CVE-2026-49388 is a medium severity vulnerability affecting multiple specific versions of Netatalk, an open-source AFP (Apple Filing Protocol) server. The exact nature and technical details of the vulnerability are unknown based on the provided data. There is no CVSS score or detailed description available. No information about active exploitation or vendor patches is provided.
CVE-2026-49389 is a medium severity vulnerability affecting multiple specific versions of Netatalk, a network file sharing software. The exact nature and technical details of the vulnerability are unknown based on the provided information. There is no CVSS score or detailed description available. No known exploits are reported in the wild. The affected versions are explicitly listed and pertain to various Ubuntu package releases of Netatalk. No patch or remediation information is provided.
CVE-2026-49390 is a medium severity vulnerability affecting multiple specific versions of the Netatalk software. The exact nature and technical details of the vulnerability are not provided. There is no CVSS score or detailed impact information available. No vendor advisory or patch information is included, so the remediation status is unknown. The affected versions are explicitly listed and include various Ubuntu package versions of Netatalk 2.2.2, 2.2.5, and 2.2.6. There are no known exploits in the wild reported. No geographic targeting is indicated.
Pypdf2 versions prior to 6.12.1 contain a vulnerability where crafted PDF files with large XMP metadata can cause excessive memory usage. This issue is fixed in version 6.12.1. The vulnerability has a medium severity rating with a CVSS score of 5.5.
MapServer versions from 6.4.0 up to but not including 8.6.3 contain a vulnerability where processing a specific SLD (Styled Layer Descriptor) with an <ElseFilter/> element can cause a NULL pointer dereference. This occurs because the function msSLDParseUserStyle incorrectly assumes a class is added when it may not be, leading to an out-of-bounds index. A crafted 200-byte SLD via the WMS SLD_BODY parameter can trigger this without authentication. The issue is fixed in version 8.6.3.
Streamlink versions prior to 8.4.0 have a vulnerability in their HLS and DASH parsers where the URI scheme of segment entries and other resources is not validated. This allows a remote playlist or manifest to specify local file URIs, causing Streamlink to read local files and output their contents. The issue is fixed in version 8.4.0.
A vulnerability in Babel versions from 7.12.0 up to but not including 7.29.4 and in 8.0.0-alpha.13 allows an attacker to craft input code that causes Babel to generate output code capable of executing arbitrary code. This issue has been fixed in version 7.29.4 and 8.0.0-alpha.13.
PuTTY versions 0.72 through 0.83-3build1 contain a double free vulnerability in the RSA key exchange (KEX) implementation. This flaw can cause a denial of service by crashing the application. The vulnerability has a medium severity rating with a CVSS score of 5.9. No information about available patches or vendor advisories is provided.
PuTTY versions from 0.65-2 through 0.84-1 use a copy of the PuTTY icon as a trust indicator for TELNET data, but the trust status is not cleared between proxy authentication and the main session. This could lead to misleading trust indications in the user interface. The vulnerability has a medium severity with a CVSS score of 3.1.
PuTTY versions 0.71 through 0.83-3build1 have an assertion failure vulnerability in ECDSA signature verification. This flaw can cause the application to crash, resulting in a denial of service. The vulnerability has a medium severity rating with a CVSS score of 3.7. No known exploits are reported in the wild. The issue affects multiple specific versions prior to 0.84.
Roundcube Webmail versions 1.6.x between 1.6.14 and 1.6.16 and 1.7.x before 1.7.1 do not properly honor remote image blocking for URLs pointing to local or private destinations. This flaw may allow information disclosure or privilege escalation when processing text/html email messages.
Roundcube Webmail versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1 contain a vulnerability where the remote image blocking feature can be bypassed using a crafted CSS var() value in an email message. This bypass may lead to information disclosure or access-control bypass. The vulnerability has a CVSS score of 6.5, indicating a medium severity level.
Roundcube Webmail versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1 contain a vulnerability where an unsanitized subject field in the draft restored value can lead to stored cross-site scripting (XSS) and HTML/CSS injection on shared mailboxes. This vulnerability has a medium severity rating with a CVSS score of 4.4.
An open redirect vulnerability exists in the action/cookie.php component of the ecrire module in SPIP versions before 4.4.15. This vulnerability allows an attacker to redirect users to arbitrary external URLs. The issue has a medium severity with a CVSS score of 3.5. Multiple specific versions of SPIP are affected, including various 3.x and 4.x releases up to but not including 4.4.15.
A vulnerability exists in PCManFM-Qt starting from version 1.1.0 where passing a regular file's path as a URI in the org.freedesktop.FileManager1.ShowFolders D-Bus method call causes PCManFM-Qt to delegate execution to another program based on the file type without user confirmation. This behavior can potentially lead to code execution or bypass network namespace restrictions. The behavior aligns with the applicable specification, and simple fixes may have negative side effects.
Netatalk versions 3.1.2 through 4.4.2 are compiled without the FORTIFY_SOURCE feature, which disables built-in runtime buffer overflow detection. This omission may allow a remote attacker to cause a minor denial of service through memory errors that would otherwise be caught and safely terminated. The vulnerability has a medium severity rating with a CVSS score of 3.7.
Netatalk versions 2.1.0 through 4.4.2 improperly combine multiple errno values using bitwise OR, leading to incorrect error codes when multiple error conditions occur simultaneously. This flaw may allow a remote attacker to cause a minor service disruption by triggering incorrect error-handling paths. The vulnerability has a medium severity rating with a CVSS score of 3.7.
A missing break statement in the DSI OpenSession processing code of Netatalk versions 1.5.0 through 4.4.2 causes a switch case for DSIOPT_ATTNQUANT to fall through into DSIOPT_SERVQUANT. This results in unintended session option handling that may allow a remote attacker to cause a minor service disruption by sending crafted DSI session options.
A stack-based buffer overflow vulnerability exists in the desktop.c component of Netatalk versions 1.3 through 4.2.2. This flaw allows a remote authenticated attacker to cause a denial of service, obtain limited information, or modify limited data. The vulnerability has a CVSS v3.1 score of 6.4, indicating a medium severity level.
A race condition vulnerability exists in the privilege toggle mechanism of Netatalk versions 2.2.5 through 4.4.2. This flaw allows a local attacker to obtain limited information, modify limited data, or cause minor service disruption. The vulnerability has a medium severity rating with a CVSS score of 4.5.