UBUNTU-CVE-2026-62291

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted image sequence with a 2x2 primary plane and a 256x256 auxiliary alpha plane can cause attacker-controlled heap corruption during a normal decode and re-encode workflow. TrackVisual::decodenextimagesample...

FreeBSD : zeek -- multiple vulnerabilities (e6a17802-cda9-4f53-8870-b629e4ac3d40)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the e6a17802-cda9-4f53-8870-b629e4ac3d40 advisory. Tim Wojtulewicz of Corelight reports: HIGH: SMB: Chains of AndX messages can crash Zeek HIGH: DNP3:...

Mattermost Server 11.7.x < 11.7.7 / 11.8.x < 11.8.4 Incorrect Authorization (MMSA-2026-00718)

The version of Mattermost Server installed on the remote host is affected by a vulnerability as referenced in the MMSA-2026-00718 advisory. - Mattermost versions 11.7.x = 11.7.6, 11.8.x = 11.8.3 The access control policy unassign endpoint fails to re-validate that each target channel still belong...

Linuxfabrik monitoring-plugins 6.0.0 Server-Side Request Forgery

Linuxfabrik monitoring-plugins versions 6.0.0 and below suffer from a server-side request forgery vulnerability. Exploit Title: Linuxfabrik monitoringplugins6.0.0 - SSRF Date: 2026-07-17 Exploit Author: Pig-Tail Jorge González Milla Vendor Homepage: https://github.com/Linuxfabrik/monitoring-plugi...

flyto_core 2.26.7 Server-Side Request Forgery

flytocore versions 2.26.7 and below suffer from a server-side request forgery vulnerability. Exploit Title: flytocore 2.26.7- Server-Side Request Forgery Date: 2026-07-17 Exploit Author: Pig-Tail Jorge González Milla Vendor Homepage: https://github.com/flytohub/flyto-core Software Link:...

Survival Of~The~Stealthiest: Evolving Low-Entropy Ransomware Via~Genetic Algorithms

Traditional ransomware deployment often relies on massive encryption procedure, triggering immediate detection by modern defense systems. This work introduces a paradigm shift in cryptographic attacks by framing ransomware execution as a Search-Based Software Engineering SBSE optimization problem...

PT-2026-78932

n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain an information disclosure vulnerability in the GraphQL node. When a GraphQL request fails at the connection level, the node re-throws the underlying HTTP client error unchanged instead of wrapping it in n8n's standard error type. That error...

Virtuozzo Infrastructure 7.4 Hotfix 2 (7.4.0-80)

This update provides stability and security fixes. Vulnerability id: VSTOR-140619 A security fix for CVE-2026-64531. Vulnerability id: VSTOR-140678 A security fix for CVE-2026-64561. Vulnerability id: VSTOR-87519 Storage version bumping could remain disabled until the end of a cluster update,...

D-Link DNS_340L Command Injection

Proof of concept exploit for a remote command injection vulnerability in various D-Link models. Exploit Title: D-Link DNS340L - OS Command Injection Date: 2026-07-16 Exploit Author: Jared Brits K3ysTr0K3R Vendor Homepage: https://www.dlink.com/ Version: DNS-320 v1.00, DNS-320LW v1.01.0914.2012,...

GHSA-8MQ9-5FW2-5RM4 Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)

Summary The production media handler shipped by next-tinacms-s3 createMediaHandler in packages/next-tinacms-s3/src/handlers.ts accepts an attacker-chosen ?key= query parameter and returns an AWS-signed PutObject URL whose Key is that value, with no check that the key falls under the operator's...

Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)

Summary The production media handler shipped by next-tinacms-s3 createMediaHandler in packages/next-tinacms-s3/src/handlers.ts accepts an attacker-chosen ?key= query parameter and returns an AWS-signed PutObject URL whose Key is that value, with no check that the key falls under the operator's...

CVE-2026-17091

IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the PowerVM hypervisor call interface. An attacker with root access to a guest partition can issue a specially crafted hypervisor call to...

CVE-2026-17097

IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the PowerVM hypervisor call interface. An attacker with root access to a guest partition can issue a specially crafted hypervisor call causin...

CVE-2026-17091

IBM PowerVM Hypervisor is affected by an integer overflow (CWE-190) in the hypervisor call interface. An attacker with root access to a guest partition can issue a specially crafted hypervisor call to inject arbitrary data into hypervisor or partition memory, causing either a full platform re-IPL...

CVE-2026-17091 Power System Integer Overflow

IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the PowerVM hypervisor call interface. An attacker with root access to a guest partition can issue a specially crafted hypervisor call to...

EUVD-2026-62868

IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the PowerVM hypervisor call interface. An attacker with root access to a guest partition can issue a specially crafted hypervisor call to...

CVE-2026-17091 Power System Integer Overflow

IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the PowerVM hypervisor call interface. An attacker with root access to a guest partition can issue a specially crafted hypervisor call to...

CVE-2026-17097 Power System Improper Validation

IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the PowerVM hypervisor call interface. An attacker with root access to a guest partition can issue a specially crafted hypervisor call causin...

EUVD-2026-62870

IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the PowerVM hypervisor call interface. An attacker with root access to a guest partition can issue a specially crafted hypervisor call causin...

CVE-2026-17097

IBM PowerVM Hypervisor is affected by an improper validation of array index (CWE-129) in the hypervisor call interface . An attacker with root access to a guest partition can issue a specially crafted hypervisor call that causes a virtual processor to become permanently unresponsive , requiring a...