PT-2026-64943

Unauthenticated Broken Access Control in Events Made Easy = 3.1.3 versions...

CVE-2026-56747: Improper Control of Generation of Code

Improper control of generation of code in the JSON Pointer-to-accessor compiler in Cribl Stream before 4.18.2 allows a remote authenticated attacker with edit privileges to execute arbitrary JavaScript on the server via a crafted database connection identifier or pack configuration value...

CVE-2026-17500: NULL Pointer Dereference

A vulnerability was detected in ggml-org llama.cpp d006858/e15efe0. This affects the function visitpattern of the file common/json-schema-to-grammar.cpp. The manipulation results in null pointer dereference. The attack can be launched remotely. The pull request to fix this issue awaits acceptance...

PT-2026-65378

Gitea: Fork Synchronization Continues After Parent Repository Changes from Public to Private in code.gitea.io/gitea...

PT-2026-64968

Contributor Cross Site Scripting XSS in Gallery PhotoBlocks = 1.3.3 versions...

PT-2026-64987

Name of the Vulnerable Software and Affected Versions Erlang OTP versions 25.0 through 27.3.4.14 Erlang OTP versions 28.0 through 28.5.0.3 Erlang OTP versions 29.0 through 29.0.3 Description A signed to unsigned conversion error leads to an out-of-bounds write when the system processes a crafted...

PT-2026-64993

Name of the Vulnerable Software and Affected Versions erlang otp versions 27.0 through 27.3.4.14 erlang otp version 28.5.0.3 erlang otp versions 29.0 through 29.0.3 erts versions 15.0 through 15.2.7.10 erts version 16.4.0.3 erts versions 17.0 through 17.0.3 Description An integer underflow exists...

CVE-2026-17501: Uncontrolled Recursion

A flaw has been found in ggml-org llama.cpp e15efe0. This vulnerability affects the function transform of the file common/json-schema-to-grammar.cpp of the component JSON-Schema-to-GBNF Conversion. This manipulation causes uncontrolled recursion. The attack may be initiated remotely. The pull...

CVE-2026-43749: Improper Limitation of a Pathname to a Restricted Directory

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to gain root privileges...

CVE-2026-65436: Improper Limitation of a Pathname to a Restricted Directory

Editor Arbitrary File Deletion in Kirki = 6.0.13 versions...

Erlang/OTP -- heap corruption decoding invalidly encoded large tuples

The Erlang/OTP team reports: Fixed heap corruption when an invalidly encoded tuple with an arity of 2^31 or larger is decoded from Erlang's External Term Format binarytoterm...

CVE-2025-15662: Server-Side Request Forgery (SSRF)

The Printcart Web to Print Product Designer for WooCommerce WordPress plugin before 2.5.3 does not restrict a user-supplied URL before fetching it server-side and does not enforce a valid authorization check, allowing unauthenticated attackers to read arbitrary local files including configuration...

CVE-2026-64223

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: consume only present negotiated TTLM maps ieee80211tidtolinkmapsizeok validates negotiated TTLM elements against the number of link-map entries indicated by linkmappresence. ieee80211parsenegttlm must consume the...

Rocket.Chat v8.7.0-rc.2

The ultimate secure open-source solution for team communications Rocket.Chat is an open-source, secure, fully customizable communications platform developed in TypeScript for organizations with high standards of data protection. We are the ultimate solution for team communications, enabling...

CVE-2026-17457

The CVE-2026-17457 entry affects mf-yang openclaw-cn up to version 0.2.1. The vulnerability resides in the function assertBrowserNavigationAllowed within src/browser/navigation-guard.ts of the Scheme Handler, where manipulation of the url argument leads to information disclosure. The issue can be...

Arbitrary Code Injection

Overview datamodel-code-generator is a Datamodel Code Generator Affected versions of this package are vulnerable to Arbitrary Code Injection via the customBasePath schema field. An attacker can execute arbitrary Python code by supplying a specially crafted value containing embedded newlines and a...

CVE-2024-14040

In the Linux kernel, the following vulnerability has been resolved: net: nexthop: Increase weight to u16 In CLOS networks, as link failures occur at various points in the network, ECMP weights of the involved nodes are adjusted to compensate. With high fan-out of the involved nodes, and overall...

bramble v1.9.0-chromium

Bramble A password manager that keeps your secrets on your own devices. No account, no server holding your vault, no company to get breached and leak everything. You hold the vault, you hold the password, and that's it. Bramble runs where you do: Browser extension for Chromium browsers Brave,...

i2pd v2.61.0

Note: i2pd for Android can be found in thei2pd-android repository and with a Qt GUI in the i2pd-qt repository. For macOS, a GUI version can be found in the gui-i2pd repository. i2pd Русская версия i2pd I2P Daemon is a full-featured C++ implementation of I2P client. I2P Invisible Internet Protocol...

Fedora 43 : google-osconfig-agent (2026-4a2d23b470)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-4a2d23b470 advisory. Update to 20260717 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested...