@babel/core: Arbitrary File Read via sourceMappingURL Comment

Impact Using @babel/core to compile maliciously crafted code can allow ab attacker to read any source map from the system that is running Babel, if these conditions are all true: - the attacker controls the input source code - the attacker can read the output source code - the attacker knows the...

UBUNTU-CVE-2026-44492

Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6 addresses. When NOPROXY lists an IPv4 address such as 127.0.0.1 or 169.254.169.254, a request URL using the IPv4-mapped IPv6 form ::ffff:7f00:1, ::ffff:a9fe:a9fe...

CVE-2026-44488

Axios 1.7.0–1.15.x did not enforce maxContentLength/maxBodyLength when using the fetch adapter, enabling oversized response or request bodies and causing resource exhaustion in server-side usage. Affected: Axios (fetch adapter context). Root cause: missing enforcement of configured size limits fo...

CVE-2026-6976

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.9 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to hide changes from merge request diff views due to...

CVE-2025-59382

QTS, QuTS hero, QuTScloud are not affected. We have already fixed the vulnerability in the following version:...

CVE-2026-48724 ImageMagick: Heap Buffer Underwrite in Floyd-Steinberg depth dithering

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-24, when using an image with mask the Floyd-Steinberg dithering method it will cause a negative heap buffer over-write. This issue has been patched in version 7.1.2-24...

CVE-2026-26241 File Station 5

A buffer overflow vulnerability has been reported to affect File Station 5. The remote attackers can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5243 and later...

CVE-2025-59382

QTS, QuTS hero, QuTScloud are not affected. We have already fixed the vulnerability in the following version:...

CVE-2026-26237 QuMagie

A missing authorization vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to access unauthorized data or perform unauthorized actions. We have already fixed the vulnerability in the following version: QuMagie 2.9.0 and later...

CVE-2026-22893 QTS, QuTS hero

A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS...

CVE-2025-66281

CVE-2025-66281 describes a NULL pointer dereference vulnerability affecting several QNAP operating system versions. According to the sources, remote attackers could exploit this to cause a denial-of-service (DoS). QNAP has issued fixes in multiple releases: QTS 5.2.9.3410 build 20260214 and later...

EUVD-2025-210094

QuTS hero is not affected. We have already fixed the vulnerability in the following version: QTS 5.2.7.3256 build 20250913 and later...

PT-2026-48359

Name of the Vulnerable Software and Affected Versions License Center versions prior to 1.9.56 Description A path traversal issue allows a local attacker with administrator account privileges to read the contents of unexpected files or system data. Path traversal is a technique where an attacker...

PT-2026-48376

Name of the Vulnerable Software and Affected Versions Synology File Station 5 versions prior to 5.5.6.5243 Description A buffer overflow occurs, which allows remote attackers to modify memory or cause processes to crash. A buffer overflow is a condition where a program writes more data to a memor...

PT-2026-48570

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 6.9.13-50 ImageMagick versions prior to 7.1.2-25 Description An incorrect loop in the ICON decoder can result in an out of bounds heap write, which may lead to a crash. An out of bounds heap write occurs when a...

PT-2026-48357

Name of the Vulnerable Software and Affected Versions QTS versions prior to 5.2.7.3256 build 20250913 Description An access-control flaw exists in legacy environments where the NFS Network File System service is enabled. When NFS share settings are permissive, specifically using a wildcard host...

PT-2026-48356

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. Description No information provided regarding the nature of the issue. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability...

CVE-2026-44541 Fides: DOM-based XSS vulnerability in fides.js via fides_description override

Fides is an open-source privacy engineering platform. From version 2.33.0 to before version 2.84.5, there is a DOM-based XSS vulnerability in fides.js via the fidesdescription override. This issue has been patched in version 2.84.5...

Critical Zcash Vulnerability Found and Fixed

If you're a user--owner?--of this cryptocurrency, this is important: On May 29, the security researcher Taylor Hornby found a critical vulnerability in Zcash Orchard privacy pool using Claude Opus 4.8. The Zcash team hired Hornby specifically to look for this kind of issue. He found one fast enou...

CVE-2026-48488

phpMyFAQ is an open source FAQ web application. Prior to version 4.1.4, attachment passwords are hashed using SHA-1, a cryptographically broken algorithm. SHA-1 has been vulnerable to collision attacks since 2017 SHAttered. Version 4.1.4 fixes the issue...