CVE-2026-17612

The CVE-2026-17612 affects Honeywell S35 Series cameras (3M/5M/8M/PinHole) with firmware versions up to HC5.26.1.14.20260207. The vulnerability enables an unauthenticated attacker to access audit logs, potentially exposing sensitive information. Attack vector is NETWORK with low attack complexity...

CVE-2026-58023 Apache Thrift: c_glib heap out-of-bounds read in transport leftover-bytes path

Out-of-bounds Read vulnerability in Apache Thrift cglib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

EUVD-2026-49154

Buffer Over-read vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

EUVD-2026-48584

Buffer Copy without Checking Size of Input 'Classic Buffer Overflow' vulnerability in Apache NimBLE. The HCI socket transport did not check whether a received HCI event would fit the configured event pool before copying it, allowing a buffer overflow. Severity is low: exploitation requires either...

OESA-2026-3143 python-filelock security update

Security Fixes: filelock is a platform-independent file lock for Python. In versions prior to 3.20.1, a Time-of-Check-Time-of-Use TOCTOU race condition allows local attackers to corrupt or truncate arbitrary user files through symlink attacks. The vulnerability exists in both Unix and Windows loc...

SUSE CVE-2026-16317

Missing validation of the outer contenttype byte on TLS 1.3 encrypted records in s2n-tls allows an active man-in-the-middle to silently discard individual application data records without either endpoint detecting the modification. RFC 8446 Section 5.2 requires that the outer contenttype of all...

PT-2026-64312

Missing Authorization vulnerability in Apache HBase thrift and rest delegation service. A scan operation in thrift/rest service has 3 steps, open, fetchpossible multiple times, close. The open step will return an id which will be passed back to server for identifying the scanner instances stored ...

Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Apache Log4j

Summary Multiple vulnerabilities in Apache Log4j that is used by InfoSphere Information Server were addressed. Vulnerability Details CVEID:CVE-2026-34477 DESCRIPTION: The fix for CVE-2025-68161 https://logging.apache.org/security.htmlCVE-2025-68161 was incomplete: it addressed hostname verificati...

pypdf: Possible large memory usage for wrong image dimensions

Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires loading images where the declared size values are much too large compared to the actual data. Patches This has been fixed in pypdf==6.14.0. Workarounds If you cannot upgrade yet, consid...

Incorrect Behavior Order: Validate Before Canonicalize

Overview next-auth is an Authentication for Next.js Affected versions of this package are vulnerable to Incorrect Behavior Order: Validate Before Canonicalize in the email/magic-link sign-in process. An attacker can gain unauthorized access to a victim's account by submitting an email address...

n8n: AI Agents Project Viewer Privilege Escalation via run_node_tool

Impact In n8n's AI Agents feature, a user with the read-only Project Viewer role could escalate their privileges by chatting with an agent that has node tools enabled. The agent's node-execution tool was authorized only by the agent:execute scope and ran nodes using the project's credentials,...

CVE-2026-11721

It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes named to produce a wildcard name for a zone that is shorter than the attacker's zone, which can result in cache poisoning. For...

RUSTSEC-2026-0215 smallstr is unmaintained

The smallstr crate is unmaintained, and all versions are affected. Recommended alternatives: - compactstr is the most popular by far - smolstr focuses on immutable strings...

[SECURITY] [DLA 4694-1] nss security update

Debian LTS Advisory DLA-4694-1 [email protected] https://www.debian.org/lts/security/ Jochen Sprickerhof July 22, 2026 https://wiki.debian.org/LTS Package : nss Version : 2:3.61-1+deb11u6 2:3.87.1-1+deb12u3 CVE ID : CVE-2026-6766 CVE-2026-6767 CVE-2026-6772 CVE-2026-12318 Debian Bug :...

PT-2026-63562

Name of the Vulnerable Software and Affected Versions Next.js versions 12.0.0 through 15.5.20 Next.js versions 16.0.0 through 16.2.10 Description A server-side fetch operation involving a request body may return a cached response body from a different request sent to the same URL but with a...

CVE-2026-16488 QUSETIONS MiniCode-Python Project File config.py subprocess.Popen os command injection

A vulnerability was determined in QUSETIONS MiniCode-Python 0.1.0. This vulnerability affects the function subprocess.Popen of the file minicode/config.py of the component Project File Handler. Executing a manipulation can lead to os command injection. The attack may be launched remotely. A high...

GHSA-8R6M-32JQ-JX6Q fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits

Impact fast-xml-parser processes multiple "DOCTYPE" declarations within a single XML document. Each declaration passes its entities to @nodable/entities through addInputEntities. addInputEntities resets the entity expansion counters every time it is called. An attacker can therefore insert...

Kibana 9.3.8, 9.4.4 Security Update (ESA-2026-65)

Missing Authorization in Kibana Leading to Unauthorized Access to Cloud Connect Management Functions Missing Authorization CWE-862 in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature privileges, via direct...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.20.30 bug fix and security update

Red Hat OpenShift Container Platform release 4.20.30 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.20. Red Hat Product Security has rated this update as having a...

CVE-2026-56452

Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. The implementation of receiving files or directories via SCP did not validate filenames in SCP "C" or "D" commands. A malicious sender could send filenames...