errorfree; if iphlen = sizeofiph / fix up saddr, totlen, id, csum, transportheader / It does not, however, reject ihl = sizeofiph" branch is...

CVE-2026-64114

A flaw was found in the Linux kernel's handling of IPv4 raw sockets. An unprivileged attacker with CAPNETRAW capabilities can craft and inject a malformed IPv4 packet with an invalid Internet Header Length IHL. This can lead to an out-of-bounds memory access when the packet is processed by certai...

CVE-2026-47255

The CVE-2026-47255 entry concerns AgenticMail API/core vulnerabilities in versions prior to 0.9.32 and 0.9.10, respectively. The connected documents specify multiple hardening and validation weaknesses across storage and outbound relay handling, including: (1) validation and binding of inactive-a...