CVE-2026-21889

CVE-2026-21889 affects the Weblate web-based localization tool. Before version 5.15.2, screenshot images were served directly by the HTTP server without proper access control, potentially allowing an unauthenticated attacker to access screenshots by guessing filenames. This could impact confident...

EUVD-2026-2015

Outray openSource ngrok alternative. Prior to 0.1.5, a TOCTOU race condition vulnerability allows a user to exceed the set number of active tunnels in their subscription plan. This vulnerability is fixed in 0.1.5...

CVE-2025-12053

The drivers in the tool packages use RTLQUERYREGISTRYDIRECT flag to read a registry value to which an untrusted user-mode application may be able to cause a buffer overflow...

CVE-2025-12051

The drivers in the tool packages use RTLQUERYREGISTRYDIRECT flag to read a registry value to which an untrusted user-mode application may be able to cause a buffer overflow...

CVE-2025-12052

The drivers in the tool packages use RTLQUERYREGISTRYDIRECT flag to read a registry value to which an untrusted user-mode application may be able to cause a buffer overflow...

CVE-2025-12053

CVE-2025-12053 describes a buffer overflow in drivers within tool packages caused by using RTL_QUERY_REGISTRY_DIRECT to read a registry value. An untrusted user-mode application could trigger overflow, with local access required (CTL: LOW privileges) and no user interaction. Public references (NV...

CVE-2025-12050

The drivers in the tool packages use RTLQUERYREGISTRYDIRECT flag to read a registry value to which an untrusted user-mode application may be able to cause a buffer overflow...

PT-2026-2440

Name of the Vulnerable Software and Affected Versions Windows Kernel Driver affected versions not specified Description The drivers within the tool packages utilize the RTL QUERY REGISTRY DIRECT flag when reading a registry value. This process is susceptible to a buffer overflow if an untrusted...

MiracleLinux 3 : ntp-4.2.2p1-9.2.2AXS3 (AXSA:2009-434:03)

The remote MiracleLinux 3 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2009-434:03 advisory. The Network Time Protocol NTP is used to synchronize a computer's time with another reference time source. The ntp package contains utilities and daemons that...

Security Bulletin: NVIDIA NSIGHT Graphics - January 2026

NVIDIA has released a software update for NVIDIA® NSIGHT Graphics. To protect your system, download and install this software update from the Download NVIDIA NSIGHT Graphics page. Go to NVIDIA Product Security...

PT-2026-2437

Name of the Vulnerable Software and Affected Versions Windows Kernel Drivers affected versions not specified Description The drivers within the tool packages utilize the RTL QUERY REGISTRY DIRECT flag when reading a registry value. This process is susceptible to a buffer overflow if an untrusted...

PT-2026-2439

Name of the Vulnerable Software and Affected Versions Windows Kernel Driver affected versions not specified Description The drivers within the tool packages utilize the RTL QUERY REGISTRY DIRECT flag when reading a registry value. This process is susceptible to a buffer overflow if an untrusted...

Debian dla-4437 : dirmngr - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4437 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4437-1 [email protected] https://www.debian.org/lts/security/...

MiracleLinux 4 : sos-2.2-17.0.1.AXS4 (AXSA:2012-41:01)

The remote MiracleLinux 4 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2012-41:01 advisory. Sos is a set of tools that gathers information about system hardware and configuration. The information can then be used for diagnostic purposes and debugging...

MiracleLinux 3 : systemtap-0.7.2-3.2AXS3 (AXSA:2009-314:01)

The remote MiracleLinux 3 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2009-314:01 advisory. SystemTap is an instrumentation system for systems running Linux 2.6. Developers can write instrumentation to collect data on the operation of the system. Fix...

The vulnerability of the TGZfname() function in the untgz utility from the zlib compression library allows a perpetrator to execute arbitrary code or cause a service failure.

The vulnerability of the TGZfname function in the untgz utility from the zlib compression library is related to the copying of buffers without checking the size of the input data. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code or cause service interruptions...

CVE-2026-22612

Fickling is a Python pickling decompiler and static analyzer. Prior to version 0.1.7, Fickling is vulnerable to detection bypass due to "builtins" blindness. This issue has been patched in version 0.1.7...

CVE-2026-22687

WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.2.5, after WeKnora enables the Agent service, it allows users to call the database query tool. Due to insufficient backend validation, an attacker can use prompt‑based bypass...

CVE-2026-22785

orval generates type-safe JS clients TypeScript from any valid OpenAPI v3 or Swagger v2 specification. Prior to 7.18.0, the MCP server generation logic relies on string manipulation that incorporates the summary field from the OpenAPI specification without proper validation or escaping. This allo...

CVE-2026-22870

GuardDog is a CLI tool to identify malicious PyPI packages. Prior to 2.7.1, GuardDog's safeextract function does not validate decompressed file sizes when extracting ZIP archives wheels, eggs, allowing attackers to cause denial of service through zip bombs. A malicious package can consume gigabyt...