PT-2026-68007

Name of the Vulnerable Software and Affected Versions Apache Qpid Broker-J versions prior to 10.1.0 Description An authenticated attacker can cause a denial of service by crafting a disposition frame with large or illegal ranges. This occurs because of naive range handling, which results in...

PT-2026-68000

Name of the Vulnerable Software and Affected Versions Apache Qpid Proton-Dotnet versions prior to 1.1.0 Description An authenticated attacker can cause a denial of service by crafting a disposition frame with large or illegal ranges. This occurs because of naive range handling, which results in...

PT-2026-68001

Name of the Vulnerable Software and Affected Versions Apache Qpid Proton-Dotnet versions prior to 1.1.0 Description An authenticated attacker can cause excessive resource usage and a potential denial of service because the system cannot govern the maximum number of transfer frames per incoming...

PT-2026-68004

Name of the Vulnerable Software and Affected Versions Apache Qpid ProtonJ2 versions prior to 1.2.0 Description An authenticated attacker can cause excessive resource usage and a potential denial of service because the system cannot govern the maximum number of transfer frames per incoming deliver...

PT-2026-67996

Name of the Vulnerable Software and Affected Versions Apache Qpid Proton-J versions prior to 0.35.0 Description An authenticated attacker can cause a denial of service by crafting a disposition frame with large or illegal ranges. This occurs because of naive range handling, which results in...

SUSE SLES15 Security Update : bind (SUSE-SU-2026:3476-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3476-1 advisory. This update for bind fixes the following issues - CVE-2026-10723: Incorrect acceptance of NSEC3 records bsc1271982. - CVE-2026-1133...

SUSE SLES15 Security Update : bind (SUSE-SU-2026:3477-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3477-1 advisory. This update for bind fixes the following issues - CVE-2026-10723: Incorrect acceptance of NSEC3 records bsc1271982. - CVE-2026-1133...

CVE-2026-70484 Open WebUI: Users denied the image-generation permission can still generate images via chat completions

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 until 0.11.0, the legacy chat-completions features block trusted a client-supplied imagegeneration flag and did not re-check the features.imagegeneration permission that the direct image routes and...

CVE-2026-70484 Open WebUI: Users denied the image-generation permission can still generate images via chat completions

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 until 0.11.0, the legacy chat-completions features block trusted a client-supplied imagegeneration flag and did not re-check the features.imagegeneration permission that the direct image routes and...

python-pillow: Pillow: Denial of Service via crafted BDF font file

A flaw was found in Pillow, a Python imaging library. This vulnerability allows a remote attacker to cause a Denial of Service DoS by providing a specially crafted BDF font file. The library's image processing function fails to properly validate dimensions from the font file, bypassing a critical...

python-pillow: Pillow: Denial of Service via crafted BDF font file

A flaw was found in Pillow, a Python imaging library. This vulnerability allows a remote attacker to cause a Denial of Service DoS by providing a specially crafted BDF font file. The library's image processing function fails to properly validate dimensions from the font file, bypassing a critical...

CVE-2026-69256

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent node allowed users to provide Python code that is executed through pyodide; although a denylist blocked dangerous Python constructs, pandas.readpickle could deserialize a pickled...

CVE-2026-18801

OpenMeter contains a stored, or second-order, SQL injection vulnerability in the handling of customer usage-attribution values. An attacker who can create or update a customer can store a malicious value in the usageAttribution.key or usageAttribution.subjectKeys fields. When that customer is...

python-pillow: Pillow: Denial of Service via crafted PCF font data

A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit this vulnerability by providing specially crafted PCF font data. This data, when processed, can lead to excessive memory allocation because the library does not properly check for decompression bombs. The primar...

MAL-2026-11838 Malicious code in @servicetitan/component-usage (npm)

npm/@servicetitan/component-usage is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malware in @servicetitan/component-usage

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2026-25288

CVE-2026-25288 refers to a transient denial-of-service in WLAN firmware when handling a short target wake time channel usage response frame built with insufficient packet size. Documented in multiple sources (CVE, NVD, CVE list, EUVD), this appears to affect WLAN firmware as reported, with root c...

CVE-2026-25288 Buffer Over-read in WLAN Firmware

Transient DOS when processing a short target wake time channel usage response frame with insufficient packet size...

EUVD-2026-52736

Transient DOS when processing a short target wake time channel usage response frame with insufficient packet size...

CVE-2026-18801

OpenMeter is affected by a stored/second-order SQL injection in the handling of customer usage-attribution values. A user who can create or update a customer can store a crafted value in usageAttribution.key or usageAttribution.subjectKeys, which is later incorporated into a ClickHouse WITH map(....