Improper Handling of Missing Special Element

Overview Affected versions of this package are vulnerable to Improper Handling of Missing Special Element in DecodeUnprotectedBucket in CoseMessage.cs‎. An attacker can gain unauthorized access or manipulate data by supplying a malicious payload that bypasses security mechanisms. Remediation...

Siemens S7-1500 Improper Restriction of Operations within the Bounds of a Memory Buffer (CVE-2025-11414)

A vulnerability was determined in GNU Binutils 2.45. Affected by this vulnerability is the function getlinkhashentry of the file bfd/elflink.c of the component Linker. This manipulation causes out- of-bounds read. The attack can only be executed locally. The exploit has been publicly disclosed an...

Siemens Polarion

SUMMARY Polarion before V2506 contains a vulnerability that could allow authenticated remote attackers to conduct cross-site scripting attacks. Siemens has released new versions for the affected products and recommends to update to the latest versions. 2. GENERAL RECOMMENDATIONS As a general...

CVE-2026-23903

Summary of CVE-2026-23903 (Apache Shiro): It is an Authentication Bypass by Alternate Name vulnerability affecting Apache Shiro versions before 2.0.7, triggered when static files are served from a case-insensitive filesystem (e.g., macOS defaults). In such cases, request filename casing can bypas...

PT-2026-7102

Name of the Vulnerable Software and Affected Versions Apache Airflow versions 3.1.0 through 3.1.6 Description An authorization flaw exists in Apache Airflow that could allow an authenticated user with limited task permissions to view task logs without proper authorization. The issue affects syste...

PT-2026-6889

Name of the Vulnerable Software and Affected Versions Simple Bible Verse via Shortcode plugin for WordPress versions prior to 1.2 Description The Simple Bible Verse via Shortcode plugin for WordPress is susceptible to Stored Cross-Site Scripting through the verse shortcode. Insufficient input...

PT-2026-6679

Name of the Vulnerable Software and Affected Versions Tune Library plugin for WordPress versions up to and including 1.6.3 Description The Tune Library plugin for WordPress is susceptible to Stored Cross-Site Scripting through the CSV import functionality. This is a result of inadequate input...

PT-2026-6756

Name of the Vulnerable Software and Affected Versions Gogs versions prior to 0.13.4 Description Gogs, a self-hosted Git service, has an issue where the API endpoint ''PUT /repos/:owner/:repo/contents/'' does not enforce write permissions correctly. It allows modification of repository contents...

CVE-2026-1517

A vulnerability was identified in iomad up to 5.0. Affected is an unknown function of the component Company Admin Block. Such manipulation leads to sql injection. The attack can be executed remotely. It is best practice to apply a patch to resolve this issue...

EUVD-2026-5535

A vulnerability was identified in iomad up to 5.0. Affected is an unknown function of the component Company Admin Block. Such manipulation leads to sql injection. The attack can be executed remotely. It is best practice to apply a patch to resolve this issue...

PT-2026-6576

Name of the Vulnerable Software and Affected Versions UltraVNC Launcher version 1.2.4.0 Description The software contains a denial of service condition in its password configuration. A local attacker can cause the application to crash by providing an overly long string, specifically 300 character...

Debian dsa-6121 : libtomcat11-embed-java - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6121 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6121-1 [email protected] https://www.debian.org/securit...

Important: python3-urllib3

Issue Overview: urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression...

CVE-2026-24735

Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 1.7.1. An unauthenticated API endpoint incorrectly exposes full revision history for deleted content. This allows unauthorized user to retrieve restricted or...

PT-2026-6655

Name of the Vulnerable Software and Affected Versions jsPDF versions prior to 4.0.0 SurveyJS PDF Generator versions 1.12.58 and lower SurveyJS PDF Generator versions 2.5.4 and lower Description A local file inclusion or path traversal issue was identified in jsPDF. Because SurveyJS PDF Generator...

PT-2026-6328

Name of the Vulnerable Software and Affected Versions iccDEV versions prior to 2.3.1.3 Description iccDEV is a set of libraries and tools for interacting with ICC color management profiles. A heap buffer overflow exists in the CIccFileIO::Read8 function when processing improperly formed ICC profi...

PT-2026-5990

Name of the Vulnerable Software and Affected Versions Water-Melon Melon versions prior to commit 9df9292 Description The software is susceptible to a Denial of Service condition. The HTTP component lacks a maximum length restriction, allowing an excessively large request header to exhaust RAM...

PT-2026-37040

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions prior to 2.4.67 Description A heap-based buffer overflow exists in the mod proxy ajp module. If mod proxy ajp connects to a malicious AJP server, that server can send a crafted AJP message causing the system to writ...

Heap-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow via the readData function when handling a manipulated DATA Submessage with DDS Security enabled. An attacker can cause remote process termination or denial of service by sending a specially crafted SPDP packet...

Apache Syncope: Console XXE on Keymaster parameters

Improper Restriction of XML External Entity Reference vulnerability in Apache Syncope Console. An administrator with adequate entitlements to create or edit Keymaster parameters via Console can construct malicious XML text to launch an XXE attack, thereby causing sensitive data leakage occurs. Th...