CVE-2026-57898

In Eclipse BaSyx Java Server SDK versions 2.0.0-milestone-05 to 2.0.0-milestone-12, deployments using the MongoDB backend are vulnerable to an unauthenticated arbitrary file write through the AAS thumbnail API. The AAS thumbnail upload path accepted a client-controlled fileName request parameter...

PT-2026-58055

Name of the Vulnerable Software and Affected Versions FortiOS versions 7.6.0 through 7.6.4 FortiOS versions 7.4.x FortiOS versions 7.2.x FortiProxy versions 7.6.0 through 7.6.4 FortiProxy versions 7.4.x FortiProxy versions 7.2.x Description An improper neutralization of CRLF Carriage Return Line...

PT-2026-57990

Name of the Vulnerable Software and Affected Versions Eclipse BaSyx Java Server SDK versions 2.0.0-milestone-05 through 2.0.0-milestone-12 Description Deployments using the MongoDB backend are subject to an unauthenticated arbitrary file write via the AAS thumbnail API. The issue occurs because t...

Veeam Management Pack for Microsoft System Center / Veeam Backup & Replication 13 Compatibility

Article Applicability The patch on this article only enables monitoring of Windows-based Veeam Backup & Replication 13.x deployments. Veeam Management Pack for Microsoft System Center 9a does not support monitoring Veeam Software Appliance. Challenge After Veeam Backup & Replication is upgraded t...

Critical: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: prometheus3.13: prometheus3.13-3.13.1-0.1.hum1 aarch64, x8664 prometheus3.13-3.13.1-0.1.hum1.src src...

CVE-2026-13239

creationtimestamp| type| source ---|---|--- 2026-07-13 17:36:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqka56ugml2b...

pypdf: Possible infinite loop when processing threads/articles in writer

ImpactAn attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with threads/articles into a writer. PatchesThis has been fixed in pypdf==6.13.1. WorkaroundsIf users cannot upgrade yet, consider applying the changes from PR 3839...

PYSEC-2026-3032 python-engineio has unbound thread allocation that can cause denial of service

Impact An attacker can cause the creation of unnecessary background threads in the python-engineio server by exploiting the heartbeat mechanism, which launches a thread when a new connection is received, and when the client sends a PONG packet. Note: this issue primarily affects synchronous...

pypdf: Possible infinite loop when retrieving fonts for layout-mode text extraction

ImpactAn attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires extracting the text in layout mode. PatchesThis has been fixed in pypdf==6.13.0. WorkaroundsIf you cannot upgrade yet, consider applying the changes from PR 3830...

PYSEC-2026-3022 pypdf: Possible infinite loop when processing outlines/bookmarks in writer

Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with outlines into a writer. Patches This has been fixed in pypdf==6.13.0. Workarounds If you cannot upgrade yet, consider applying the changes from PR 3830...

PYSEC-2026-3009 pypdf: Possible infinite loop when retrieving fonts for layout-mode text extraction

Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires extracting the text in layout mode. Patches This has been fixed in pypdf==6.13.0. Workarounds If you cannot upgrade yet, consider applying the changes from PR 3830...

PYSEC-2026-2396 Improper S3 ownership verification in Bedrock AgentCore Starter Toolkit

Summary An issue has been identified in the Bedrock AgentCore Starter Toolkit versions prior to v0.1.13 that may allow a remote actor to inject code during the build process, leading to code execution in the AgentCore Runtime. Impact A remote actor could inject code during the build process,...

Scrapy is vulnerable to a denial of service (DoS) attack due to flaws in brotli decompression implementation

Scrapy versions up to 2.13.3 are vulnerable to a denial of service DoS attack due to a flaw in its brotli decompression implementation. The protection mechanism against decompression bombs fails to mitigate the brotli variant, allowing remote servers to crash clients with less than 80GB of...

Malciously crafted QPY files can allows Remote Attackers to Cause Denial of Service in Qiskit

ImpactA maliciously crafted QPY file containing a malformed symengine serialization stream as part of the larger QPY serialization of a ParameterExpression object can cause a segfault within the symengine library, allowing an attacker to terminate the hosting process deserializing the QPY payload...

PYSEC-2026-3045 Malciously crafted QPY files can allows Remote Attackers to Cause Denial of Service in Qiskit

Impact A maliciously crafted QPY file containing a malformed symengine serialization stream as part of the larger QPY serialization of a ParameterExpression object can cause a segfault within the symengine library, allowing an attacker to terminate the hosting process deserializing the QPY payloa...

TensorFlow has segfault in array_ops.upper_bound

Impactarrayops.upperbound causes a segfault when not given a rank 2 tensor. PatchesWe have patched the issue in GitHub commit 915884fdf5df34aaedd00fc6ace33a2cfdefa586.The fix will be included in TensorFlow 2.13. We will also cherrypick this commit in TensorFlow 2.12.1. For more informationPlease...

PYSEC-2026-3190 TensorFlow has segfault in array_ops.upper_bound

Impact arrayops.upperbound causes a segfault when not given a rank 2 tensor. Patches We have patched the issue in GitHub commit 915884fdf5df34aaedd00fc6ace33a2cfdefa586. The fix will be included in TensorFlow 2.13. We will also cherrypick this commit in TensorFlow 2.12.1. For more information...

CVE-2026-57727

Missing Authorization vulnerability in Themeum Kirki kirki allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kirki: from n/a through = 6.0.13...

CLEANSTART-2026-NM99858 Security fixes for CVE-2025-61732, CVE-2025-68121 applied in versions: 2.13.1-r0

Multiple security vulnerabilities affect the rancher-agent package. These issues are resolved in later releases. See references for individual vulnerability details...

CVE-2026-12274

The Tutor LMS WordPress plugin, in versions prior to 3.9.13 , is vulnerable to an Insecure Direct Object Reference (IDOR) . The flaw exists because one of its content-builder save handlers fails to verify if a requesting user has permission to edit a target post before overwriting it. Instead, th...