PT-2026-73243

A bug in APR-util version 1.6.3 and earlier allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr xml quote elem function. Users are recommended to upgrade to version 1.6.4, which fixes this issue...

PT-2026-76744

An issue in Squirro Cognitive Search 3.14.2 allows a remote attacker to execute arbitrary code via a crafted payload to the password reset function...

EUVD-2026-60354

An issue in Squirro Cognitive Search 3.14.2 allows a remote attacker to execute arbitrary code via a crafted payload to the password reset function...

CVE-2026-50772

An issue in Squirro Cognitive Search 3.14.2 allows a remote attacker to execute arbitrary code via a crafted payload to the password reset function...

CVE-2026-50772

An issue in Squirro Cognitive Search 3.14.2 allows a remote attacker to execute arbitrary code via a crafted payload to the password reset function...

Important: pcp

Issue Overview: A flaw in the PCP linuxsockets module exposes an unsecured internal connection. An attacker with initial code execution can exploit this to escalate privileges and execute arbitrary commands as root. CVE-2026-16526 A signed integer overflow in the PCP pmGetPDU function can be...

PT-2026-76610

openssl encrypt versions before 1.4.0 use Python's non-cryptographic random module for steganographic pixel selection in the generate pseudorandom sequence function. Attackers who know the password can recover the Mersenne Twister state from approximately 624 outputs and predict pixel locations...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099725)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099725 advisory. In the Linux kernel, the following vulnerability has been resolved: net/tcp-md5: Fix MAC comparison to be constant-time To prevent timing attacks, MACs need to be...

CVE-2026-67918

Directory Traversal vulnerability in hermes-studio v.0.6.26 allows a remote attacker to obtain sensitive information via the validatePath function in api/hermes/download endpoint...

EUVD-2026-60444

An issue in Tneda W20E v.16.01.0.62782 allows a remote attacker to execute arbitrary code via the urlneedlogin function...

PT-2026-76793

An issue in Tneda W20E v.16.01.0.62782 allows a remote attacker to execute arbitrary code via the url need login function...

PT-2026-76754

COVESA Open1722 through 0.9.2 contains a stack buffer overflow vulnerability that allows unauthenticated remote attackers to write past the end of a fixed 15-slot stack array by sending a crafted UDP datagram containing more than 15 ACF-CAN messages. The avtp to can function increments its write...

PT-2026-76740

File Upload vulnerability in T-Systems International GmbH ImageMaster Version: 9.14.2.8.1 allows a remote attacker to execute arbitrary code via the add attachments feature in the create new document function...

CVE-2026-50768

File Upload vulnerability in T-Systems International GmbH ImageMaster Version: 9.14.2.8.1 allows a remote attacker to execute arbitrary code via the add attachments feature in the create new document function...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100719)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100719 advisory. In the Linux kernel, the following vulnerability has been resolved: pppoe: drop PFC frames RFC 2516 Section 7 states that Protocol Field Compression PFC is NOT...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100736)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100736 advisory. In the Linux kernel, the following vulnerability has been resolved: pstore/ram: fix buffer overflow in persistentramsaveold persistentramsaveold can be called multip...

The vulnerability of the f81604_read_int_callback() function in the drivers/crypto/ccp/sev-dev-tsm.c file of the Linux kernel cryptographic accelerator driver allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the f81604readintcallback function in the drivers/crypto/ccp/sev-dev-tsm.c file of the Linux kernel cryptographic accelerator driver is related to improper validation of input data. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...

PT-2026-76725

Astro is a web framework for content-driven websites. From 10.0.3 until 11.0.3, the Astro Vercel adapter in packages/integrations/vercel/src/serverless/entrypoint.ts accepts x astro path for the public / isr function based only on the x-vercel-isr header, allowing unauthenticated GET requests to...

Important: qemu

Issue Overview: In QEMU's VNC server implementation ui/vnc.c, the setpixelformat function does not properly validate the redmax, greenmax, and bluemax fields from a client's SetPixelFormat message. These fields are received as 16-bit values but are stored internally as uint8t. A malicious VNC...

The vulnerability of the rga_buf_init() function in the drivers/media/platform/rockchip/rga/rga-buf.c driver for multimedia devices in the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the rgabufinit function in the drivers/media/platform/rockchip/rga/rga-buf.c file of the Linux multimedia device driver module is related to the copying of buffers without checking the size of the input data a classic buffer overflow attack. Exploiting this vulnerability coul...