This package provides base tools, such as string, xml, and network handling.
Security Fix(es):
Uncontrolled recursion in Qt's QDomDocument serialization (QtXml) lets deeply nested untrusted XML crash the app via stack exhaustion (DoS only).(CVE-2026-11573)
Pylint is a Python source code analyzer which looks for programming errors, helps enforcing a coding standard and sniffs for some code smells (as defined in Martin Fowler's Refactoring book). Pylint can be seen as another PyChecker since nearly all tests you can do with PyChecker can also be done with Pylint. However, Pylint offers some more features, like checking length of lines of code, checking if variable names are well-formed according to your coding standard, or checking if declared interfaces are truly implemented, and much more. Additionally, it is possible to write plugins to add your own checks.
Security Fix(es):
Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINT_HOME and loads those files with pickle.load on a later run. An attacker who can write to a shared, group-writable, or otherwise untrusted cache directory can replace a stats cache with crafted serialized data, causing arbitrary code to execute with the privileges of the user who next runs Pylint. The default per-user cache is not normally writable by another user. This issue is fixed in version 4.0.9.(CVE-2026-114608)
Libwebsockets (LWS) is a flexible, lightweight pure C library for implementing modern network protocols easily with a tiny footprint, using a nonblocking event loop.
Security Fix(es):
libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of PUBACK packets. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-31039.(CVE-2026-114550)
Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging \ Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift. of CVE-2022-22815,CVE-2022-22816)
Security Fix(es):
Pillow is a Python imaging library. From 9.1.0 until 13.0.0, Pillow can disclose uninitialized stack memory when Image.quantize() uses an empty palette. ImagingPaletteCacheUpdate() leaves a local cache array uninitialized when the palette has zero entries, and the conversion path emits those bytes as output pixel indices. An attacker who controls the palette image can obtain stack contents from a returned PNG or GIF. This can disclose addresses and stack-canary data without an out-of-bounds access, memory corruption, or process crash. This issue is fixed in version 13.0.0.(CVE-2026-112898)
Pillow is a Python imaging library. From 9.1.0 until 13.0.0, BmpRleDecoder.decode() in src/PIL/BmpImagePlugin.py permits crafted RLE BMP delta escapes and absolute-mode runs to append beyond the remaining dest_length without a per-branch cap. A delta can add roughly 255 image rows in one iteration, so a kilobyte-sized file with a large but permitted width can expand the data bytearray to hundreds of megabytes or more, causing memory-exhaustion denial of service. This issue is fixed in version 13.0.0.(CVE-2026-96638)
Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging \ Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift. of CVE-2022-22815,CVE-2022-22816)
Security Fix(es):
Pillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow can free an invalid glyph pointer during FreeType rendering with an active stroker. If FT_Load_Glyph fails, cleanup may call FT_Done_Glyph on an uninitialized or stale glyph variable. An attacker can supply a malformed font as untrusted bytes to an application that draws text with a nonzero stroke width, forcing the glyph-load failure path. This can corrupt memory or crash the process. This issue is fixed in version 13.0.0.(CVE-2026-112893)
Pillow is a Python imaging library. From 9.1.0 until 13.0.0, BmpRleDecoder.decode() in src/PIL/BmpImagePlugin.py permits crafted RLE BMP delta escapes and absolute-mode runs to append beyond the remaining dest_length without a per-branch cap. A delta can add roughly 255 image rows in one iteration, so a kilobyte-sized file with a large but permitted width can expand the data bytearray to hundreds of megabytes or more, causing memory-exhaustion denial of service. This issue is fixed in version 13.0.0.(CVE-2026-96638)
CVE-2026-126663 is a path traversal vulnerability in Contao versions 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6. It allows content editors to read image files anywhere on the filesystem via the {{image::}} insert tag by exploiting incorrect validation order of paths. Attackers can use percent-encoded sequences to bypass the Validator::isInsecurePath() check, causing the frontend to serve files outside the intended directory.
CVE-2026-126662 is an access control bypass vulnerability in Contao versions 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6. It allows filemount-restricted backend users with certain permissions to modify folders outside their authorized filemount via the file manager's Edit-Multiple operation. This can lead to publishing protected folders or excluding them from synchronization, potentially exposing files for public download.
BlueprintUE Self-Hosted Edition versions 1.0.0 through before 4.3.5 contain a resource exhaustion vulnerability. Unauthenticated attackers can repeatedly create anonymous blueprints with a 'never' expiration, bypassing automatic purges. This allows attackers to fill server storage, leading to denial of service. The vulnerability is fixed in version 4.3.5.
ByteStash versions 1.5.10 through before 1.6.2 have a vulnerability where API keys remain valid even after the associated user account is deactivated. This occurs because the validateApiKey function does not verify the account status, allowing continued access to API endpoints for snippet management and MCP tools.
Finite State, a product security firm, raised $27 million in a Series C funding round to expand its international presence and enhance its autonomous device security platform. The platform inspects compiled firmware and binaries to identify known and zero-day vulnerabilities in connected devices, helping manufacturers in sectors like automotive, medical, industrial, consumer electronics, and utilities. It also supports compliance with regulations such as the EU Cyber Resilience Act, FDA premarket cybersecurity requirements, UNECE vehicle regulations, and IEC 62443. The investment is driven by increased discovery of critical vulnerabilities and growing regulatory mandates. AI agents automate analysis, triage, testing, and regulatory reporting within the platform.
Raptor is the RDF Parser Toolkit for Redland that provides a set of standalone RDF parsers, generating triples from RDF/XML or N-Triples.
Security Fix(es):
* raptor2: raptor2: arbitrary code execution via heap-based buffer overflow in language tag handling (CVE-2025-71436)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
GNOME Remote Desktop is a remote desktop and screen sharing service for the GNOME desktop environment.
Security Fix(es):
* gnome-remote-desktop: Busy-Wait DoS in VNC TLS I/O Handlers (GNUTLS_E_AGAIN / GNUTLS_E_INTERRUPTED) (CVE-2026-109832)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.
Security Fix(es):
* freerdp: FreeRDP: Denial of Service via uninitialized progressive tile handling (CVE-2026-109242)
* freerdp: freerdp: Denial of Service via heap-based buffer overflow during MP3 audio decoding (CVE-2026-110837)
* freerdp: freerdp: Denial of Service via heap out-of-bounds write in NTLM authentication (CVE-2026-111880)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The libsoup packages provide an HTTP client and server library for GNOME.
Security Fix(es):
* SoupWebsocketExtensionDeflate: libsoup: libsoup: WebSocket permessage-deflate Unbounded Decompression Remote Denial of Service (CVE-2026-15709)
* libsoup: SoupWebsocketConnection: libsoup: WebSocket remote denial of service via oversized control frame protocol violation (CVE-2026-15711)
* libsoup: libsoup: Heap buffer overflow from WebSocket Pong signal type confusion (CVE-2026-102556)
* libsoup: libsoup: Heap buffer overflow during WebSocket message reassembly (CVE-2026-102557)
* libsoup: libsoup: Heap buffer overflow during WebSocket receive-buffer growth (CVE-2026-102558)
* libsoup: libsoup: Heap buffer overflow during WebSocket client-frame masking (CVE-2026-102559)
* libsoup: libsoup: Heap buffer overflow during outgoing permessage-deflate buffer growth (CVE-2026-102560)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The dpdk packages provide the Data Plane Development Kit, which is a set of libraries and drivers for fast packet processing in the user space.
Security Fix(es):
* dpdk: dpdk: Missing memory size validation before mmap in vhost memory region setup (CVE-2026-86561)
* dpdk: dpdk: Control-queue descriptor double-fetch overflows host heap in DPDK vhost (VDUSE) (CVE-2026-86562)
* dpdk: dpdk: Double offset bug in vhost log mapping calculation (CVE-2026-86563)
* dpdk: dpdk: Guest can desynchronize virtqueue size from inflight descriptor table size, causing out-of-bounds write (CVE-2026-86565)
* dpdk: dpdk: Guest with runt RX descriptors underflows copy length in vhost enqueue (split and packed rings) (CVE-2026-86566)
* dpdk: dpdk: VDUSE handler fails to invalidate vring pointers when IOTLB is invalidated, leading to use-after-unmap (CVE-2026-86567)
* dpdk: dpdk: Guest-triggered use-after-free and type confusion in vhost-crypto session cleanup (CVE-2026-86845)
* dpdk: dpdk: Guest can trigger out-of-bounds write by controlling avail ring index in vhost-crypto (CVE-2026-86846)
* dpdk: dpdk: Guest can trigger infinite loop in vhost-crypto writeback chain cleanup (CVE-2026-86847)
* dpdk: dpdk: Time-of-check/time-of-use vulnerability allowing guest-triggered out-of-bounds write in vhost-crypto (CVE-2026-86848)
* dpdk: dpdk: Integer overflow combined with missing validation leads to host buffer overflow in vhost-crypto (CVE-2026-86849)
* dpdk: dpdk: Stack and heap buffer overflow in nfp vDPA driver (CVE-2026-86856)
* dpdk: dpdk: Guest-triggered out-of-bounds walk via vhost indirect descriptor length TOCTOU (CVE-2026-93683)
* dpdk: dpdk: heap out-of-bounds read/write in GSO header copy (CVE-2026-100236)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures.
Security Fix(es):
* xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c (CVE-2026-16118)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Uncontrolled Resource Consumption vulnerability in the sketch deserialization of Apache DataSketches Java.
Several deserializers trusted sizes and counts declared in the serialized input. A small crafted input could make an application allocate an excessive amount of memory, leading to an OutOfMemoryError. A crafted string passed to FrequentLongsSketch.getInstance(String) could also make deserialization, or a later update, loop indefinitely. Only applications that deserialize sketches from untrusted sources are affected.
This issue affects Apache DataSketches Java: through 9.0.0.
Users are recommended to upgrade to version 9.1.0, which fixes the issue.