SUSE CVE-2026-72889

Net::OAuth versions before 0.33 for Perl allow the sender to choose the signature algorithm in verify. verify resolves the signature method class from the signaturemethod parameter of the incoming message. signaturemethod is required on every request, so the algorithm used to check a signature is...

SUSE CVE-2026-73624

GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerability in the Diffable.diff method that fails to validate git options passed through kwargs. Attackers can supply the --output argument via the other parameter or output kwarg to write patch content to attacker-chosen fil...

SUSE CVE-2026-73625

GitPython versions before 3.1.54 contain a remote code execution vulnerability in the checkunsafeoptions guard that can be bypassed by smuggling git options inside single-character kwarg values. Attackers can supply crafted option dictionaries to clonefrom, fetch, pull, push, lsremote, itercommit...

SUSE CVE-2026-75904

libmodplug through 0.8.9.1 contains an out-of-bounds read in patsmplooped in src/loadpat.cpp. The function validates only the upper bound of its sample index against MAXSMP and then subtracts one before indexing the 191-byte static array patloops, so an index of zero reads patloops-1, one byte...

SUSE CVE-2026-76218

GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that forwards unsafe git options without validation. Attackers can supply a template parameter pointing to a directory with malicious git hooks that execute arbitrary code when git operations are performed on the...

PT-2026-79358

SiYuan before v3.7.4 fails to validate the packageName parameter in Bazaar install and uninstall endpoints, allowing authenticated administrators to perform path traversal via directory traversal sequences. Attackers with admin access can write arbitrary files to any location via install operatio...

PT-2026-79444

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop has a reflected Cross-Site Scripting XSS vulnerability in its dashboard revert functionality with the parameter dashboard id in /pages/ajax.render.php. This issue has been fixed in version 3.2.3...

PT-2026-79412

Name of the Vulnerable Software and Affected Versions Omnigent versions prior to 0.3.0 Description Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. The multipart POST '/v1/sessions' endpoint accepts an authenticated user's agent bundle, but the...

PT-2026-79345

A vulnerability in misp-stix could allow a crafted STIX document to influence security-sensitive MISP attribute metadata during import. The STIX import logic automatically selected between the internal MISP parser and the external STIX parser based on metadata contained in the STIX document itsel...

PT-2026-79382

Joomla Extension - yootheme.com - Reflected XSS and open redirect via the submission redirect parameter in Zoo 4.1.66...

PT-2026-80333

Summary An uncontrolled resource consumption vulnerability in openapi3filter lets any unauthenticated client force multi-gigabyte heap allocation with a single, tiny HTTP request. When a spec declares a deepObject-style query parameter whose schema contains an array a normal, documented pattern,...

PT-2026-79300

The Link Whisper Free WordPress plugin before 0.9.7 does not properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users with the Editor role or above to perform SQL injection attacks...

PT-2026-79304

The Media Library Assistant WordPress plugin before 3.40 does not validate a search parameter before concatenating it into a SQL query in one of its media-library query handlers, allowing users with the Author role to perform SQL injection...

PT-2026-79418

Missing minimum size validation in secure context allocation in FreeRTOS-Kernel before 11.3.1 might allow local users to corrupt secure-world heap metadata via an out-of-bounds write with an undersized stack size parameter. To remediate this issue, users should upgrade to version 11.3.1 or later...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102090)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102090 advisory. In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctpunpackcookie only...

The vulnerability of the Metabase data visualization and reporting software lies in the lack of security measures for query structures, allowing attackers to enhance their privileges and execute arbitrary code.

The vulnerability of the Metabase data visualization and reporting software relates to the lack of measures taken to protect the SQL query structure during the processing of the resetpassword parameter. Exploiting this vulnerability allows a malicious actor to enhance their privileges and execute...

PT-2026-80230

Summary Unleash's addon/integration subsystem lets an operator configure a webhook and the Slack, Microsoft Teams, Datadog, and New Relic integrations with a target url parameter. Whenever a subscribed feature-flag event fires, the Unleash server itself issues an HTTP request to that configured...

PT-2026-80290

Summary A nil-pointer dereference in openapi3filter.ConvertErrors lets any unauthenticated client crash a server with a single HTTP request. When an application validates a multipart/form-data request body and renders the resulting validation error through the library-provided...

PT-2026-79474

Name of the Vulnerable Software and Affected Versions kin-openapi versions 0.124.0 through 0.141.0 Description An unauthenticated client can trigger a denial of service by sending a query with sparse indexes in a deepObject query parameter to an endpoint whose schema contains an array. The functi...

PT-2026-80328

Summary Xinference used Python's unsafe eval function when parsing Llama3 tool-call output generated by a large language model. Because the model output can be influenced by attacker-controlled prompts sent to the chat completion API, a remote attacker can craft prompts that cause the model to...