PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.70, LTS2025 release versions 8.3.1.0 through 8.3.1.30, LTS2026 release versions 8.6.1.0 through 8.6.1.10, contain a Relative Path Traversal vulnerability in the certificate. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.
PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.70, LTS2025 release versions 8.3.1.0 through 8.3.1.30, LTS2026 release versions 8.6.1.0 through 8.6.1.10, contain a Process Control vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass.
PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.70, LTS2025 release versions 8.3.1.0 through 8.3.1.30, LTS2026 release versions 8.6.1.0 through 8.6.1.10, contain a Path Traversal vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.
A critical stack-based buffer overflow vulnerability exists in HiRDB Server versions 9 and 10 within specified version ranges. The flaw allows for remote exploitation without privileges or user interaction, potentially leading to high confidentiality and integrity impact, and low availability impact.
A critical vulnerability identified as CVE-2026-82116 affects multiple versions of HiRDB Server. The flaw involves missing authentication for critical functions, allowing unauthenticated attackers to potentially execute unauthorized actions. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability. Affected versions include HiRDB Server Version 10 from 10-00 before 10-12-01, and various releases of Version 9 and its variants up to specified builds. No patch or remediation information is currently provided.
A critical stack-based buffer overflow vulnerability exists in HiRDB Server versions 9 and 10, affecting multiple sub-versions. The flaw allows for remote exploitation without privileges or user interaction, potentially leading to full system compromise.
A stack-based buffer overflow vulnerability exists in JP1/Automatic Job Management System 3 - Manager versions from 10-00 up to but not including 13-50-31. This vulnerability has a critical severity with a CVSS score of 9.4, indicating it can be exploited remotely without privileges or user interaction to cause high confidentiality and integrity impact, and low availability impact.
CVE-2026-105323 is a reflected cross-site scripting (XSS) vulnerability in Kulga News Software versions from 26.7.4 up to but not including 26.10.0. This flaw arises from improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts. The vulnerability has a CVSS 3.1 score of 6.1, indicating a medium severity impact primarily affecting confidentiality and integrity with no impact on availability. A fix is available in version 26.10.0.
A vulnerability in virtualenv's venv creator allows attacker-controlled pathnames containing Unicode line boundary characters to inject additional configuration keys into the pyvenv.cfg file. This can alter environment settings such as the 'home' directory and 'include-system-site-packages', potentially changing which standard library files are loaded and weakening environment isolation. The issue affects virtualenv versions from 2023.4.22_1 up to but not including 2026.10.20. A fix was released in version 2026.10.20.
CVE-2026-82121 is an origin validation error vulnerability in Hitachi HiRDB Server Version 10 and certain versions of Version 9. It allows an attacker to bypass origin checks, potentially leading to unauthorized data access. The vulnerability affects multiple versions prior to 10-12-01 and specific 9.x versions. It has a high severity with a CVSS score of 7.5. A fix is available in version 10-12-01.
CVE-2026-76937 is a heap-based buffer overflow vulnerability in Hitachi's JP1/Automatic Job Management System 3 - Manager affecting versions from 10-00 up to but not including 13-50-31. This flaw allows an attacker to potentially execute arbitrary code or cause a denial of service. The vulnerability has a critical severity with a CVSS score of 9.4. A fix is available in version 13-50-31.
CVE-2026-76934 is a critical stack-based buffer overflow vulnerability affecting Hitachi JP1/Automatic Job Management System 3 - Manager and Agent components. It impacts versions from 10-00 up to but not including 13-50-31. The flaw allows remote attackers to execute arbitrary code or cause denial of service without requiring privileges or user interaction. A fix is available in version 13-50-31.
A security update for Git Large File Storage (git-lfs) addresses a vulnerability in the golang crypto/x509 package that could allow man-in-the-middle attacks via untrusted intermediate certificates. This vulnerability is tracked as CVE-2026-111943 and affects Red Hat Enterprise Linux 10.0 Extended Update Support versions. The update mitigates the risk by correcting certificate validation to prevent interception attacks.
CVE-2026-105946 is an out-of-bounds read vulnerability in the QAuthenticator NTLM authentication handling within the Qt Network module. It affects applications using QNetworkAccessManager or QTcpSocket that authenticate with NTLM. A malicious server or proxy can send a crafted NTLM challenge to trigger this flaw, potentially exposing sensitive heap memory contents or causing an application crash. The vulnerability affects Qt versions from 6.8.0 up to but not including 6.8.10, and from 6.9.0 up to but not including 6.11.2. Fixed versions are 6.8.10 and 6.11.2. The CVSS 4.0 score is 5.3, indicating medium severity.
An integer overflow vulnerability exists in llama.cpp versions before b11275 in the function gguf_init_from_reader. This flaw bypasses a prior size check (CVE-2025-53630) when handling tensor sizes near the maximum size limit. Attackers can craft a GGUF file with a tensor size that pads to zero, leading to an undersized data blob and out-of-bounds reads by consumers. The vulnerability has a CVSS score of 6.1, indicating medium severity.
A heap out-of-bounds write vulnerability exists in llama.cpp versions before b10261 in the llm_tokenizer_plamo2::build function. This flaw allows attackers to corrupt heap memory by supplying crafted GGUF models with specially crafted BYTE-typed token text containing negative parsed values. The vulnerability can cause crashes or potentially enable code execution during model loading.
A heap out-of-bounds read vulnerability exists in llama.cpp versions before commit b5649 in the function llama_vocab::impl::print_info(). This flaw allows attackers to crash the model loading process by supplying a crafted GGUF model with an undersized tokenizer.ggml.tokens array, causing out-of-bounds reads past the id_to_token array. The vulnerability affects specific package versions of llama.cpp and results in denial of service via application crash.