CVE-2026-73234

FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, PropertyFileIncluded::Restore in src/App/PropertyFile.cpp concatenates an attacker-controlled file or data attribute from Document.xml with the document transient path without rejecting directory components,...

MINI-H74C-2MVR-497R

Bulletin has no description...

MINI-6F4C-48W9-R432

Bulletin has no description...

MINI-H9WV-JM6P-5CV6

Bulletin has no description...

MINI-XPFX-F6MQ-MW8P

Bulletin has no description...

MINI-5F42-CF7M-CC2P

Bulletin has no description...

MINI-H8MF-G897-7WVC

Bulletin has no description...

MINI-CH9F-X9VJ-6J29

Bulletin has no description...

MINI-RXWF-QQHP-4FC4

Bulletin has no description...

MINI-RJXP-Q2QW-QPWM

Bulletin has no description...

MINI-W8Q6-CMRR-F2V4

Bulletin has no description...

MINI-M395-FP46-WG6G

Bulletin has no description...

MINI-M846-MG2G-CPF9

Bulletin has no description...

MINI-WP5H-8HWP-62M8

Bulletin has no description...

CVE-2026-45618

LiquidJS is a Shopify/GitHub Pages compatible template engine. Prior to version 10.26.0, it is possible to execute arbitrary code with crafted templates. Version 10.26.0 patches the issue...

CVE-2026-45618 LiquidJS is Vulnerable to Remote Code Execution

LiquidJS is a Shopify/GitHub Pages compatible template engine. Prior to version 10.26.0, it is possible to execute arbitrary code with crafted templates. Version 10.26.0 patches the issue...

CVE-2026-45618 LiquidJS is Vulnerable to Remote Code Execution

LiquidJS is a Shopify/GitHub Pages compatible template engine. Prior to version 10.26.0, it is possible to execute arbitrary code with crafted templates. Version 10.26.0 patches the issue...

CVE-2026-73230

Ente provides end-to-end encrypted cloud services and security tools. Prior to 2026.07.28, Ente 2of3 card format version 1 stored the secret byte length and 32-bit FNV-1a checksum in cleartext on every card, allowing someone with one card to test candidate secrets offline and recover low-entropy ...

CVE-2026-48802

Summary (CVE-2026-48802, python-engineio): Before v4.13.2, a heartbeat-driven background thread could be created on new connections or PONG handling, causing DoS especially on synchronous servers. The fix in v4.13.2 changes the behavior so that the initial heartbeat background thread/async task i...

CVE-2026-73090

PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, processUpdateActivity and processUpdateVideo accept an ActivityPub Update containing a Video object without verifying that byActor.url is authorized for the host in videoObject.id, allowing a malicious federated server...