DEBIAN-CVE-2026-56452

Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. The implementation of receiving files or directories via SCP did not validate filenames in SCP "C" or "D" commands. A malicious sender could send filenames...

CVE-2026-55550

NextCRM is open-source customer relationship management CRM software. The CRM product catalog is an organization-wide business object. Normal application server actions restrict product creation, update, and deletion to manager and admin roles. However, in version 0.12.1, the MCP product tools...

CVE-2026-55544

NextCRM (open-source) vulnerability CVE-2026-55544 affects version 0.12.1, where MCP campaign tools expose read/write operations over the network via user-generated Bearer tokens (nxtc__...). Despite an authorization model restricting normal users to their own campaigns, multiple MCP handlers ign...

CVE-2026-55544

NextCRM is open-source customer relationship management CRM software. In version 0.12.1, the MCP campaign tools expose campaign read and write operations over the network using user-generated Bearer API tokens nxtc.... The application has an authorization model that restricts normal users to...

pulpcore: pulpcore: relative_path_validator bypass via directory traversal in FilesystemExport

A path traversal vulnerability was found in pulpcore. The relativepathvalidator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relativepath containing...

CVE-2026-58624 Apache MINA SSHD: Remote execution of JGit commands can write files on the server

Improper input validation in sshd-git in Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component org.apache.sshd:sshd-git provides though its GitPgmCommandFactory a way to configure an Apache MINA SSHD server such that SSH clients can remotely execute g...

CVE-2026-58624 Apache MINA SSHD: Remote execution of JGit commands can write files on the server

Improper input validation in sshd-git in Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component org.apache.sshd:sshd-git provides though its GitPgmCommandFactory a way to configure an Apache MINA SSHD server such that SSH clients can remotely execute g...

CVE-2026-58624 Apache MINA SSHD: Remote execution of JGit commands can write files on the server

Improper input validation in sshd-git in Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component org.apache.sshd:sshd-git provides though its GitPgmCommandFactory a way to configure an Apache MINA SSHD server such that SSH clients can remotely execute g...

oras-go: oras-go: File store write outside working directory via symlink traversal

A flaw was found in oras-go. The file content store, intended to confine writes to a specified working directory, does not properly account for symbolic link symlink traversal. A remote attacker, by providing a specially crafted blob title, could exploit this vulnerability to create files outside...

oras-go: oras-go: File store write outside working directory via symlink traversal

A flaw was found in oras-go. The file content store, intended to confine writes to a specified working directory, does not properly account for symbolic link symlink traversal. A remote attacker, by providing a specially crafted blob title, could exploit this vulnerability to create files outside...

pulpcore: pulpcore: relative_path_validator bypass via directory traversal in FilesystemExport

A path traversal vulnerability was found in pulpcore. The relativepathvalidator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relativepath containing...

USN-8573-1: libde265 vulnerabilities

It was discovered that libde265 did not properly manage memory under certain circumstances. An attacker could possibly use this issue to cause libde265 to crash, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS. CVE-2023-51792 It was discovered that libde265 did not...

USN-8573-1 libde265 vulnerabilities

It was discovered that libde265 did not properly manage memory under certain circumstances. An attacker could possibly use this issue to cause libde265 to crash, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS. CVE-2023-51792 It was discovered that libde265 did not...

GHSA-499R-G7PC-VMP9 Composer: Arbitrary file write outside vendor via malicious transitive package name

Summary A maliciously crafted package, published on an untrusted third party repository other than Packagist.org or Private Packagist, can cause Composer to write files outside the vendor/ directory and outside your project, with attacker-controlled content, during a normal install or update...

Composer: Arbitrary file write outside vendor via malicious transitive package name

Summary A maliciously crafted package, published on an untrusted third party repository other than Packagist.org or Private Packagist, can cause Composer to write files outside the vendor/ directory and outside your project, with attacker-controlled content, during a normal install or update...

webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash

A flaw was found in WebKitGTK. Processing maliciously crafted web content can trigger an out-of-bounds write due to improper memory handling, resulting in an unexpected process crash...

Updated libssh2 packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Heap Buffer Over-read via sftpsymlink in sftp.c. CVE-2025-15661 libssh2 userauth.c userauthpassword integer overflow. CVE-2026-7598 Pre-Authentication DoS via SSHMSGEXTINFO Handler. CVE-2026-55199 Out-of-Bounds Write via Unchecked packetlength in...

MGASA-2026-0273 Updated libssh2 packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Heap Buffer Over-read via sftpsymlink in sftp.c. CVE-2025-15661 libssh2 userauth.c userauthpassword integer overflow. CVE-2026-7598 Pre-Authentication DoS via SSHMSGEXTINFO Handler. CVE-2026-55199 Out-of-Bounds Write via Unchecked packetlength in...

webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash

A flaw was found in WebKitGTK. Processing maliciously crafted web content can trigger an out-of-bounds write due to improper input validation, resulting in an unexpected process crash...

webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash

A flaw was found in WebKitGTK. Processing maliciously crafted web content can trigger an out-of-bounds write due to improper memory handling, resulting in an unexpected process crash...