CVE-2026-102996

The pypdf pure-python PDF library is vulnerable to excessive memory consumption when parsing font data in versions prior to 6.18.1 . A crafted PDF containing a TrueType or Type1 simple font with an unusually large /Widths array can cause the Font._collect_tt_t1_character_widths function in pypdf/...

CVE-2026-102995 pypdf: Possible large memory usage for large /ToUnicode streams (Follow-up 2)

pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can place unusually large source-code or destination-string tokens in a font /ToUnicode mapping, causing pypdf/cmap.py parsebfchar to decode and retain oversized values during operations such as text extractio...

CVE-2026-102995 pypdf: Possible large memory usage for large /ToUnicode streams (Follow-up 2)

pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can place unusually large source-code or destination-string tokens in a font /ToUnicode mapping, causing pypdf/cmap.py parsebfchar to decode and retain oversized values during operations such as text extractio...

CVE-2025-63820

CVE-2025-63820 Submitter: Nicola Giuffrida Information Vendor: TOTOLINK Vendor's website: TOTOLINK Model: A720R Firmware version: V4.1.5cu.630B20250509 Firmware download address: TOTOLINK Vulnerability details When logging into the control panel, the username and password are sent in plain-text:...

PT-2026-103601

Name of the Vulnerable Software and Affected Versions modelscope Agentscope versions 1.0.0 through 1.0.8 Description A path traversal issue exists in the insert text file function. Path traversal is a flaw that allows an attacker to access files and directories that are stored outside the intende...

DeBERTa-ConPara: Attack-Aware and Deployment-Realistic Detection of AI-Generated Text

Robust detection of AI-generated text under deployment conditions is challenging: distribution shifts across domains and generators, adversarial perturbations of the input surface, and the absence of target-domain labels for threshold calibration all degrade detectors that perform well in-domain...

CentOS Linux 8.4 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-filesystem / etc (CENTOS8.4:CLSA-2026:1782979343)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1782979343 advisory. - A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security TLS servers. An attacker...

CentOS Linux 7 [TuxCare] Security Update: python3 / python3-debug / python3-devel / python3-idle / etc (CENTOS7:CLSA-2026:1788004965)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1788004965 advisory. - When using the configparser module to write configuration files containing multi-line text values with carriage return characters \r the...

CentOS Linux 8.5 [TuxCare] Security Update: python2 / python2-debug / python2-devel / python2-libs / etc (CENTOS8.5:CLSA-2026:1787663936)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1787663936 advisory. - When using the configparser module to write configuration files containing multi-line text values with carriage return characters \r the...

Linux Distros Unpatched Vulnerability : CVE-2026-100784

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153....

Do Defenses against LLM Extraction Work across Attacks? A Lifecycle Benchmark of Black-Box Model Extraction

Large language models LLMs deployed through text-only APIs face model extraction risks, as adversaries can collect their responses to train surrogates that reproduce their capabilities. While prior work has developed diverse attacks and defenses, evaluations remain fragmented across access...

PT-2026-103600

Name of the Vulnerable Software and Affected Versions modelscope Agentscope versions 1.0.0 through 1.0.18 Description A path traversal issue exists in the write text file function. Path traversal is a flaw that allows an attacker to access or manipulate files and directories outside the intended...

Rocky Linux 9.6 [TuxCare] Security Update: python3.11 / python3.11-debug / python3.11-devel / python3.11-idle / etc (ALMALINUX9.6:CLSA-2026:1787312520)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787312520 advisory. - When using the configparser module to write configuration files containing multi-line text values with carriage return characters \r the...

CentOS Linux 6 [TuxCare] Security Update: python / python-devel / python-libs / python-test / python-tools / etc (CENTOS6:CLSA-2026:1788794443)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1788794443 advisory. - When using the configparser module to write configuration files containing multi-line text values with carriage return characters \r the...

SUSE CVE-2026-97942

In the Linux kernel, the following vulnerability has been resolved: x86/alternatives: Exclude text poking against changepageattr From time to time, the following BUG can be observed in the x86 alternatives patching code 0: kernel BUG at arch/x86/kernel/alternative.c:2576! Oops: invalid opcode: 00...

SUSE CVE-2026-100784

Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17...

CVE-2026-102937

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, BatchActivator.quote returns prompt text unchanged before activate.bat inserts it into a cmd.exe set "VAR=value" statement. An attacker who influences --prompt, VIRTUALENVPROMPT, or the corresponding...

Uncontrolled Resource Consumption

Apache Struts is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to unbounded growth of internal localized-text caches based on attacker-controlled locale values from incoming requests, which allows an unauthenticated remote attacker to exhaust the Java heap and cause a...

CVE-2026-34212

CVE-2026-34212 Docmost は、アタッチメントノード内の javascript: URL を受け入れ、それをストレージとレンダリングを通じて保持し、Docmost オリジン内のクリック可能なアンカーに変換していました。 概要 私は Docmost （オープンソースの共同作業ドキュメントプラットフォーム）において、高深刻度の保存型XSS の問題を特定し、責任を持って開示し、再現しました。 Docmost の公式サイトでは、エンタープライズ対応のオンプレミス Wiki として 300 万以上のダウンロード があり、ビリニュス市 、Bechtle 、オーストラリア政府 、赤十...

postgresql-cve-2026-14662

CVE-2026-14662 を追いかける — PostgreSQL 全文検索の範囲外書き込み脆弱性 PostgreSQL の全文検索データ型（tsvector / tsquery）に見つかった CVE-2026-14662 について、 修正前（18.4）と修正後（18.6）を Docker で同時に動かし、挙動の差を実際に観測した 記録です。 セキュリティ学習用にまとめたもので、発表資料も同梱しています。 この脆弱性のあらまし 項目| 内容 ---|--- CVE| CVE-2026-14662 対象| PostgreSQL の tsvector / tsquery 種類|...