PT-2026-73387

An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate active cursors on a separate database, disrupting ongoing query operations for other users. The behavior stems from an authorization check that does not correctly scope privileges...

CVE-2026-65343: Use After Free

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. A remote attacker may be able to cause unexpected system termination...

CVE-2026-64787: Use After Free

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to an unexpected...

CVE-2026-65349: Out-of-bounds Read

An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Sequoia 15.8, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination or read kernel memory...

PT-2026-76859

Name of the Vulnerable Software and Affected Versions iOS versions prior to 26.6.1 iPadOS versions prior to 26.6.1 macOS Tahoe versions prior to 26.6.2 Description A use after free issue, which occurs when a program continues to use a pointer after it has been freed, can be exploited by a remote...

PT-2026-76844

Name of the Vulnerable Software and Affected Versions iOS versions prior to 26.6.1 iPadOS versions prior to 26.6.1 macOS Tahoe versions prior to 26.6.2 Description A use-after-free issue, which occurs when a program continues to use a pointer after it has been freed, can lead to unexpected proces...

CVE-2026-54758: Stack-based Buffer Overflow

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the expandNppEnvironmentStrs function in PowerEditor/src/WinControls/StaticDialog/RunDlg/RunDlg.cpp copies a Notepad++ variable name between $ and into the fixed-size wchart strMAXPATH stack buffer without bounding the m loop...

PT-2026-76803

Determined fails to authorize requests on the generic task kill, pause, and unpause endpoints in the API handlers. Authenticated attackers can disrupt other users' workloads by terminating, pausing, or unpausing tasks they do not own...

CVE-2026-65330: Improper Restriction of Operations within the Bounds of a Memory Buffer

The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Sequoia 15.8, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination or corrupt kernel memory...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-100164)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100164 advisory. In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix loop termination condition in gssfreeintokenpages The intoken-pages array is not NULL...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099697)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099697 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: module names must be null-terminated We need to explicitly check the length,...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100523)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100523 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: module names must be null-terminated We need to explicitly check the length,...

CVE-2026-74794

Scriban before 6.6.0 contains an infinite recursion vulnerability in object rendering when the ObjectRecursionLimit property defaults to unlimited. Attackers can supply circular reference objects to the template context, exhausting stack space and triggering an uncatchable StackOverflowException...

CVE-2026-74792 Scriban before 7.0.0 Stack Overflow via nested array initializers

Scriban before 7.0.0 affected versions = 6.6.0 contains a stack overflow vulnerability in nested array initializer parsing. Deeply nested array initializers recurse through a path ParseArrayInitializer → ParseExpression → ParseArrayInitializer that is not covered by the ExpressionDepthLimit count...

EUVD-2026-59953

Scriban before 7.0.0 contains an uncontrolled recursion vulnerability in the object.tojson builtin function that lacks depth limits and circular reference detection. Attackers can craft templates with self-referencing objects to trigger unbounded recursion, causing a StackOverflowException that...

CVE-2026-74787

Scriban before 7.0.0 contains an uncontrolled recursion vulnerability in the object.tojson builtin function that lacks depth limits and circular reference detection. Attackers can craft templates with self-referencing objects to trigger unbounded recursion, causing a StackOverflowException that...

MINI-Q2FF-XW3H-M4JP

Bulletin has no description...

PT-2026-89054

zstd-jni before 1.5.7-14 fails to validate the samples buffer capacity in Zstd.trainFromBufferDirect, allowing attackers to read past buffer boundaries by supplying oversized per-sample lengths. Attackers can trigger out-of-bounds memory access by providing crafted sample length arrays that cause...

CVE-2026-74783: Uncontrolled Recursion

Scriban versions 6.6.0 through 7.2.0 contain a non-enforcing ExpressionDepthLimit guard that fails to stop recursive descent parsing of deeply nested expressions. Attackers can supply templates with deeply nested parentheses, array initializers, object initializers, or unary operators to trigger ...

SUSE CVE-2026-74493

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix socket use-after-free during link group termination smclgrterminate drops connslock after finding a connection in lgr-connsall, but before taking a reference on its socket. The connection is embedded in the socket, a...