PT-2026-102634

Name of the Vulnerable Software and Affected Versions Werkzeug versions prior to 3.1.9 Description The safe join function used by send from directory fails to remove empty NTFS Alternate Data Stream ADS markers before checking Windows device names. On Windows systems using NTFS, if an application...

Security Bulletin: IBM Quantum Safe Explorer is affected by multiple vulnerabilities (CVE-2026-19032, CVE-2026-83557)

Summary Multiple vulnerabilities are found in dependent open source libraries used in IBM Quantum Safe Explorer code base. IBM Quantum Safe Explorer has addressed these vulnerabilities by updating the versions of the affected libraries. Vulnerability Details CVEID:CVE-2026-19032 DESCRIPTION:...

Security Bulletin: IBM Quantum Safe Explorer is affected by multiple vulnerabilities

Summary Multiple vulnerabilities are found in dependent open source libraries used in IBM Quantum Safe Explorer code base. IBM Quantum Safe Explorer has addressed these vulnerabilities by updating the versions of the affected libraries. Vulnerability Details CVEID:CVE-2026-64607 DESCRIPTION:...

CVE-2026-98094

In the Linux kernel, the following vulnerability has been resolved: staging: fbtft: make dirtylock IRQ-safe fbtftmkdirty can be reached from the fbcon rendering path while processing printk in hardirq context. Meanwhile, dirtylock is also taken by fbtftdeferredio in workqueue context with local...

CVE-2026-78397

The Link Library WordPress plugin before 7.9.6 does not validate the destination of a user-supplied URL before falling back to an unprotected fetch when its safe request is rejected, allowing unauthenticated visitors to make the site issue requests to hosts on its internal network and to learn fr...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: x86/bugs: Make Safe-RET robust against interrupt injection. An attacker who injects interrupts while the Safe-RET mitigation is executing on machines affected by SRSO can neutralize the safe return sequence, potentially leading t...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted input in Safe Browsing in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass discretionary access control via a malicious file. Chromium security severity: Medium...

WordPress Safe SVG plugin <= 2.5.0 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Safe SVG versions = 2.5.0...

WordPress Safe SVG plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by spectreDeveloper in WordPress Plugin Safe SVG versions = 2.5.0...

GHSA-56V6-2FHR-WXGQ Nautobot: Stored cross-site scripting (XSS) in object create/edit form help text

Impact What kind of vulnerability is it? Who is impacted? It has two related instances that share the same root cause: a user-controlled model field is assigned verbatim to a form field's helptext, which is rendered with Django's |safe filter renderfield.html, bypassing auto-escaping. In both cas...

CVE-2026-84301 FastGPT safe axios SSRF guard still allows DNS rebinding TOCTOU on protected outbound requests

FastGPT is an open-source LLM platform for building AI applications on a knowledge base. Prior to 4.15.2, the safe Axios request interceptor in packages/service/common/api/axios.ts validates a hostname with isInternalAddress before a later HTTP connection performs an independent DNS lookup,...

ship-safe v10.1.0

The independent security agent for AI-written software. It finds issues, investigates whether they are real, and shows you the evidence. Website · Docs · Security & Data Flow · Benchmark · Pricing · Blog · Contribute Ship Safe CLI Ship Safe runs locally in your repo and works in two layers. A...

CVE-2026-92072

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions in the Safe Browsing component...

SUSE CVE-2026-89941

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: Make IIO DMA fence release RCU-safe The dmafence documentation states that if a custom release implementation is provided, the dmafence object must be freed in an RCU-safe way. The current iiodmafence implementation...

TRACTOR Benchmark for Evaluating C to Rust Translators

Memory-safety vulnerabilities remain a persistent source of security risk in critical software, much of which is implemented in memory-unsafe languages such as C and C++. Recent advances in programming languages, program analysis, and artificial intelligence have created new opportunities to...

CVE-2026-85271

Open edX Platform (versions from Redwood until Ulmo and Verawood.1) contains a stored CSS injection vulnerability in email digest notifications. The add_additional_attributes_to_notifications function in openedx/core/djangoapps/notifications/email/utils.py fails to sanitize discussion-title value...

CVE-2026-75031

In the interchange/interchange project, a critical remote code execution RCE vulnerability was found in the “quick question” admin feature. In default installations arbitrary Perl code can be injected and executed server-side by unauthenticated users. The Perl code normally runs within a Safe...

Malicious Package

Overview lint-staged-tailwindcss-altair-dotenv-safe is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that...

PT-2026-95289

Name of the Vulnerable Software and Affected Versions VK All in One Expansion Unit versions prior to 9.118.1 Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. This occurs vi...

Linux Distros Unpatched Vulnerability : CVE-2026-92072

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect boundary conditions in the Safe Browsing component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird...