PT-2026-117406

RisingWave before 3.1.0 contains a missing authorization vulnerability that allows low-privileged SQL users to read and write arbitrary server files by creating posix fs sources and fs sinks. Attackers holding schema CREATE privilege can set posix fs.root or fs.path to any directory to read...

PT-2026-117458

CLI Bridge provides filesystem access within a workspace root. Prior to 0.0.2, a dangling symlink pointing outside the workspace root bypasses resolveSafePath when fs.realpathSync throws ENOENT for a nonexistent target. The fallback resolves only the parent directory and returns the symlink path ...

PT-2026-118044

Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If thi...

PT-2026-117695

Name of the Vulnerable Software and Affected Versions Zephyr OS affected versions not specified Description An issue exists in the user-mode syscall verifier z vrfy rtio cqe get mempool buffer within subsys/rtio/rtio syscalls.c. The verifier incorrectly uses K SYSCALL MEMORY READ instead of K...

PT-2026-117211

在 openGauss-server 的 src/gausskernel/cbb/utils/hll/hll.cpp 中，内置函数 HllObjectUnpack 存在长度校验缺陷。该函数从用户提供的 packed HLL 解析 lenUsed 与 lenTotal 后，仅检查输入长度足以覆盖 HLL HEAD SIZE + lenUsed，随后按 lenTotal 分配缓冲区、按 lenUsed 调用 memcpy s 拷贝输入，既未校验 lenTotal = lenUsed，也将 memcpy s 目标大小写成 lenUsed 而非实际分配的...

Linux Distros Unpatched Vulnerability : CVE-2026-112060

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - librtmp in RTMPDump through 2.6 contains an out-of-bounds read and heap out-of-bounds write vulnerability because AMF3Decode ignores AMF3 property decode...

openSUSE 16 Security Update : mutt (openSUSE-SU-2026:22099-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:22099-1 advisory. This update for mutt fixes the following issue: - CVE-2026-107570: heap out-of-bounds write in convertfilefromto via a crafted Content-Type header...

Red Hat: CVE-2026-112257: gimp: gimp: heap out-of-bounds read/write in PSD thumbnail loader (load_resource_1033)

A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash...

CVE-2026-112262: Missing Authorization

RisingWave before 3.1.0 contains a missing authorization vulnerability that allows low-privileged SQL users to read and write arbitrary server files by creating posixfs sources and fs sinks. Attackers holding schema CREATE privilege can set posixfs.root or fs.path to any directory to read...

PT-2026-117664

Name of the Vulnerable Software and Affected Versions GIMP affected versions not specified Description A flaw exists in the PSD thumbnail resource loader that performs a BGR-to-RGB channel swap using a fixed 3-byte stride without verifying if the JPEG thumbnail is RGB. A specially crafted graysca...

ALSA-2026:84744 Important: gimp:2.8 security update

The GIMP GNU Image Manipulation Program is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo. Security Fixes: gimp: gimp:...

ALSA-2026:84574 Important: xorg-x11-server security update

X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fixes: xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling...

RHEL 10 : openexr (RHSA-2026:84796)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:84796 advisory. OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document...

PT-2026-132899

Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds when a tied or shared hash grows during canonical encoding in encode hv. With canonical, the keys of a tied or threads::shared hash are counted before a second pass collects them for sorting. The encoder uses a fixed...

CVE-2026-110680: Out-of-bounds Write

Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds when a tied or shared hash grows during canonical encoding in encodehv. With canonical, the keys of a tied or threads::shared hash are counted before a second pass collects them for sorting. The encoder uses a fixed...

CVE-2026-111045: Improper Link Resolution Before File Access

CLI Bridge provides filesystem access within a workspace root. Prior to 0.0.2, a dangling symlink pointing outside the workspace root bypasses resolveSafePath when fs.realpathSync throws ENOENT for a nonexistent target. The fallback resolves only the parent directory and returns the symlink path ...

ALSA-2026:84796 Important: openexr security update

OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR. Security Fixes:...

CVE-2026-76788: Out-of-bounds Write

The OSDP Control Panel reply parser cpdecoderesponse in subsys/mgmt/osdp/src/osdpcp.c decodes replies from a Peripheral Device into a stack-allocated struct osdpevent. For the REPLYKEYPPAD and REPLYRAW reply types, the payload length is taken from the received frame and the only validation...

PT-2026-117661

Name of the Vulnerable Software and Affected Versions MLflow versions prior to 3.17.2 Description The FileStore tracking backend contains a path traversal issue. Unauthenticated attackers can control filesystem paths by submitting a crafted trace ID containing traversal sequences to the 'POST...

RHEL 10 : mariadb11.8 (RHSA-2026:84799)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:84799 advisory. MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation...