EulerOS Virtualization 2.12.1 (EulerOS-SA-2026-2744)

According to the versions of the packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if th...

EUVD-2026-43741

Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service...

CVE-2026-44510

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-43620. Reason: This candidate is a duplicate of CVE-2026-43620. Notes: All CVE users should reference CVE-2026-43620 instead of this candidate...

DEBIAN-CVE-2026-44510

Rsync is a file-copying tool that uses a delta-transfer algorithm to synchronize remote and local files. In versions prior to 3.4.3, the receiver-side out-of-bounds array read in rsync's recvfiles lets a malicious rsync server or any peer acting in the sender role deterministically crash any rsyn...

CVE-2026-56452

Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. The implementation of receiving files or directories via SCP did not validate filenames in SCP "C" or "D" commands. A malicious sender could send filenames...

EUVD-2026-41902

Pillow BdfFontFile: Image.new called without decompressionbombcheck — bomb protection bypass via font loading...

CVE-2026-44510

CVE-2026-44510 is a duplicate of CVE-2026-43620 and is not a separately exploitable entry. Connected sources describe the underlying issue as a pre-3.4.3 rsync vulnerability: receiver-side out-of-bounds array read in rsync’s recv_files() during a normal recursive pull can crash an rsync client wh...

CVE-2026-44230

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.4 up to but not including 5.0.10, and 6.0.0 up to but not including 6.0.3 contain a reflected Cross-Site Scripting XSS vulnerability where an attacker who can induce an authenticated RT user to visit a crafted U...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: helm3: helm3-3.21.3-0.1.2.hum1 aarch64, x8664 helm3-3.21.3-0.1.2.hum1.src src...

CVE-2026-13380

VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP responses of three unauthenticated endpoints. The credentials are present in these responses only when SFTP connections have been configured within the application. No authentication is required to retriev...

CVE-2026-44229 RT: Cross-Site Scripting via inline-served uploaded content

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.0 and 6.0.0 and above, prior to both 5.0.10 and 6.0.3 contain a Cross-Site Scripting XSS vulnerability where uploaded content is served inline rather than as an attachment. An authenticated user who can upload...

CVE-2026-44229 RT: Cross-Site Scripting via inline-served uploaded content

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.0 and 6.0.0 and above, prior to both 5.0.10 and 6.0.3 contain a Cross-Site Scripting XSS vulnerability where uploaded content is served inline rather than as an attachment. An authenticated user who can upload...

CVE-2026-44229 RT: Cross-Site Scripting via inline-served uploaded content

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.0 and 6.0.0 and above, prior to both 5.0.10 and 6.0.3 contain a Cross-Site Scripting XSS vulnerability where uploaded content is served inline rather than as an attachment. An authenticated user who can upload...

EUVD-2026-9061

pillow-heif: Integer Overflow in Encode Path Buffer Validation Leads to Heap Out-of-Bounds Read...

EUVD-2025-203029

Tornado: Quadratic DoS via Crafted Multipart Parameters...

EUVD-2025-203031

Tornado: Quadratic DoS via Repeated Header Coalescing...

CVE-2026-61424 Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-Classifieds < 3.11.2

Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-Classifieds 3.11.2 - The Joomla extension DJ-Classifieds is vulnerable to an unauthenticated file upload, leading to full RCE...

CVE-2026-44228 RT: Stored Cross-Site Scripting via insufficient template escaping

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3, contain a stored Cross-Site Scripting XSS vulnerability, where user-controlled data is rendered without proper HTML escaping. An authenticated user with permission to set the relevan...

CVE-2026-44227

RT (Rocket Tickets) is affected in versions 6.0.0 and above up to, but not including, 6.0.3, where a reflected XSS vulnerability exists in URL parameters. An attacker who can lure an authenticated RT user to visit a crafted URL can execute arbitrary JavaScript in that user’s browser session, with...

CVE-2026-44227 RT: Reflected Cross-Site Scripting via URL parameters

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3 contain a reflected Cross-Site Scripting XSS vulnerability. An attacker who can induce an authenticated RT user to visit a crafted URL can execute arbitrary JavaScript in that user's...