CVE-2026-64547

A flaw was found in the Linux kernel's net1080 USB network adapter driver. A malicious NetChip 1080 device could send a specially crafted network frame with an invalid packet length. This could lead to an out-of-bounds read when processing the packet, causing a system crash and resulting in a...

CVE-2026-64540

A flaw was found in the Linux kernel's GeneLink GL620A USB network driver. A malicious GeneLink device can send specially crafted Universal Serial Bus USB packets that cause an out-of-bounds read vulnerability. This can lead to the disclosure of sensitive kernel memory, potentially revealing...

CVE-2026-64546

A flaw was found in the Linux kernel. A specially crafted Extended Display Identification Data EDID, which describes display capabilities, can cause a heap out-of-bounds read in the drmparsetiledblock function within the drm/edid component. This vulnerability could lead to system instability or t...

SUSE-SU-2026:22977-1 Security update for samba

This update for samba fixes the following issues: - CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server bsc1271672. - CVE-2026-15779: pamwinbind module with mkhomedir set allows chown of critical system paths without validation bsc1271469. - CVE-2026-58216: 6-by...

ALSA-2026:47756 Important: openssh security update

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fixes: openssh: Local MITM of X11 forwarding via abstract UNIX socket pre-binding in AlmaLinux OpenS...

CVE-2026-50782

CVE-2026-50782 describes an XML External Entity (XXE) injection in Jinher OA C6. The vulnerability is located at the /c6/JHSoft.Web.HrmAttendance/sp_manager_getUserlist.aspx/GetXmlHttp endpoint, where an unauthenticated attacker can submit a crafted XML payload to read arbitrary files from the se...

EUVD-2026-50569

Jinher OA C6 contains an XML External Entity XXE injection vulnerability in the /c6/JHSoft.Web.HrmAttendance/spmanagergetUserlist.aspx/GetXmlHttp endpoint. An unauthenticated remote attacker can send a crafted XML payload to read arbitrary files from the server via an out-of-band attack...

CVE-2026-50782

Jinher OA C6 contains an XML External Entity XXE injection vulnerability in the /c6/JHSoft.Web.HrmAttendance/spmanagergetUserlist.aspx/GetXmlHttp endpoint. An unauthenticated remote attacker can send a crafted XML payload to read arbitrary files from the server via an out-of-band attack...

APSB26-114 : Security update available for Adobe Campaign Classic

Adobe has released a security update for Adobe Campaign Classic. This update addresses critical vulnerabilities that could result in arbitrary code execution and arbitrary file system read...

Linux Distros Unpatched Vulnerability : CVE-2026-50735

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pglogical's apply worker does not sufficiently validate the length of certain fields in incoming replication protocol messages before copying them, resulting in...

NewStart CGSL MAIN 6.06 : ipv6nat-selinux Multiple Vulnerabilities (NS-SA-2026-0054)

The remote NewStart CGSL host, running version MAIN 6.06, has ipv6nat-selinux packages installed that are affected by multiple vulnerabilities: - net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This...

PT-2026-65819

Name of the Vulnerable Software and Affected Versions Autodesk AutoCAD affected versions not specified Description An Out-of-Bounds Read occurs when the software reads data outside the intended boundary of a buffer. This issue is triggered when Autodesk AutoCAD parses a maliciously crafted DWG or...

PT-2026-65936

Name of the Vulnerable Software and Affected Versions Kenwood DNR1007XR affected versions not specified Description An out-of-bounds write exists in the tchdr bytestream read function. This issue occurs because the software fails to properly validate user-supplied data, allowing a write operation...

PT-2026-65942

Sony XAV-9500ES prh l2 decode packet Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Sony XAV-9500ES devices. An attacker must first obtain the ability to pair a malicious...

NewStart CGSL MAIN 6.06 : ipv6nat Multiple Vulnerabilities (NS-SA-2026-0062)

The remote NewStart CGSL host, running version MAIN 6.06, has ipv6nat packages installed that are affected by multiple vulnerabilities: - net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This is...

ALSA-2026:47757 Important: openssh security update

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fixes: openssh: Local MITM of X11 forwarding via abstract UNIX socket pre-binding in AlmaLinux OpenS...

PT-2026-65904

Name of the Vulnerable Software and Affected Versions Pydantic AI versions 1.65.0 through 1.105.0 Pydantic AI versions 2.0.0b1 through 2.0.0b5 Description A client submitting message history to a UI adapter can reference arbitrary files within the application's model-provider or cloud-storage...

CVE-2026-54659

Pagy is agnostic pagination in plain Ruby. From 43.0.0 until 43.5.6, Pagy::I18n.locale= in gem/lib/pagy/modules/i18n/i18n.rb stored locale values verbatim and later used them as .yml path components, allowing untrusted params:locale values with absolute paths or ../ sequences to create a file...

CVE-2026-55389

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.62.0, datamodel-code-generator resolves JSON Schema $ref targets in...

goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite

Summary The WebDAV mode-flag guard added to fix GHSA-3whc-qvhv-xqjp still does not enforce --no-delete on the WebDAV MOVE verb. MOVE deletes the source file rename removes it from its original path, and with Overwrite: T it additionally performs an explicit RemoveAll on the destination. Under -w...