SUSE CVE-2026-15830

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango's django.contrib.gis.geos.GEOSGeometry is subject to a potential denial-of-service when parsing deeply nested GEOMETRYCOLLECTION objects supplied as well-known text WKT, well-known binary WKB, or hex-encoded WKB,...

PT-2026-68760

Name of the Vulnerable Software and Affected Versions Fedify versions 1.2.0 through 1.9.12 Fedify versions 1.10.0 through 1.10.11 Fedify versions 2.0.0 through 2.0.21 Fedify versions 2.1.0 through 2.1.17 Fedify versions 2.2.0 through 2.2.6 Fedify versions 2.3.0 through 2.3.1 Description The...

CVE-2026-15830

A flaw was found in Django's GeoDjango component. A remote attacker could exploit this vulnerability by supplying specially crafted, deeply nested geometry collection objects in well-known text WKT, well-known binary WKB, or hex-encoded WKB formats. This triggers unbounded recursion and a...

CVE-2026-15830

An issue was discovered in Django 6.0 before 6.0.9 and 5.2 before 5.2.18. GeoDjango's django.contrib.gis.geos.GEOSGeometry is subject to a potential denial-of-service when parsing deeply nested GEOMETRYCOLLECTION objects supplied as well-known text WKT, well-known binary WKB, or hex-encoded WKB,...

UBUNTU-CVE-2026-15830

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango's django.contrib.gis.geos.GEOSGeometry is subject to a potential denial-of-service when parsing deeply nested GEOMETRYCOLLECTION objects supplied as well-known text WKT, well-known binary WKB, or hex-encoded WKB,...

EUVD-2026-52749

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango's django.contrib.gis.geos.GEOSGeometry is subject to a potential denial-of-service when parsing deeply nested GEOMETRYCOLLECTION objects supplied as well-known text WKT, well-known binary WKB, or hex-encoded WKB,...

CVE-2026-15830 Potential denial-of-service vulnerability via nested geometry collections

An issue was discovered in Django 6.0 before 6.0.9 and 5.2 before 5.2.18. GeoDjango's django.contrib.gis.geos.GEOSGeometry is subject to a potential denial-of-service when parsing deeply nested GEOMETRYCOLLECTION objects supplied as well-known text WKT, well-known binary WKB, or hex-encoded WKB,...

CVE-2026-15830

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango's django.contrib.gis.geos.GEOSGeometry is subject to a potential denial-of-service when parsing deeply nested GEOMETRYCOLLECTION objects supplied as well-known text WKT, well-known binary WKB, or hex-encoded WKB,...

CVE-2026-15830 Potential denial-of-service vulnerability via nested geometry collections

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango's django.contrib.gis.geos.GEOSGeometry is subject to a potential denial-of-service when parsing deeply nested GEOMETRYCOLLECTION objects supplied as well-known text WKT, well-known binary WKB, or hex-encoded WKB,...

CVE-2026-35591

CVE-2026-35591 concerns libvips' TIFF decoding via the tiffload path. The issue arises when processing a TIFF image containing a JPEG/JPEG2000-encoded tile, where the number of channels could be mis-determined, enabling a possible heap-based buffer overflow. Affected versions are libvips ≤ 8.18.1...

GHSA-GGW3-5987-RX77 Pomerium Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE Callback

Summary The HPKE V2 URL decode path in pkg/hpke/url.go decompresses attacker-controlled zstd data without any size limit. On Pomerium deployments using the stateless authentication flow Pomerium Zero / hosted authenticate, the proxy's /.pomerium/callback endpoint is reachable without credentials...

CVE-2026-62314

Anubis Web AI Firewall Utility vulnerable in versions 1.22.0–1.26.0-pre1 due to PathChecker.Check() trusting the client-controlled X-Original-URI header before r.URL.Path, enabling bypass of the challenge via ALLOW rules (e.g., ^/.well-known/.*$). A fixed release is 1.26.0-pre1; upgrade to mitiga...

PT-2026-60328

Name of the Vulnerable Software and Affected Versions Anubis versions 1.22.0 through 1.26.0-pre1 Description Anubis is a Web AI Firewall Utility designed to protect upstream resources from scraper bots by challenging user connections. A flaw exists in the PathChecker.Check function within...

GNSS Spoofing Detection in TDD Networks: A 3GPP Standards-Based Security Framework

Time Division Duplex TDD mobile networks require synchronization accuracy of $\pm$1.5 $μ$s 3GPP TS 38.104, with GNSS-disciplined grandmaster clocks as the predominant timing source. GNSS spoofing -- now a documented operational threat -- can corrupt timing across all downstream base stations, yet...

SSRF Vulnerability on assetlinks_check(act_name, well_knowns)

SummaryWhile examining the "App Link assetlinks.json file could not be found" vulnerability detected by MobSF, we, as the Trendyol Application Security team, noticed that a GET request was sent to the "/.well-known/assetlinks.json" endpoint for all hosts written with "android:host". In the...

EUVD-2026-31388

golang.org/x/crypto/ssh: Invoking byte arithmetic causes underflow and panic...

CVE-2026-9616

The Generate Security.txt plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.0.12. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

CVE-2026-9616 Generate Security.txt <= 1.0.12 - Missing Authorization to Authenticated (Subscriber+) Security.txt Deletion via delete_securitytxt AJAX Action

The Generate Security.txt plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.0.12. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

CVE-2026-9616

The CVE concerns the WordPress plugin Generate Security.txt (

EUVD-2026-38675

The Generate Security.txt plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.0.12. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...