Information disclosure in AccessControl

ImpactPython's "format" functionality allows someone controlling the format string to "read" objects accessible recursively via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown getattr and getitem, not the policy...

SUSE-SU-2026:22637-1 Security update for jq

This update for jq fixes the following issues - CVE-2026-43896: unbounded recursion in jvobjectmergerecursive can lead to C stack exhaustion and a process crash bsc1265075. - CVE-2026-44777: uncontrolled recursion in ordinary module loader when two valid modules include each other can lead to sta...

CVE-2026-41041 Apache Gravitino: URL path injection via unencoded user-supplied identifiers in MCP REST client f-string URL construction, enabling path traversal to unintended API endpoints.

URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino. This issue affects Apache Gravitino: from 1.0.0 before 1.2.1. Users are recommended to upgrade to version 1.2.1, which fixes the issue...

PT-2026-59114

Discovered through manual source code review. Verified by PoC execution against a local dbt-mcp v1.15.1 installation. Summary run dbt command in src/dbt mcp/dbt cli/tools.py constructs the dbt subprocess argument list by appending user-supplied MCP tool parameters without sanitization. Two...

PT-2026-57822

Name of the Vulnerable Software and Affected Versions Perl versions prior to 5.44 Description Incorrect regular expression matches occur when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl study chunk. A trie is a specialized tree-like data structure used...

PT-2026-59027

The access key and connection string connection properties were not marked as sensitive names in secrets masker. This means that user with read permission could see the values in Connection UI, as well as when Connection was accidently logged to logs, those values could be seen in the logs. Azure...

PT-2026-59482

Summary There is a use-after-free in PyObject StealAttrString of pyOpenEXR old.cpp. This bug was found with ZeroPath. Details The legacy adapter defines PyObject StealAttrString that calls PyObject GetAttrString to obtain a new reference, immediately decrefs it, and returns the pointer. Callers...

PT-2026-59009

Impact Python's "format" functionality allows someone controlling the format string to "read" objects accessible recursively via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown getattr and getitem, not the policy...

PT-2026-59311

Description MobSF's read sqlite function in mobsf/MobSF/utils.py lines 542-566 uses Python string formatting % to construct SQL queries with table names read from a SQLite database's sqlite master table. When a security analyst uses MobSF to analyze a malicious mobile application containing a...

PT-2026-59220

LangChain's f-string prompt-template validation was incomplete in two respects. First, some prompt template classes accepted f-string templates and formatted them without enforcing the same attribute-access validation as PromptTemplate. In particular, DictPromptTemplate and ImagePromptTemplate...

PT-2026-59168

Summary The programmatic remote project scanning path rewrites attacker-controlled repository URLs using a blind string replacement and then sends the caller's GitHub credentials with the resulting request. This allows an attacker who can influence the scanned repository URL to trigger SSRF and...

PT-2026-60000

Summary tinytag 2.2.0 allows an attacker who can supply MP3 files for parsing to trigger a non-terminating loop while the library parses an ID3v2 SYLT synchronized lyrics frame. In server-side deployments that automatically parse attacker-supplied files, a single 498-byte MP3 can cause the parsin...

PT-2026-59498

In JazzCore python-pdfkit 1.0.0, the from string method enables the execution of JavaScript code within the context of the server application and the exfiltration of local files...

CVE-2026-15680: Use of Externally-Controlled Format String

Lorex 2K Indoor Wi-Fi Security Camera CDeviceOperator Format String Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Lorex 2K Indoor Wi-Fi Security Cameras. Authentication is not required to exploit th...

The vulnerability of the is_cmd_string_valid function in the /boafrm/formWsc file of the libapmib.so component of the TOTOLINK N300RT router software allows a attacker to influence the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the iscmdstringvalid function in the /boafrm/formWsc file of the libapmib.so component of the TOTOLINK N300RT router software is related to the issue where the operation is performed outside of the buffer in memory when processing the localPin parameter. Exploiting this...

PT-2026-59134

Summary An issue in the low-level DER parsing functions can cause unexpected exceptions to be raised from the public API functions. 1. ecdsa.der.remove octet string accepts truncated DER where the encoded length exceeds the available buffer. For example, an OCTET STRING that declares a length of...

freerdp:TestFuzzChannelRail: Heap-buffer-overflow in _wcsnlen

Project: https://github.com/FreeRDP/FreeRDP.git Detailed Report: https://oss-fuzz.com/testcase?key=5268164724981760 Project: freerdp Fuzzing Engine: libFuzzer Fuzz Target: TestFuzzChannelRail Job Type: libfuzzerasanfreerdp Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address:...

CVE-2026-59162

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, Excelize parses shared-string cell values with strconv.Atoi and checks only the upper bound before indexing the shared string slice, allowing an XLSX file containing a shared-string cell with ...

CVE-2026-58493 grav-plugin-database: DSN Parameter Injection via Unsanitized Configuration Values in Connection String Construction

grav-plugin-database is the database plugin for Grav CMS. Prior to 1.2.0, Database::call builds PDO DSN strings by directly concatenating user-configurable YAML values from fields such as host, dbname, charset, server, database, directory, and filename without sanitization or validation, allowing...

CVE-2026-59162 Excelize: Negative shared-string index causes panic in GetCellValue and GetRows

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, Excelize parses shared-string cell values with strconv.Atoi and checks only the upper bound before indexing the shared string slice, allowing an XLSX file containing a shared-string cell with ...