PT-2026-89423

A security vulnerability has been detected in proma-ai Proma up to 0.19.37. Affected is the function resolveTargetPath of the file apps/electron/src/main/lib/file-preview-service.ts of the component File Preview Service. Such manipulation of the argument file path leads to path traversal. Local...

Important: vim security update

Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: Vim: Information disclosure and denial of service via crafted Unicode characters in terminal emulator CVE-2026-28420 vim: Vim: Denial of Service via out-of-bounds write in terminal handling CVE-2026-52859 vi...

Python Library Tornado < 6.5.8 DoS (CVE-2026-82397)

The version of the Tornado Python package installed on the remote host is prior to 6.5.8. It is, therefore, affected by a denial of service vulnerability: - Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded...

CVE-2026-71643

An issue in ZJU-FAST-Lab EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 allows an attacker to cause a denial of service via the EGOReplanFSM component...

Oracle Linux 10 : ELSA-2026-65816-0: / qt6-qt5compat (ELSA-2026-658160)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-658160 advisory. 6.10.1-1.1 - Fix out-of-bounds read in QTextCodec::codecForName CVE-2026-9499 Resolves: RHEL-247204 Tenable has extracted the preceding description block...

Moderate: apr-util security update

The mission of the Apache Portable Runtime APR is to provide a free library of C data structures and routines. This library contains additional utility interfaces for APR; including support for XML, LDAP, database interfaces, URI parsing and more. Security Fixes: apr-util: Apache Portable Runtime...

Important: vim security update

Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: Vim: Information disclosure and denial of service via crafted Unicode characters in terminal emulator CVE-2026-28420 vim: Vim: Denial of Service via out-of-bounds write in terminal handling CVE-2026-52859 vi...

UBUNTU-CVE-2026-39020

An issue in WIngs3D v.2.4.1 allows a local attacker to cause a denial...

Linux Distros Unpatched Vulnerability : CVE-2026-89045

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read, allowing attackers to trigger infinit...

CVE-2026-71645

CVE-2026-71645 affects RACER , a robotics framework developed by the SYSU STAR Group (Robotics-STAR-Lab) . The vulnerable component is the exploration state machine , and the tested affected version is commit abcdef1234567890 . An attacker can trigger a denial of service by exploiting a flaw in t...

CVE-2026-71647

CVE-2026-71647 affects EGO-Planner-v2 (by ZJU-FAST-Lab), a motion planning tool for autonomous vehicles. All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 are vulnerable to denial of service via the checkCollisionCallback, execFSMCallback, and planFromGlobalTraj functions in ego_...

CVE-2026-71647

An issue in EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 allows an attacker to cause a denial of service via the checkCollisionCallback, execFSMCallback, planFromGlobalTraj in egoreplanfsm.cpp...

apr-util security update

1.6.1-23.1 - Resolves: RHEL-236631 - apr-util: Apache Portable Runtime Utility: Information disclosure via timing attack in password validation CVE-2025-49506 - Resolves: RHEL-236266 - apr-util: Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client CVE-2026-34502 - Resolve...

PT-2026-89520

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Plumbing::DeSerialize in src/lstm/plumbing.cpp rejects excessively large network stacks but accepts a zero-length stack for NT SERIES, NT PARALLEL, or NT REVERSED layers in a crafted .traineddata model. During LSTMRecognizer...

PT-2026-89696

Summary When backend/local is used with --links/-l or the links=true config option, each symlink is exposed as an rclone object whose content is the target path string, suffixed .rclonelink. Object.Open decodes an incoming fs.RangeOption via Decodeo.Size, then for a translated-symlink object pass...

PT-2026-89524

zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read, allowing attackers to trigger infinite loops. Attackers can pass negative length values to cause the read method to spin indefinitely while holding the stream monitor, blocki...

PT-2026-89718

Several functions in cstruct may use wrong data, leading to unexpected exceptions and return corrupted data. Impact - Cstruct.filter map writes retained bytes at their original input positions, producing corrupted output when earlier bytes are dropped. - Cstruct.tail rev:true removes two bytes...

PT-2026-89722

A vulnerability in lightning-ai/pytorch-lightning version 2.3.2 allows an attacker to cause a denial of service by sending an unexpected POST request to the /api/v1/state endpoint of LightningApp. This issue occurs due to improper handling of unexpected state values, which results in the server...

PT-2026-89688

Summary There is a medium severity vulnerability in Traefik's HTTP/3 entry points: the respondingTimeouts settings were not applied to the HTTP/3 request path. readTimeout in particular is on by default at 60s and is documented as bounding the time to read the entire request including its body, b...

PT-2026-89476

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or links=true exposes symlink targets as .rclonelink objects, and fs.RangeOption.Decode can pass an unchecked positive Range start through...