{"kind": "feed", "path": "vulns/feed", "name": "", "items": [{"id": "CVE-2026-115557", "noindex": false, "published": "2026-10-24T15:17:33.600Z", "modified": "2026-10-25T05:00:07.270438637Z", "cvss": null, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-115557", "title": "DEBIAN-CVE-2026-115557", "description": "Python has added a denylist for known compromised certificates to the \"ssl\" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.", "references": ["https://security-tracker.debian.org/tracker/CVE-2026-115557", "https://osv.dev/vulnerability/DEBIAN-CVE-2026-115557"], "fixes": [], "products": [{"name": "python3.11", "path": "vulns/debian-12/python3.11", "ecosystem": "Debian:12"}, {"name": "python3.13", "path": "vulns/debian-13/python3.13", "ecosystem": "Debian:13"}, {"name": "python3.13", "path": "vulns/debian-14/python3.13", "ecosystem": "Debian:14"}, {"name": "python3.14", "path": "vulns/debian-14/python3.14", "ecosystem": "Debian:14"}, {"name": "python3.15", "path": "vulns/debian-14/python3.15", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-114629", "noindex": false, "published": "2026-10-24T14:16:39.187Z", "modified": "2026-10-25T05:00:06.571095230Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-114629", "title": "DEBIAN-CVE-2026-114629", "description": "Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters.  Web::Dispatch::ParamParser::get_unpacked_body_from reads an application/x-www-form-urlencoded body using a single read call, with no cap and the return value ignored. Perl's read grows the buffer to the requested length before reading, so the declared Content-Length determines the allocation.  An attacker can trigger this through any route whose dispatch specification has a % body-parameter match, such as sub (POST + %name=), sending a Content-Length far larger than the body actually sent. No authentication is invol", "references": ["https://security-tracker.debian.org/tracker/CVE-2026-114629", "https://osv.dev/vulnerability/DEBIAN-CVE-2026-114629"], "fixes": [], "products": [{"name": "libweb-simple-perl", "path": "vulns/debian-12/libweb-simple-perl", "ecosystem": "Debian:12"}, {"name": "libweb-simple-perl", "path": "vulns/debian-13/libweb-simple-perl", "ecosystem": "Debian:13"}, {"name": "libweb-simple-perl", "path": "vulns/debian-14/libweb-simple-perl", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-116014", "noindex": false, "published": "2026-10-24T12:16:57.607Z", "modified": "2026-10-25T05:00:05.698872249Z", "cvss": 8.1, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-116014", "title": "DEBIAN-CVE-2026-116014", "description": "open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStructureDescription() that wraps the 16-bit memSize field for large custom structure definitions. A malicious OPC UA server can supply DataType definitions via UA_Client_getRemoteDataTypes(), causing decodeBinaryStructure() to overflow the heap, crashing clients or enabling code execution.", "references": ["https://security-tracker.debian.org/tracker/CVE-2026-116014", "https://osv.dev/vulnerability/DEBIAN-CVE-2026-116014"], "fixes": [], "products": [{"name": "open62541", "path": "vulns/debian-13/open62541", "ecosystem": "Debian:13"}, {"name": "open62541", "path": "vulns/debian-14/open62541", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-116013", "noindex": false, "published": "2026-10-24T12:16:57.437Z", "modified": "2026-10-25T05:00:05.761463571Z", "cvss": 3.7, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "severity": "low", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-116013", "title": "DEBIAN-CVE-2026-116013", "description": "OpenResty lua-resty-dns before 0.24 contains an improper input validation vulnerability in parse_section() and _decode_name() that fails to check resource record lengths against the received message. Attackers controlling or spoofing a queried nameserver can send truncated record headers or RDATA, raising uncaught Lua exceptions in resolver:query() that abort requests and break name resolution.", "references": ["https://security-tracker.debian.org/tracker/CVE-2026-116013", "https://osv.dev/vulnerability/DEBIAN-CVE-2026-116013"], "fixes": [], "products": [{"name": "lua-nginx-dns", "path": "vulns/debian-12/lua-nginx-dns", "ecosystem": "Debian:12"}, {"name": "lua-nginx-dns", "path": "vulns/debian-13/lua-nginx-dns", "ecosystem": "Debian:13"}, {"name": "lua-nginx-dns", "path": "vulns/debian-14/lua-nginx-dns", "ecosystem": "Debian:14"}]}, {"id": "RLSA-2026:88477", "noindex": false, "published": "2026-10-24T12:08:27.748486Z", "modified": "2026-10-24T12:30:02.743265515Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/rlsa-2026:88477", "title": "Important: kernel security, bug fix, and enhancement update", "description": "The kernel packages contain the Linux kernel, the core of any Linux operating system.\n\nSecurity Fix(es):\n\n* kernel: calipso: Don't call calipso functions for AF_INET sk. (CVE-2025-38147)\n\n* kernel: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (CVE-2026-64114)\n\n* kernel: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CVE-2026-64048)\n\n* kernel: ALSA: hda/cs35l41: Fix firmware load work teardown (CVE-2026-64481)\n\n* kernel: fuse: re-lock request before returning from fuse_ref_folio() (CVE-2026-64266)\n\n* kernel: ipv4: fib: free fib_alias with kfree_rcu() on insert error path (CVE-2026-64572)\n\n* kernel: drm/amd/display: set ", "references": ["https://errata.rockylinux.org/RLSA-2026:88477", "https://bugzilla.redhat.com/show_bug.cgi?id=2376106", "https://bugzilla.redhat.com/show_bug.cgi?id=2502486"], "fixes": ["0:6.12.0-211.68.1.el10_2"], "products": [{"name": "kernel", "path": "vulns/rocky-linux-10/kernel", "ecosystem": "Rocky Linux:10"}]}, {"id": "RLSA-2026:87805", "noindex": false, "published": "2026-10-24T12:04:09.025614Z", "modified": "2026-10-24T12:30:02.719962311Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/rlsa-2026:87805", "title": "Important: kernel security, bug fix, and enhancement update", "description": "The kernel packages contain the Linux kernel, the core of any Linux operating system.\n\nSecurity Fix(es):\n\n* kernel: netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CVE-2025-22063)\n\n* kernel: calipso: Don't call calipso functions for AF_INET sk. (CVE-2025-38147)\n\n* kernel: ALSA: hda/cs35l41: Fix firmware load work teardown (CVE-2026-64481)\n\n* kernel: ALSA: seq: close a re-opened queue timer in the destructor (CVE-2026-68202)\n\n* kernel: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CVE-2026-68299)\n\n* kernel: ovl: check access to copy_file_range source with src mounter creds (CVE-2026-68448)\n\n* kernel: ", "references": ["https://errata.rockylinux.org/RLSA-2026:87805", "https://bugzilla.redhat.com/show_bug.cgi?id=2360273", "https://bugzilla.redhat.com/show_bug.cgi?id=2376106"], "fixes": ["0:5.14.0-687.60.1.el9_8"], "products": [{"name": "kernel", "path": "vulns/rocky-linux-9/kernel", "ecosystem": "Rocky Linux:9"}]}, {"id": "CVE-2026-115936", "noindex": false, "published": "2026-10-24T10:47:32.984166379Z", "modified": "2026-10-24T11:00:11.475063972Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-115936", "title": "DEBIAN-CVE-2026-115936", "description": "DEBIAN-CVE-2026-115936", "references": ["https://security-tracker.debian.org/tracker/CVE-2026-115936", "https://osv.dev/vulnerability/DEBIAN-CVE-2026-115936"], "fixes": [], "products": [{"name": "libio-compress-brotli-perl", "path": "vulns/debian-13/libio-compress-brotli-perl", "ecosystem": "Debian:13"}, {"name": "libio-compress-brotli-perl", "path": "vulns/debian-14/libio-compress-brotli-perl", "ecosystem": "Debian:14"}]}, {"id": "RLSA-2026:80674", "noindex": false, "published": "2026-10-24T00:08:31.522066Z", "modified": "2026-10-24T00:30:02.731141428Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/rlsa-2026:80674", "title": "Important: thunderbird security update", "description": "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nSecurity Fix(es):\n\n* firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component (CVE-2026-100832)\n\n* firefox: Use-after-free in the Layout: Text and Fonts component (CVE-2026-100784)\n\n* firefox: thunderbird: Privilege escalation in the DLL Services component (CVE-2026-100801)\n\n* firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Internationalization component (CVE-2026-100794)\n\n* firefox: thunderbird: Privilege escalation in the Address Bar component (CVE-2026-100820)\n\n* firefox: thunderbird: Use-after-free in the Graphics: Canvas2D com", "references": ["https://errata.rockylinux.org/RLSA-2026:80674", "https://bugzilla.redhat.com/show_bug.cgi?id=2543113", "https://bugzilla.redhat.com/show_bug.cgi?id=2543114"], "fixes": ["0:140.17.0-1.el10_2"], "products": [{"name": "thunderbird", "path": "vulns/rocky-linux-10/thunderbird", "ecosystem": "Rocky Linux:10"}]}, {"id": "RLSA-2026:76764", "noindex": false, "published": "2026-10-24T00:08:31.522066Z", "modified": "2026-10-24T00:30:02.741271029Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/rlsa-2026:76764", "title": "Important: firefox security update", "description": "Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.\n\nSecurity Fix(es):\n\n* firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics component (CVE-2026-92035)\n\n* firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component (CVE-2026-100832)\n\n* firefox: Use-after-free in the Layout: Text and Fonts component (CVE-2026-100784)\n\n* firefox: thunderbird: Privilege escalation in the DLL Services component (CVE-2026-100801)\n\n* firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Internationalization component (CVE-2026-1", "references": ["https://errata.rockylinux.org/RLSA-2026:76764", "https://bugzilla.redhat.com/show_bug.cgi?id=2533789", "https://bugzilla.redhat.com/show_bug.cgi?id=2543113"], "fixes": ["0:140.17.0-1.el10_2"], "products": [{"name": "firefox", "path": "vulns/rocky-linux-10/firefox", "ecosystem": "Rocky Linux:10"}]}, {"id": "RLSA-2026:80694", "noindex": false, "published": "2026-10-24T00:04:21.976358Z", "modified": "2026-10-24T00:30:02.727659621Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/rlsa-2026:80694", "title": "Important: thunderbird security update", "description": "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nSecurity Fix(es):\n\n* firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component (CVE-2026-100832)\n\n* firefox: Use-after-free in the Layout: Text and Fonts component (CVE-2026-100784)\n\n* firefox: thunderbird: Privilege escalation in the DLL Services component (CVE-2026-100801)\n\n* firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Internationalization component (CVE-2026-100794)\n\n* firefox: thunderbird: Privilege escalation in the Address Bar component (CVE-2026-100820)\n\n* firefox: thunderbird: Use-after-free in the Graphics: Canvas2D com", "references": ["https://errata.rockylinux.org/RLSA-2026:80694", "https://bugzilla.redhat.com/show_bug.cgi?id=2543113", "https://bugzilla.redhat.com/show_bug.cgi?id=2543114"], "fixes": ["0:140.17.0-1.el9_8"], "products": [{"name": "thunderbird", "path": "vulns/rocky-linux-9/thunderbird", "ecosystem": "Rocky Linux:9"}]}, {"id": "RLSA-2026:76761", "noindex": false, "published": "2026-10-24T00:04:21.976358Z", "modified": "2026-10-24T00:30:02.729554858Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/rlsa-2026:76761", "title": "Important: firefox security update", "description": "Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.\n\nSecurity Fix(es):\n\n* firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics component (CVE-2026-92035)\n\n* firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component (CVE-2026-100832)\n\n* firefox: Use-after-free in the Layout: Text and Fonts component (CVE-2026-100784)\n\n* firefox: thunderbird: Privilege escalation in the DLL Services component (CVE-2026-100801)\n\n* firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Internationalization component (CVE-2026-1", "references": ["https://errata.rockylinux.org/RLSA-2026:76761", "https://bugzilla.redhat.com/show_bug.cgi?id=2533789", "https://bugzilla.redhat.com/show_bug.cgi?id=2543113"], "fixes": ["0:140.17.0-1.el9_8"], "products": [{"name": "firefox", "path": "vulns/rocky-linux-9/firefox", "ecosystem": "Rocky Linux:9"}]}, {"id": "RLSA-2026:76850", "noindex": false, "published": "2026-10-24T00:01:21.638628Z", "modified": "2026-10-24T00:30:02.741761692Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/rlsa-2026:76850", "title": "Important: firefox security update", "description": "Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.\n\nSecurity Fix(es):\n\n* firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics component (CVE-2026-92035)\n\n* firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component (CVE-2026-100832)\n\n* firefox: Use-after-free in the Layout: Text and Fonts component (CVE-2026-100784)\n\n* firefox: thunderbird: Privilege escalation in the DLL Services component (CVE-2026-100801)\n\n* firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Internationalization component (CVE-2026-1", "references": ["https://errata.rockylinux.org/RLSA-2026:76850", "https://bugzilla.redhat.com/show_bug.cgi?id=2533789", "https://bugzilla.redhat.com/show_bug.cgi?id=2543113"], "fixes": ["0:140.17.0-1.el8_10"], "products": [{"name": "firefox", "path": "vulns/rocky-linux-8/firefox", "ecosystem": "Rocky Linux:8"}]}, {"id": "RLSA-2026:88550", "noindex": false, "published": "2026-10-24T00:00:58.624421Z", "modified": "2026-10-24T00:30:02.741244550Z", "cvss": 6.8, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/rlsa-2026:88550", "title": "Critical: ca-certificates security update", "description": "The ca-certificates package contains a set of Certificate Authority (CA) certificates chosen by the Mozilla Foundation for use with the Internet Public Key Infrastructure (PKI).\n\nSecurity Fix(es):\n\n* ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns (CVE-2026-114406)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "references": ["https://errata.rockylinux.org/RLSA-2026:88550", "https://bugzilla.redhat.com/show_bug.cgi?id=2556046", "https://access.redhat.com/errata/RHSA-2026:88550"], "fixes": ["0:2026.2.92_v9.0.319-81.3.el8_10"], "products": [{"name": "ca-certificates", "path": "vulns/rocky-linux-8/ca-certificates", "ecosystem": "Rocky Linux:8"}]}, {"id": "CVE-2026-112913", "noindex": false, "published": "2026-10-23T22:28:19Z", "modified": "2026-10-23T22:45:03.439584635Z", "cvss": 3.3, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "severity": "low", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-112913", "title": "filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database", "description": "On Windows, `ReadWriteLock` and `AsyncReadWriteLock` (the SQLite-backed reader/writer lock) connect SQLite to the lock database by its path, in every directory. SQLite derives three side files from that path: `<database>-journal`, the rollback journal (pages saved to undo an interrupted write); `<database>-wal`, the write-ahead log (changes kept outside the main file); and `<database>-shm`, the shared-memory index of the WAL. SQLite acts on whichever of these it finds beside the database before the lock runs any statement. Another local account that can create files in the database's directory, but not delete files of other accounts there, pl", "references": ["https://github.com/tox-dev/filelock/security/advisories/GHSA-9vhv-jxww-xfm5", "https://github.com/tox-dev/filelock/pull/834", "https://github.com/tox-dev/filelock/commit/5e3f2ec0c5fb17cb2635b60b2b68bc63ab81ca2d"], "fixes": ["4.2.1"], "products": [{"name": "filelock", "path": "vulns/pypi/filelock", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-112907", "noindex": false, "published": "2026-10-23T22:27:32Z", "modified": "2026-10-23T22:45:03.452878321Z", "cvss": 2.5, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L", "severity": "low", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-112907", "title": "filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break", "description": "On Windows the soft locks (`SoftFileLock`, `MarkerSoftFileLock`, `SoftFileLease`, their async forms, and a `FileLock` that fell back to a soft lock) read their marker by path. The marker is the lock file whose presence says a process holds the lock. Each `acquire()` attempt that finds a marker opens it with `os.open` to read the holder's process id, and the lock renames and deletes a marker it judges stale, by path. On Windows each of these calls waits for an oplock. An oplock (opportunistic lock) is a request by a process that holds a handle on a file to be told before another process opens, renames or deletes that file; the other process wa", "references": ["https://github.com/tox-dev/filelock/security/advisories/GHSA-567q-5qvw-pf92", "https://github.com/tox-dev/filelock/pull/835", "https://github.com/tox-dev/filelock/commit/e1e825b1992f69fb6b346dc395d5ae4893536c0a"], "fixes": ["4.2.1"], "products": [{"name": "filelock", "path": "vulns/pypi/filelock", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-115931", "noindex": false, "published": "2026-10-23T22:02:21.717Z", "modified": "2026-10-23T23:07:14.650Z", "cvss": 9.9, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "severity": "critical", "epss": 0.00649, "kev": false, "exploits": [], "stacks": [], "path": "vulns/cve-2026-115931", "title": "Arbitrary file read and backend crash through unrestricted provider method calls", "description": "Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not restrict which functions can be requested, so a user could call internal helper functions that were never meant to be reachable from the web interface.\n\nOne of those helpers reads a file from the server's disk. A user who connects a channel whose stored token is a file path can have the backend return the contents of any file it can read, including its environment, which holds the secret used to sign login sessions, the database address and the credentials of connected services. Another helper makes the backend process exit w", "references": ["https://github.com/gitroomhq/postiz-app", "https://github.com/gitroomhq/postiz-app/releases/tag/v2.25.1", "https://github.com/gitroomhq/postiz-app/commit/9383f5be4d310c346e33a3748a9a7ded64c96fed"], "fixes": ["2.25.2"], "products": [{"name": "postiz-app", "path": "vulns/postiz-app", "ecosystem": ""}]}, {"id": "CVE-2026-115938", "noindex": false, "published": "2026-10-23T21:58:51.816Z", "modified": "2026-10-23T21:58:51.816Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00682, "kev": false, "exploits": [], "stacks": [], "path": "vulns/cve-2026-115938", "title": "Low privilege condition filter escapes Twig sandbox, recovers \"securityKey\" and reaches RCE", "description": "Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. Craft’s allowed column filter delegates property lookup to Yii ArrayHelper, outside Twig’s SecurityPolicy. Repeated single-segment lookups therefore bypass the sandbox’s empty property/method allowlists.\n\n\n\nThe vulnerable condition value is ultimately cast to an integer. That does not protect the secret: the template can return author ID 1 when a guessed key character is correct and an impossible ID otherwise. The JSON endpoint returns entries for the first case and an empty array", "references": ["https://www.hckrt.com/hacktivity/HCKRT-DRNL9W", "https://github.com/craftcms/cms/releases/tag/5.11.2", "https://github.com/craftcms/cms"], "fixes": ["4.18.9", "5.11.2"], "products": [{"name": "cms", "path": "vulns/cms", "ecosystem": ""}]}, {"id": "GHSA-h4fr-cmh5-qr62", "noindex": false, "published": "2026-10-23T21:58:16Z", "modified": "2026-10-23T22:15:05.376415931Z", "cvss": 3.3, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "severity": "low", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/ghsa-h4fr-cmh5-qr62", "title": "Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project root", "description": "### Impact\n\nFallow expands some globs from the analyzed repository on disk. Before 3.34.0, a segment such as `.*`, `.?` or `..*` in such a glob also matched the special `..` entry. The `glob` crate tests `..` against a segment that starts with a literal `.`. Fallow validates plugin glob patterns and refuses absolute paths and `..` segments, but these segments passed that validation.\n\nThe attacker controls the repository content. The attacker must also be able to read the Fallow output, for example a CI log or a pull request comment. Then the attacker can learn if a file or directory exists in the parent of the project root:\n\n- A plugin `fileE", "references": ["https://github.com/fallow-rs/fallow/security/advisories/GHSA-h4fr-cmh5-qr62", "https://github.com/fallow-rs/fallow/pull/3548", "https://github.com/fallow-rs/fallow/commit/133d4c862c74f4b1f0a7417c65b7157c1144294d"], "fixes": ["3.34.0"], "products": [{"name": "fallow", "path": "vulns/npm/fallow", "ecosystem": "npm"}, {"name": "@fallow-cli/fallow-node", "path": "vulns/npm/@fallow-cli%2Ffallow-node", "ecosystem": "npm"}, {"name": "fallow-cli", "path": "vulns/crates.io/fallow-cli", "ecosystem": "crates.io"}, {"name": "fallow-config", "path": "vulns/crates.io/fallow-config", "ecosystem": "crates.io"}, {"name": "fallow-core", "path": "vulns/crates.io/fallow-core", "ecosystem": "crates.io"}]}, {"id": "GHSA-f2hq-32vh-53cc", "noindex": false, "published": "2026-10-23T21:54:36Z", "modified": "2026-10-23T22:00:03.736647172Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/ghsa-f2hq-32vh-53cc", "title": "postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words", "description": "### Impact\n\nDecoding a header that holds a long run of joinable RFC 2047 base64 encoded words, such as `=?utf-8?B?QUJD?=` repeated tens of thousands of times in a `Subject`, `From`, `To`, a filename or a description, took time quadratic in the number of words. The join check ran a regex over the text joined so far for every word, which flattens the accumulated string each time. A single well formed message of about 1.6 MB blocked the event loop for one to twenty seconds depending on the host, and inline `message/rfc822` parts multiplied the cost, since each nested message carried its own header budget.\n\nAny application that parses untrusted m", "references": ["https://github.com/postalsys/postal-mime/security/advisories/GHSA-f2hq-32vh-53cc", "https://github.com/postalsys/postal-mime/commit/9eb25a66bb3cc8b631421be651b9648796f19136", "https://github.com/postalsys/postal-mime"], "fixes": ["4.0.8"], "products": [{"name": "postal-mime", "path": "vulns/npm/postal-mime", "ecosystem": "npm"}]}, {"id": "GHSA-8c8m-p3m8-cjg8", "noindex": false, "published": "2026-10-23T21:53:04Z", "modified": "2026-10-23T22:00:03.731164953Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/ghsa-8c8m-p3m8-cjg8", "title": "Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient", "description": "### Vulnerability summary\n\nRFC 5322 comments nest. addressparser ended a comment at the first `)`, including the one that closes a nested comment, and parsed the rest of the outer comment as header text. `Victim (x(y) <evil@evil.com>) <v@victim.com>` names `v@victim.com` with `x(y) <evil@evil.com>` as a comment, and Nodemailer read it as the address `evil@evil.com`. This is the same shape as the escaped parenthesis fixed in 10.1.2, reached through nesting instead of a quoted-pair. Affected: 3.0.0 through 10.1.3.\n\n### Attacker capabilities\n\nThe attacker controls the text of an address that an application passes to Nodemailer, or the From or To", "references": ["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-8c8m-p3m8-cjg8", "https://github.com/nodemailer/nodemailer/commit/0a8761762ac78f2db2ba37f712f2a52a404ce011", "https://github.com/nodemailer/nodemailer"], "fixes": ["10.1.4"], "products": [{"name": "nodemailer", "path": "vulns/npm/nodemailer", "ecosystem": "npm"}]}], "total": 484284, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 200, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "python3.11", "path": "vulns/debian-12/python3.11", "ecosystem": "Debian:12"}, {"name": "python3.13", "path": "vulns/debian-13/python3.13", "ecosystem": "Debian:13"}, {"name": "python3.13", "path": "vulns/debian-14/python3.13", "ecosystem": "Debian:14"}, {"name": "python3.14", "path": "vulns/debian-14/python3.14", "ecosystem": "Debian:14"}, {"name": "python3.15", "path": "vulns/debian-14/python3.15", "ecosystem": "Debian:14"}, {"name": "libweb-simple-perl", "path": "vulns/debian-12/libweb-simple-perl", "ecosystem": "Debian:12"}, {"name": "libweb-simple-perl", "path": "vulns/debian-13/libweb-simple-perl", "ecosystem": "Debian:13"}, {"name": "libweb-simple-perl", "path": "vulns/debian-14/libweb-simple-perl", "ecosystem": "Debian:14"}, {"name": "open62541", "path": "vulns/debian-13/open62541", "ecosystem": "Debian:13"}, {"name": "open62541", "path": "vulns/debian-14/open62541", "ecosystem": "Debian:14"}, {"name": "lua-nginx-dns", "path": "vulns/debian-12/lua-nginx-dns", "ecosystem": "Debian:12"}, {"name": "lua-nginx-dns", "path": "vulns/debian-13/lua-nginx-dns", "ecosystem": "Debian:13"}, {"name": "lua-nginx-dns", "path": "vulns/debian-14/lua-nginx-dns", "ecosystem": "Debian:14"}, {"name": "kernel", "path": "vulns/rocky-linux-10/kernel", "ecosystem": "Rocky Linux:10"}, {"name": "kernel", "path": "vulns/rocky-linux-9/kernel", "ecosystem": "Rocky Linux:9"}, {"name": "libio-compress-brotli-perl", "path": "vulns/debian-13/libio-compress-brotli-perl", "ecosystem": "Debian:13"}, {"name": "libio-compress-brotli-perl", "path": "vulns/debian-14/libio-compress-brotli-perl", "ecosystem": "Debian:14"}, {"name": "thunderbird", "path": "vulns/rocky-linux-10/thunderbird", "ecosystem": "Rocky Linux:10"}, {"name": "firefox", "path": "vulns/rocky-linux-10/firefox", "ecosystem": "Rocky Linux:10"}, {"name": "thunderbird", "path": "vulns/rocky-linux-9/thunderbird", "ecosystem": "Rocky Linux:9"}, {"name": "firefox", "path": "vulns/rocky-linux-9/firefox", "ecosystem": "Rocky Linux:9"}, {"name": "firefox", "path": "vulns/rocky-linux-8/firefox", "ecosystem": "Rocky Linux:8"}, {"name": "ca-certificates", "path": "vulns/rocky-linux-8/ca-certificates", "ecosystem": "Rocky Linux:8"}, {"name": "filelock", "path": "vulns/pypi/filelock", "ecosystem": "PyPI"}, {"name": "node.js", "path": "vulns/node.js", "ecosystem": ""}, {"name": "php", "path": "vulns/php", "ecosystem": ""}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 18840, "kev": 20}, "lastmod": "2026-10-25T05:00:07.270438637Z", "early_advisories": [{"fixes": [], "id": "EA-auto-4bff2f84a4193db76ba2e9516480ce082aff4b257b52d171", "cves": ["CVE-2026-111497"], "texts": {"de": {"title": "Node.js: Remote-Codeausführung", "description": "Laut OpenNet wurde in Node.js eine Sicherheitslücke gefunden: Remote-Codeausführung (CVE-2026-111497). Die betroffenen Versionen sind nicht genau angegeben. Im Bericht wird keine Version mit Fehlerbehebung genannt.", "action": "Prüfen Sie, ob ein Update für Node.js mit der Fehlerbehebung verfügbar ist, und installieren Sie es."}, "en": {"title": "Node.js: remote code execution", "description": "According to OpenNet, Node.js has a remote code execution vulnerability (CVE-2026-111497). The exact affected versions are unspecified. The report does not name a fixed version.", "action": "Check whether a Node.js update with the fix is available and install it."}, "es": {"title": "Node.js: ejecución remota de código", "description": "Según OpenNet, Node.js tiene una vulnerabilidad de ejecución remota de código (CVE-2026-111497). No se especifican las versiones exactas afectadas. El mensaje no indica una versión corregida.", "action": "Comprueba si hay una actualización de Node.js con la corrección e instálala."}, "fr": {"title": "Node.js : exécution de code à distance", "description": "Selon OpenNet, Node.js présente une vulnérabilité d’exécution de code à distance (CVE-2026-111497). Les versions exactes affectées ne sont pas précisées. Le message ne précise pas de version corrigée.", "action": "Vérifiez si une mise à jour de sécurité de Node.js contenant le correctif est disponible et installez-la."}}, "affected": {"all_supported": false, "branches": [], "ranges": []}, "updated_at": "2026-10-25T06:34:44.314509Z", "candidate_id": "a37e75e35b2b428b3d695bbb722cf7a5a6cb270f98b9a69a0fb5008f4155b333", "sources": [{"name": "opennet", "url": "https://www.opennet.ru/opennews/art.shtml?num=66537"}, {"name": "oss-security", "url": "https://seclists.org/oss-sec/2026/q4/373"}], "fix_status": "unfixed", "created_at": "2026-10-24T19:15:10.159140Z", "fixed_version": "", "product": "node.js", "state": "published"}, {"fixes": [], "id": "EA-auto-43744e2e5c9a208ed806e57a9b42af7ed13757e08dcfc2e8", "cves": ["CVE-2026-115560"], "texts": {"de": {"title": "PHP: Remote-Codeausführung", "description": "Laut OpenNet wurde in PHP eine Sicherheitslücke gefunden: Remote-Codeausführung (CVE-2026-115560). Die betroffenen Versionen sind nicht genau angegeben. Im Bericht wird keine Version mit Fehlerbehebung genannt.", "action": "Prüfen Sie, ob ein Update für PHP mit der Fehlerbehebung verfügbar ist, und installieren Sie es."}, "en": {"title": "PHP: remote code execution", "description": "According to OpenNet, PHP has a remote code execution vulnerability (CVE-2026-115560). The exact affected versions are unspecified. The report does not name a fixed version.", "action": "Check whether a PHP update with the fix is available and install it."}, "es": {"title": "PHP: ejecución remota de código", "description": "Según OpenNet, PHP tiene una vulnerabilidad de ejecución remota de código (CVE-2026-115560). No se especifican las versiones exactas afectadas. El mensaje no indica una versión corregida.", "action": "Comprueba si hay una actualización de PHP con la corrección e instálala."}, "fr": {"title": "PHP : exécution de code à distance", "description": "Selon OpenNet, PHP présente une vulnérabilité d’exécution de code à distance (CVE-2026-115560). Les versions exactes affectées ne sont pas précisées. Le message ne précise pas de version corrigée.", "action": "Vérifiez si une mise à jour de sécurité de PHP contenant le correctif est disponible et installez-la."}}, "affected": {"all_supported": false, "branches": [], "ranges": []}, "updated_at": "2026-10-24T17:08:02.545120Z", "candidate_id": "63ebe2e680c5dd94d54a881dabfd180796897bf3bf44a3b15d1ec396cb8a181a", "sources": [{"name": "opennet", "url": "https://www.opennet.ru/opennews/art.shtml?num=66534"}, {"name": "the-hacker-news", "url": "https://thehackernews.com/2026/10/urgent-php-warns-of-another-unpatched.html"}], "fix_status": "unfixed", "created_at": "2026-10-24T17:05:52.430295Z", "fixed_version": "", "product": "php", "state": "published"}], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}