Threat database

A critical PHP code injection vulnerability exists in Twig versions >=1.15.1 and <3.26.0 via the `{% use %}` template tag. The issue arises because single quotes in template names are not escaped properly, allowing injection of arbitrary PHP code into compiled cache files. This code executes with the PHP process, bypassing Twig's sandbox and enabling remote code execution. The vulnerability is fixed in version 3.26.0 by escaping single quotes in template names.

A security update for the libtiff library has been released by SUSE Product Security Team. This update is functionally equivalent to the Red Hat advisory RHSA-2026:19585. No specific affected versions or detailed vulnerability information is provided in the input data.

A security update for giflib addresses a vulnerability referenced as CVE-2026-23868. This update is functionally equivalent to the Red Hat advisory RHSA-2026:19367. No specific technical details or affected versions are provided in the input data.

This security update for GnuTLS addresses multiple vulnerabilities including OCSP revocation bypass, case-insensitive domain name comparison in name constraints, buffer overreads, DTLS reassembly checks, sequence number validation, PSK identity lookup, and various X.509 certificate handling issues. The update fixes issues that could lead to security bypasses, memory safety errors, and incorrect certificate validation.

This security update for glibc addresses three vulnerabilities: CVE-2026-4046, which can cause an assertion failure leading to a remote crash; CVE-2026-5450, where the scanf %mc pattern may cause a heap overflow when the width is greater than 1024; and CVE-2026-5928, where the ungetwc function could leak data under special conditions.

A vulnerability in GStreamer gst-plugins-good before version 1.28.2 allows insufficient validation of MP4 audio track atom data in the isomp4 plugin. This leads to an integer division by zero error in the qtdemux_parse_trak function, causing a denial of service (DoS) by crashing the plugin. The issue affects multiple Ubuntu package versions and has been fixed in updated releases.

Multiple security issues have been fixed in the glibc-2.43-3.1 package included in the GA media of openSUSE Tumbleweed. These fixes address vulnerabilities present in earlier versions of glibc used by SUSE. No specific details on the nature of the vulnerabilities or their impact are provided.