Unity Linux 20.1070e Security Update: kernel (UTSA-2026-142674)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142674 advisory. In the Linux kernel, the following vulnerability has been resolved: rapidio/tsi721: prevent a bad dereference in tsi721dbdpc With a listforeach loop, if we don't fin...

openSUSE 16 Security Update : aliyun-cli (openSUSE-SU-2026:22140-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:22140-1 advisory. This update for aliyun-cli fixes the following issue: - CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict allows an...

CentOS Linux 7 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-filesystem / nginx-mod-devel / etc (CENTOS7:CLSA-2026:1792580871)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1792580871 advisory. - A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite an...

penligent-recreation

Penligent — Recreation A high-fidelity reconstruction of Pe...

SUSE CVE-2026-98641

In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: set up the frame pointer for the exception callback A program acting as exception boundary saves all callee-saved registers, so buildprologue takes the exceptioncb path and never calls pushcalleeregs. That is the only...

SUSE CVE-2026-112943

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. This...

Malicious code in dictanovaasr (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fd53cc46174e799bbe5340512eb53aa19d00168034876b49d53671f90b15b83 Package dictanovaasr version 0.1.0 was examined and no evidence of exfiltration, install-time or import-time code execution from external sources,...

MAL-2026-18139 Malicious code in dictanovaasr (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fd53cc46174e799bbe5340512eb53aa19d00168034876b49d53671f90b15b83 Package dictanovaasr version 0.1.0 was examined and no evidence of exfiltration, install-time or import-time code execution from external sources,...

MAL-2026-18142 Malicious code in orchestril (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7191855f520c024b0d8a705ec8f900030ecadccb35f1831e1145804b4a36b62d The package orchestril 0.1.0 was examined and no indicators of installer-side harm were observed. There is no evidence of install-time or import-time...

Malicious code in orchestril (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7191855f520c024b0d8a705ec8f900030ecadccb35f1831e1145804b4a36b62d The package orchestril 0.1.0 was examined and no indicators of installer-side harm were observed. There is no evidence of install-time or import-time...

MAL-2026-18145 Malicious code in quillonatts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fad09c871f903768f458b780fd73be2cea587a7217ace4c10fa46941883e905d The package quillonatts 0.1.0 does not exhibit traced behavior consistent with supply-chain attack shapes. No install-time or import-time outbound...

Malicious code in quillonatts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fad09c871f903768f458b780fd73be2cea587a7217ace4c10fa46941883e905d The package quillonatts 0.1.0 does not exhibit traced behavior consistent with supply-chain attack shapes. No install-time or import-time outbound...

Incorrect Behavior Order

Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Incorrect Behavior Order via submodule checkout destination validation in git/objects/submodule/base.py. Submodule checkout destinations can pass the containment check...

GHSA-XVH5-G6GV-559V Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags

============================================================================ Memory disclosure and segfault in libtiff encoder via crafted TIFF tags Location: src/encode.c:1014 in PyImagingLibTiffEncoderNew Commit: a707c6b21c313880d0771e54965d142dd42358b6...

Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags

============================================================================ Memory disclosure and segfault in libtiff encoder via crafted TIFF tags Location: src/encode.c:1014 in PyImagingLibTiffEncoderNew Commit: a707c6b21c313880d0771e54965d142dd42358b6...

Exploit for CVE-2026-109618

Correctifs CVE-2026-109618 et CVE-2026-109619 pour PHP 5.0 à 8...

Exploit for CVE-2026-109618

php-oom-corruption-lab Research lab, verification tooling and...

Pillow: Invalid free in FreeType glyph rendering when a stroker is active

Summary When text is drawn with a non-zero stroke width, Pillow creates a FreeType stroker and then loads each glyph. If FTLoadGlyph fails for a glyph, the cleanup path calls FTDoneGlyph on the glyph variable. That variable is not initialized before the first measurement loop, and in the render...

GHSA-J4M9-6W36-PW47 Pillow: Invalid free in FreeType glyph rendering when a stroker is active

Summary When text is drawn with a non-zero stroke width, Pillow creates a FreeType stroker and then loads each glyph. If FTLoadGlyph fails for a glyph, the cleanup path calls FTDoneGlyph on the glyph variable. That variable is not initialized before the first measurement loop, and in the render...

Coraza Body Processor Has A JSON Key Collision That Allows Unauthenticated Attackers To Bypass OWASP CRS Inspection

Summary Coraza's JSON body processor converts nested JSON properties into dot-separated "ARGSPOST" names without escaping dots contained in literal property names. Two distinct JSON properties can therefore collapse into the same Coraza variable An unauthenticated attacker can place a malicious...