216 matches found
CVE-2026-45774
compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the compliance-trestle library's profile import mechanism resolves trestle:// URIs and relative file paths by joining them with trestleroot and calling .resolve, but performs no boundary...
CVE-2026-73650 SVGO: removeScripts plugin leaves some executable scripts intact
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.3, 3.3.4, and 4.0.2, the removeScripts plugin, named removeScriptElement in versions 1 through 3, can leave executable content in optimized SVGs because...
CVE-2026-18024
Buffer over-read in PostgreSQL ascii SQL function allows a user to disclose up to 3 bytes after the end of a specific allocation, via a crafted text value. This is the same class of defect that CVE-2026-2006 fixed, though this instance has less impact. Versions before PostgreSQL 18.5, 17.11, 16.1...
EUVD-2026-57844
Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via calls to functions with that argument type. Type "internal" represents a class of mutually-incompatible data structures not intended for...
CVE-2026-64574 affecting package kernel for versions less than 6.6.150.1-1
CVE-2026-64574 affecting package kernel for versions less than 6.6.150.1-1. An upgraded version of the package is available that resolves this issue...
CVE-2026-64363 affecting package kernel for versions less than 6.6.145.2-1
CVE-2026-64363 affecting package kernel for versions less than 6.6.145.2-1. An upgraded version of the package is available that resolves this issue...
CVE-2026-54171 affecting package rubygem-excon for versions less than 0.102.0-2
CVE-2026-54171 affecting package rubygem-excon for versions less than 0.102.0-2. A patched version of the package is available...
CVE-2026-64378 affecting package kernel for versions less than 6.6.145.2-1
CVE-2026-64378 affecting package kernel for versions less than 6.6.145.2-1. An upgraded version of the package is available that resolves this issue...
CVE-2026-64374 affecting package kernel for versions less than 6.6.145.2-1
CVE-2026-64374 affecting package kernel for versions less than 6.6.145.2-1. An upgraded version of the package is available that resolves this issue...
CVE-2026-65940
In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can write arbitrary files to a web-accessible location on the host server...
CVE-2026-48762
TypeBot is a chatbot builder tool. Prior to version 3.16.0, the OpenAI "Create Transcription" action handler fetches a user-supplied audio URL using fetch without applying the SSRF protection that exists elsewhere in the codebase. An attacker can direct the server to make HTTP requests to arbitra...
CVE-2026-73228
Django REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's request.data parsing in restframework/request.py Request.parse passes the underlying HttpRequest stream to JSONParser and FormParser for application/json and application/x-www-form-urlencoded bodies...
CVE-2026-63524 Microsoft Office Information Disclosure Vulnerability
...
CVE-2026-48766
TypeBot (chatbot builder) before version 3.17.0 exposes OpenAI API keys stored in workspaces. A low-privilege guest can exfiltrate credentials by invoking the OpenAI model-listing helper with an attacker-controlled baseUrl. The vulnerability decrypts the workspace credential, constructs an OpenAI...
CVE-2026-59700
A vulnerability has been identified in Simcenter Femap All versions V2606.0001. The affected applications contains an out of bounds read vulnerability while parsing specially crafted BMP files. This could allow an attacker to execute code in the context of the current process...
CVE-2026-11972 affecting package python3 for versions less than 3.12.9-14
CVE-2026-11972 affecting package python3 for versions less than 3.12.9-14. A patched version of the package is available...
Linux Distros Unpatched Vulnerability : CVE-2026-71557
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to...
CVE-2026-15337
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.utils.translation.checkforlanguage is subject to a potential denial-of-service attack when given many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory...
Linux Distros Unpatched Vulnerability : CVE-2026-55990
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when the 'dnscrypt:' clause lists more 'dnscrypt- provider-cert:' files than there are matching...