CVE-2026-47664 Pathling: $import-pnp operation enables authenticated SSRF, credential leakage, and warehouse data poisoning

Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, the $import-pnp operation in Pathling Server accepts a caller-supplied exportUrl and uses it as the remote FHIR Bulk Export endpoint without...

EUVD-2026-54651

Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, the $import-pnp operation in Pathling Server accepts a caller-supplied exportUrl and uses it as the remote FHIR Bulk Export endpoint without...

Security Bulletin: Authenticated denial of service in Consul Enterprise-to-Community Edition downgrade path

Summary Consul Community Edition and Consul Enterprise 1.18.0 through 2.0.2 are vulnerable to an authenticated denial of service in the Enterprise-to-Community Edition downgrade path that may allow an authorized caller to crash the Consul server. A caller with config-entry write permission can...

CVE-2026-19113

Consul Community Edition and Consul Enterprise 1.3.0 through 2.0.2 are vulnerable to an unauthenticated denial of service in several agent HTTP API endpoints. A remote caller could cause the agent to consume substantial memory before the request was rejected. This vulnerability, CVE-2026-19113, i...

CVE-2026-47661 Pathling has path traversal in $result endpoint that allows arbitrary warehouse file read

Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's /$result endpoint allows a caller who can obtain any valid async export job ID to supply file parameter values containing path...

CVE-2026-47661 Pathling has path traversal in $result endpoint that allows arbitrary warehouse file read

Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's /$result endpoint allows a caller who can obtain any valid async export job ID to supply file parameter values containing path...

EUVD-2026-54640

Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's /$result endpoint allows a caller who can obtain any valid async export job ID to supply file parameter values containing path...

CVE-2026-19017

Consul Community Edition and Consul Enterprise 1.18.21 through 2.0.2 are vulnerable to a partial arbitrary file read when configured to use the Vault Connect CA provider with JWT or AppRole authentication. A privileged attacker with operator:write permission may direct Consul to read and forward...

CVE-2026-48098

NexTor IP Changer is a command-line tool that leverages the Tor network to periodically rotate a user's IP address. Versions prior to 2.0.0 execute privileged system commands using sudo and shell=True directly inside application logic. In environments where passwordless sudo NOPASSWD is enabled,...

EUVD-2026-54603

NexTor IP Changer is a command-line tool that leverages the Tor network to periodically rotate a user's IP address. Versions prior to 2.0.0 have a command execution vulnerability due to unsafe use of shell=True with commands that rely on executable resolution through the PATH environment variable...

CVE-2026-47363

In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied session including OAuth tokens from Intent extras with no permission guard, and signs the app into that session without validating it against the backend. Th...

CVE-2026-47361

In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a caller-supplied conversationid. When the activity closes and no in-process session matches that ID, it unconditionally cancels notification ...

CVE-2026-19082

Imager versions from 0.4502 before 1.034 for Perl may expose adjacent heap bytes via strlen over-read from zero-count ASCII EXIF entries in copystringtags. copystringtags computes an ASCII EXIF tag's length as entry-size - 1 to strip the trailing NUL. A zero-count ASCII entry sets entry-size to 0...

CVE-2026-19082

The Perl Imager module (versions 0.45_02 before 1.034 ) is vulnerable to a heap over-read in the copy_string_tags() function. The root cause is that a zero-count ASCII EXIF entry sets entry->size to 0, resulting in a length of -1; this causes i_tags_add() to invoke strlen(), which scans past t...

CVE-2026-19082 Imager versions from 0.45_02 before 1.034 for Perl may expose adjacent heap bytes via strlen() over-read from zero-count ASCII EXIF entries in copy_string_tags

Imager versions from 0.4502 before 1.034 for Perl may expose adjacent heap bytes via strlen over-read from zero-count ASCII EXIF entries in copystringtags. copystringtags computes an ASCII EXIF tag's length as entry-size - 1 to strip the trailing NUL. A zero-count ASCII entry sets entry-size to 0...

CVE-2026-19082 Imager versions from 0.45_02 before 1.034 for Perl may expose adjacent heap bytes via strlen() over-read from zero-count ASCII EXIF entries in copy_string_tags

Imager versions from 0.4502 before 1.034 for Perl may expose adjacent heap bytes via strlen over-read from zero-count ASCII EXIF entries in copystringtags. copystringtags computes an ASCII EXIF tag's length as entry-size - 1 to strip the trailing NUL. A zero-count ASCII entry sets entry-size to 0...

EUVD-2026-54561

Imager versions from 0.4502 before 1.034 for Perl may expose adjacent heap bytes via strlen over-read from zero-count ASCII EXIF entries in copystringtags. copystringtags computes an ASCII EXIF tag's length as entry-size - 1 to strip the trailing NUL. A zero-count ASCII entry sets entry-size to 0...

CVE-2026-19082 Imager versions from 0.45_02 before 1.034 for Perl may expose adjacent heap bytes via strlen() over-read from zero-count ASCII EXIF entries in copy_string_tags

Imager versions from 0.4502 before 1.034 for Perl may expose adjacent heap bytes via strlen over-read from zero-count ASCII EXIF entries in copystringtags. copystringtags computes an ASCII EXIF tag's length as entry-size - 1 to strip the trailing NUL. A zero-count ASCII entry sets entry-size to 0...

SUSE CVE-2026-70628

FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsubparser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard...

SUSE CVE-2026-70629

FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder libavcodec/rscc.c that allows attackers to disclose heap memory contents by supplying a crafted video file with a compressed tile that decompresses fewer bytes...