Recent Advisories

Severity ID Title Vendor Product Date Type
HIGH 7.8 CVE-2026-11940

tarfile extraction filter bypass allows escaping the destination directory_CVE-2026-11940

tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a dee...

Python Software Foundation CPython CVE
HIGH 7.5 CVE-2025-61025

CVE-2025-61025_CVE-2025-61025

An issue in the sslr_qst_get component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL ...

n/a n/a n/a CVE
HIGH 7.5 CVE-2025-61022

CVE-2025-61022_CVE-2025-61022

An issue in the sqlo_tb_col_preds component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted...

n/a n/a n/a CVE
HIGH 7.5 CVE-2025-61020

CVE-2025-61020_CVE-2025-61020

An issue in the sqlo_strip_in_join component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafte...

n/a n/a n/a CVE
HIGH 7.5 CVE-2025-61018

CVE-2025-61018_CVE-2025-61018

An issue in the sqlo_place_dt_set component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted...

n/a n/a n/a CVE
MEDIUM 4.4 CVE-2025-13162

Advant Master Online Builder DLL vulnerability_CVE-2025-13162

Uncontrolled Search Path Element vulnerability in ABB Control Builder A, ABB 800xA for Advant Master. This issue affects Control Builder A: throug...

ABB Control Builder A CVE
LOW 2.9 CVE-2026-57062

CVE-2026-57062_CVE-2026-57062

CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to...

GnuPG GnuPG CVE
MEDIUM 4 CVE-2026-57053

CVE-2026-57053_CVE-2026-57053

GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs because of mishandling in idna_to_unicode_inte...

GNU libidn CVE
MEDIUM 4.3 CVE-2026-55517

Deno: Denial of service via non-ASCII bytes in WebSocket response headers_CVE-2026-55517

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.5, a Deno program that opens a client WebSocket connection could be crashed...

denoland deno < 2.7.5 CVE
MEDIUM 6 CVE-2026-54316

Claude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetch_CVE-2026-54316

Claude Code is an agentic coding tool. From 0.2.54 until 2.1.163, because the hostname huggingface.co was pre-approved as a bare hostname for the ...

anthropics claude-code >= 0.2.54, < 2.1.163 CVE