PT-2026-119526

DBI versions before 1.656 for Perl crash via type confusion in dbi profile when a database handle is destroyed under a Profile Path with an attr element. An attr element names a database handle attribute, which dbi profile reads from the handle's inner hash. It expects the inner handle as a...

PT-2026-118404

Name of the Vulnerable Software and Affected Versions launch-editor versions prior to 2.14.2 Description On Windows, the software fails to escape the % character when passing arguments to cmd.exe. This occurs because .bat or .cmd files cannot be called directly via child process.spawn and must be...

PT-2026-120301

Summary launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. Impact Only apps that match all of the following conditions are affected: - The user uses Windows - An...

AlmaLinux 9.2 [TuxCare] Security Update: sudo / sudo-devel / sudo-python-plugin (ALMALINUX9.2:CLSA-2026:1791834762)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1791834762 advisory. - A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailin...

Atlassian Jira Service Management Data Center and Server < 10.3.13 / 10.4.x < 11.1.1 (JSDSERVER-16831)

The version of Atlassian Jira Service Management Data Center and Server Jira Service Desk running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16831 advisory. - In Bouncy Castle for Java before 1.86, NTRU reduced secret values with the % operator in three helpe...

Linux Distros Unpatched Vulnerability : CVE-2026-98590

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Fix bpfsock context code generation Currently, the ctx access code reads the rxqueuemapping field with either a 4-byte or 2-byte load. The rest of the bits...

Linux Distros Unpatched Vulnerability : CVE-2026-98719

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: SEV: Nullify have run CPUs mask pointer when freeing it Nullify haveruncpus when freeing the mask, particularly in the error path of sevguestinit, so that...

Linux Distros Unpatched Vulnerability : CVE-2026-108518

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - DBI versions before 1.656 for Perl crash via type confusion in dbiprofile when a database handle is destroyed under a Profile Path with an attr element. An attr...

Linux Distros Unpatched Vulnerability : CVE-2026-98621

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: gue: reject invalid REMCSUM offsets The REMCSUM option carries an absolute checksum start and checksum field offset. gueremcsum passes them to...

Security update for gitoxide (moderate)

openSUSE security update: security update for gitoxide ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22126-1 Rating: moderate References: bsc1281749 Cross-References: CVE-2026-91986 CVSS scores: CVE-2026-91986 SUSE : 5.4...

Security update for grafana (important)

openSUSE security update: security update for grafana ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22125-1 Rating: important References: bsc1263330 bsc1265525 bsc1265763 bsc1268868 bsc1269841 bsc1271330 bsc1272008 bsc1272328 bsc1272427 bsc1274217...

Apache Paimon 2.1.0 MySQL CDC Arbitrary File Read

Apache Paimon versions 2.1.0 and 2.0.0 MySQL CDC synchronization actions allow user-supplied JDBC properties that can enable a rogue MySQL server to request arbitrary local files from the CDC process. !/usr/bin/env bash Apache Paimon 2.1.0 MySQL CDC Arbitrary File Read Vendor: The Apache Software...

Testing TLS 1.3 PQC on Constrained Devices and Microcontrollers

The UK, EU and US governments have set timelines for post-quantum cryptography migration of critical systems, with deadlines ranging from 2028 to 2035. This paper focuses on IoT-class devices and microcontrollers and the viability of using PQC to connect these devices in secure TLS 1.3 connection...

prismsec

PrismSec 🔷 Secure, modular MCP server for pentesting tools. Wraps 7 industry-standard security tools nmap, nuclei, gobuster, subfinder, httpx, nikto, sqlmap into 13 registered MCP tools — ready to use with Claude, Cursor, Copilot, and any MCP-compatible AI agent. Features Feature| Description...

Use of Uninitialized Variable

Overview Affected versions of this package are vulnerable to Use of Uninitialized Variable via fontrenderimpl in src/imagingft.c, where a FTGlyph object can be freed via FTDoneGlyph during the rendering loop when a stroker is active, and then freed a second time in the glypherror cleanup path due...

Use of Uninitialized Variable

Overview Affected versions of this package are vulnerable to Use of Uninitialized Variable in the topalette function in src/libImaging/Convert.c when quantize is called with an empty palette. An attacker can trigger an unhandled error condition by supplying a palette with zero entries, causing th...

cve-2023-41564-research

CVE-2023-41564 Vulnerability Overview CVE-2023-415641 is a stored XSS vulnerability in the CMS Cockpit = v2.6.3. When a .shtml HTML file is uploaded during file upload, JavaScript is executed the moment the uploaded file is opened. 1: https://nvd.nist.gov/vuln/detail/CVE-2023-41564 Attack Executi...

SUSE CVE-2026-98590

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bpfsock context code generation Currently, the ctx access code reads the rxqueuemapping field with either a 4-byte or 2-byte load. The rest of the bits in the register are marked known zero by the verifier. However, the...

external_expat_AOSP10_r33_CVE-2022-25236

Expat, Release 2.2.6 This is Expat, a C library for parsing XML, started by James Clark in 1997. Expat is a stream-oriented XML parser. This means that you register handlers with the parser before starting the parse. These handlers are called when the parser discovers the associated structures in...

ghidra-mtk-loader

MediaTek md1img Loader for Ghidra Ghidra loader for the MediaTek md1img modem firmware image format. Currently, only nanoMIPS-based firmware is supported, but basic features may still work if you manually choose a different architecture e.g., MIPS when loading an image. Setup For nanoMIPS-based...