PT-2026-94285

Name of the Vulnerable Software and Affected Versions ash authentication versions 0.2.0 through 4.14.9 ash authentication versions 5.0.0-rc.0 through 5.0.0-rc.13 Description Improper verification of cryptographic signatures in AshAuthentication allows a caller of the token revocation action to...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write in the parsing process of text models due to insufficient validation of child and split array values. An attacker can achieve arbitrary memory writes by supplying a specially crafted model file with invalid node...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in keras

Summary IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in keras Vulnerability Details CVEID:CVE-2026-11816 DESCRIPTION: Keras versions prior to 3.14.0 are vulnerable to a path traversal issue in the archive extraction utilities located in keras/src/utils/fileutils.py. T...

Duplicate Advisory: Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-qfwc-vx6f-3g6g. This link is maintained to preserve external references. Original Description Vikunja before 2.6.0 fails to properly restrict access to the link-share hash field in single-share read endpoints,...

CVE-2026-91985

Vikunja before 2.6.0 fails to properly restrict access to the link-share hash field in single-share read endpoints, allowing read-only members to obtain the share's secret credential. Attackers can exchange the disclosed hash for a link-share JWT at the share's permission level to escalate...

CVE-2026-91985 Vikunja before 2.6.0 Privilege Escalation via Link Share Hash

Vikunja before 2.6.0 fails to properly restrict access to the link-share hash field in single-share read endpoints, allowing read-only members to obtain the share's secret credential. Attackers can exchange the disclosed hash for a link-share JWT at the share's permission level to escalate...

CVE-2026-91985 Vikunja before 2.6.0 Privilege Escalation via Link Share Hash

Vikunja before 2.6.0 fails to properly restrict access to the link-share hash field in single-share read endpoints, allowing read-only members to obtain the share's secret credential. Attackers can exchange the disclosed hash for a link-share JWT at the share's permission level to escalate...

postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation

A flaw was found in PostgreSQL. An object creator can exploit a stack buffer overflow vulnerability within the argument name matching component. By manipulating the OUT parameter count, an attacker can write limited arbitrary bytes 0x0 and 0x1 to server memory, which may lead to unknown impacts...

PT-2026-97294

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.25 Apache Tomcat versions 10.1.0-M1 through 10.1.59 Apache Tomcat versions 9.0.0.M1 through 9.0.121 Apache Tomcat versions 8.5.0 through 8.5.100 Apache Tomcat versions 7.0.43 through 7.0.109...

CVE-2026-55374: Improper Neutralization of Special Elements in Output Used by a Downstream Component

canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, Request::buildRequestUrl joins values returned by Request::getPathVariables without encoding individual path segments, including the scheme and contentId values used by GetContentDetailsRequest. When ...

CVE-2026-49446: Improper Authorization

Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Prior to 0.22.19, tokenMiddleware in src/proxy/routerGen.go can return through the Constellation tunnel bypass before removing x-cosmos-user, x-cosmos-role,...

DDRop: Active Memory Interposer Attacks on Confidential VMs by Dropping DDR5 Writes

Trusted Execution Environments TEEs are increasingly deployed in the cloud to protect sensitive workloads through hardware-enforced isolation, remote attestation, and transparent memory encryption. However, to meet memory performance and size demands, modern TEEs omit cryptographic freshness...

OESA-2026-3811 nano security update

Nano is a tiny GNU editor Security Fixes: A flaw was found in GNU nano's multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specially crafted filename containing printf format specifiers can be reinterpreted. This format strin...

ffmpeg: FFmpeg: Arbitrary code execution via heap buffer overflow in VobSub subtitle demuxer.

A flaw was found in FFmpeg, a widely used multimedia framework. This vulnerability, a heap buffer overflow in the VobSub subtitle demuxer, allows a remote attacker to corrupt memory. By providing a specially crafted subtitle file, an attacker can trigger unbounded writes, which could lead to...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: fs: Protect reconfiguration of sb read-write from racing writes The code responsible for reconfiguration and remounting the filesystem requires significant effort to protect it from racing writes during operations where the...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Block: Initialize the integrity buffer to zero before writing it to the media. The metadata added by biointegrityprep uses the plain kmalloc function, which results in random kernel memory being written to the media. For PI...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ext4: dax: fix an issue where overflowing extents beyond the inode size occurs during partial writing. The daxiomaprw function does two things in each iteration: it maps the written blocks and copies user data to those blocks. If...

Astra Linux – Vulnerability in Linux 5.10

A issue was discovered in the Linux kernel before version 6.0.11. Missing validation of the IEEE80211P2PATTROPERCHANNEL in the drivers/net/wireless/microchip/wilc1000/cfg80211.c file within the WILC1000 wireless driver can lead to a out-of-bounds write when parsing the channel list attribute from...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Stop parsing channel bits when all channels are found. If a USB audio device sets more bits than the number of channels it supports, it may write data outside of the map array...

Astra Linux – Vulnerability in PostgresSQL 11

A flaw was discovered in PostgreSQL versions prior to 13.3, before 12.7, before 11.12, before 10.17, and before 9.6.22. When modifying certain SQL array values, missing bounds checks allow authenticated database users to write arbitrary bytes into a wide range of server memory. The greatest threa...