PT-2026-51910

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the cryptographic coprocessor CCP driver. When processing AF ALG rfc3686-ctr-aes-ccp requests, the ccp aes complete function restores more data than the allocated buffer...

PT-2026-35086

Name of the Vulnerable Software and Affected Versions langchain-text-splitters versions prior to 1.1.2 Description In the HTMLHeaderTextSplitter.split text from url function, the initial URL is validated using validate safe url, but the subsequent fetch is performed via requests.get with redirect...

python3 security update

3.6.8-21.0.9 - Security update CVE-2025-15366, CVE-2025-15367, CVE-2026-1299 Orabug: 39159999 3.6.8-21.0.7 - Security update CVE-2025-12084 Orabug: 38971895 3.6.8-21.0.5 - tarfile now validates archives to ensure member offsets are non-negative Orabug: 38442771CVE-2025-8194 3.6.8-21.0.3 - Fix DoS...

RHEL 8 : .NET 8.0 (RHSA-2026:8468)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:8468 advisory. .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR...

GHSA-M9HQ-H476-H2G8 Pyroscope Exposes Storage Secret

Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Tencent Cloud Object Storage COS. If the database is configured to use Tencent COS as the storage backend, an attacker could extract the secretkey configuration value from the...

CVE-2026-33667

OpenProject is an open-source project management application. In versions prior to 17.3.0, 2FA OTP verification in the confirmotp action of the twofactorauthentication module has no rate limiting, lockout mechanism, or failed-attempt tracking. The existing bruteforceblockafterfailedlogins setting...

kubo-0.40.1-1.1 on GA media (moderate)

kubo-0.40.1-1.1 on GA media Announcement ID: openSUSE-SU-2026:10543-1 Rating: moderate Cross-References: CVE-2025-58181 CVE-2025-58190 CVE-2026-35480 CVSS scores: CVE-2025-58181 SUSE : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2025-58181 SUSE : 6.9...

python311-aiohttp-3.13.5-3.1 on GA media (moderate)

python311-aiohttp-3.13.5-3.1 on GA media Announcement ID: openSUSE-SU-2026:10545-1 Rating: moderate Cross-References: CVE-2026-34516 CVE-2026-34520 CVSS scores: CVE-2026-34516 SUSE : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2026-34516 SUSE : 6.9...

CVE-2026-39984

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Versions 2.0.5 and below contain an authorization bypass vulnerability in the VerifyTimestampResponse function. VerifyTimestampResponse correctly verifies the certificate chain signature, but the TSA-specific constraint...

CVE-2026-34602

Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, the /api/courserelusers endpoint is vulnerable to Insecure Direct Object Reference IDOR, allowing an authenticated attacker to modify the user parameter in the request body to enroll any arbitrary user into...

KB5084821 - Description of the security update for SQL Server 2016 SP3 GDR: April 14, 2026

None None...

CLSA-2026-1776169648 python3.9: Fix of CVE-2026-4519

CVE-2026-4519: reject leading dashes in webbrowser URLs - Update pubkeys.txt with refreshed Łukasz Langa GPG key expired 2025-05-12...

PT-2026-32925

Name of the Vulnerable Software and Affected Versions libsixel versions prior to 1.8.7-r1 Description A Use-After-Free issue exists in the load gif function within fromgif.c. This occurs because a single sixel frame t object is reused across all frames of an animated GIF, and the gif init frame...

PT-2026-32622

Name of the Vulnerable Software and Affected Versions Composer versions 1.0 through 2.2.26 Composer versions 2.3 through 2.9.5 Description Command injection is possible in the PHP dependency manager Composer. The Perforce::syncCodeBase function appends the $sourceReference parameter to a shell...

PT-2026-32927

libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. Versions 1.8.7 and prior contain an integer overflow which leads to a heap buffer overflow via sixel frame convert to rgb888 in frame.c, where allocation size and pointer offset computations for palettised images PAL1,...

SUSE SLES15 Security Update : kernel (Live Patch 18 for SUSE Linux Enterprise 15 SP6) (SUSE-SU-2026:1272-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1272-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150600.23.81 fixes various security issues The following security issues were fixed: -...

golang-github-openprinting-ipp-usb security update

0.9.27-5.1 - rebuilt to fix CVE-2026-25679...

SUSE CVE-2026-34945

Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler contains a bug where a 64-bit table, part of the memory64 proposal of WebAssembly, incorrectly translated the table.size instruction. This bug could lead to disclosing data on the...

CVE-2026-40311

ImageMagick is free and open-source software used for editing and manipulating digital images. Versions below 7.1.2-19 and 6.9.13-44 contain a heap use-after-free vulnerability that can cause a crash when reading and printing values from an invalid XMP profile. This issue has been fixed in versio...

CVE-2026-33908 ImageMagick is vulnerable to Stack Overflow in DestroyXMLTree()

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, Magick frees the memory of the XML tree via the DestroyXMLTree function; however, this process is executed recursively with no depth limit imposed. When...