23762 matches found
EUVD-2026-24046
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.4.0 through 3.4.9, 3.3.0 through 3.3.9, and 3.2.0 through 3.2.7, internaldwacompressor.h:1722 performs curc-width curc-height in int32...
CLEANSTART-2026-DY53885 Security fixes for ghsa-72hv-8253-57qq applied in versions: 3.8.6-r0
Security vulnerability affects the apache-zookeeper package. This issue is resolved in later releases. See references for vulnerability details...
CVE-2026-39378
The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. In versions 6.5 through 7.17.0, when HTMLExporter.embedimages=True, nbconvert's markdown renderer allows arbitrary file read via path traversal in image references. A malicious notebook...
PT-2026-33910
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, attachment download tokens are generated using a weak and predictable formula: md5APP KEY + attachment id + size. Since attachment id is sequential and size can be brute-forced in a small range, an...
PT-2026-34197
Name of the Vulnerable Software and Affected Versions WWBN AVideo versions 29.0 and earlier Description Cross-Site Request Forgery occurs in three admin-only JSON endpoints: 'objects/categoryAddNew.json.php', 'objects/categoryDelete.json.php', and 'objects/pluginRunUpdateScript.json.php'. These...
PT-2026-34030
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, when APP SHOW ONLY ASSIGNED CONVERSATIONS is enabled, direct conversation view correctly blocks users who are neither the assignee nor the creator. The save draft AJAX path is weaker. A direct POST can create ...
Unity Linux 20.1070a Security Update: kernel (UTSA-2026-013077)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013077 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check NULL before accessing WHAT IGT kmscursorlegacy's...
PT-2026-34206
Name of the Vulnerable Software and Affected Versions WWBN AVideo versions prior to 29.1 Description An issue exists where the isValidDuration function at 'objects/video.php:918' uses a regular expression /^0-91,2:0-91,2:0-91,2/ that lacks a $ end anchor. This allows arbitrary HTML or JavaScript ...
PT-2026-34057
mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the mailcow web interface passes the raw $ SERVER'REQUEST URI' to Twig as a global template variable and renders it inside a JavaScript string literal in the setLang helper of base.twig,...
PT-2026-33879
Name of the Vulnerable Software and Affected Versions nbconvert versions 6.5 through 7.17.0 Description The nbconvert tool converts Jupyter notebooks to various formats using Jinja templates. When the HTMLExporter.embed images variable is set to True, the markdown renderer allows arbitrary file...
PT-2026-34202
Name of the Vulnerable Software and Affected Versions WWBN AVideo versions 29.0 and earlier Description The allowOrigin$allowAll=true function in objects/functions.php reflects any arbitrary Origin header back in Access-Control-Allow-Origin along with Access-Control-Allow-Credentials: true. This...
PT-2026-34036
blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, the password change form at /profile/slug/edit/ does not include a current password field and does not verify the user's existing password before accepting a new one. Any attacker who obtains a valid authenticated session —...
PT-2026-37377
Name of the Vulnerable Software and Affected Versions gnutls versions prior to 3.8.13-1.1 Description Servers configured with RSA-PSK Rivest–Shamir–Adleman – Pre-Shared Key incorrectly match usernames containing a NUL character with truncated usernames. A remote attacker can exploit this by sendi...
python311-PyPDF2-2.11.1-9.1 on GA media (moderate)
python311-PyPDF2-2.11.1-9.1 on GA media Announcement ID: openSUSE-SU-2026:10582-1 Rating: moderate Cross-References: CVE-2026-40260 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the...
Important: Red Hat Security Advisory: grafana-pcp security update
An update for grafana-pcp is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
SUSE-SU-2026:1502-1 Security update for python312
This update for python312 fixes the following issues: - CVE-2026-3446: Base64 decoding stops at first padded quad by default bsc1261970...
CVE-2026-25058
CVE-2026-25058 affects Vexa. The transcription-collector exposes an unauthenticated internal endpoint GET /internal/transcripts/{meeting_id}, allowing enumeration of meeting IDs and access to any user’s transcripts without authentication. Root cause: missing auth checks on the internal transcript...
CLSA-2026-1776698705 graphviz: Fix of CVE-2023-46045
CVE-2023-46045: fix out-of-bounds read via crafted config6a file...