THREAT OPS › Threat News

Threat Intelligence News

11692 reports from 110+ open cyber-threat-intelligence sources — APT activity, malware, vulnerabilities and campaigns, newest first.

AI Doesn’t Mean the End of Mathematics—at Least Not Yetschneier · 2026-08-28
China-Made ZBT Routers Ship With Two Implants Giving Unauthenticated Attackers Root Accessthehackernews · 2026-08-28
PaperCut NG/MF Critical Zero-Day Exploited in the Wildrapid7 · 2026-08-28
[qilin] Infinnium posted to leak siteransomware_live · 2026-08-28
[qilin] Whitehouse posted to leak siteransomware_live · 2026-08-28
Critical cPanel Flaw Could Let One Hosting Customer Take Root Control of a Whole Serverthehackernews · 2026-08-28
PaperCut Zero-Day Exploited in Attacks, Affecting All NG and MF Versionsthehackernews · 2026-08-28
APT28-Linked HOOKEDGE Backdoor Targets European Government and Diplomatic Organizationsthehackernews · 2026-08-28
[NVD] CVE-2026-80724 (HIGH 8.8) — In the Linux kernel, the following vulnerability has been resolved: ptp: vmclock: prevent read-only mappings from becoming writable vmclock_miscdev_mmap() rejects writable mappings of the shared vmclock ABI page with -EROFS, but leaves VM_MAYWRITE set. Userspace can map the panvd · 2026-08-28
[NVD] CVE-2026-80721 (HIGH 8.8) — In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: ensure no dangling hcon references in iso_conn After iso_conn_del(), ISO sockets should not dereference the hcon any more. Currently, clearing iso_conn::hcon relies on iso_conn_del() releasing nvd · 2026-08-28
[NVD] CVE-2026-80703 — In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE Prevent unauthorized termination of active GPU debug sessions. Previously, users with /dev/kfd access could terminate another process's denvd · 2026-08-28
[NVD] CVE-2026-80653 (HIGH 8.4) — In the Linux kernel, the following vulnerability has been resolved: scsi: hisi_sas: Add slave_destroy interface for v3 hw WARNING is triggered when executing link reset of remote PHY and rmmod SAS driver simultaneously. Following is the WARNING log: WARNING: CPU: 61 PID: 21818nvd · 2026-08-28
[NVD] CVE-2026-80649 (HIGH 7.8) — In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Fix OOB in scmi_power_name_get() scmi_power_name_get() does not validate the domain number passed by the external caller, which may lead to an out-of-bounds access. Fix this by returning "unvd · 2026-08-28
[NVD] CVE-2026-80646 (HIGH 7.5) — In the Linux kernel, the following vulnerability has been resolved: ipv6: guard against possible NULL deref in __in6_dev_stats_get() dev_get_by_index_rcu() could return NULL if the original physical device is unregistered. Found by Sashiko.nvd · 2026-08-28
[NVD] CVE-2026-80645 (HIGH 8.1) — In the Linux kernel, the following vulnerability has been resolved: rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc() With a list_for_each() loop, if we don't find the item we are looking for in the list, then the loop exits with the iterator, which is "dbell" in thinvd · 2026-08-28
[NVD] CVE-2026-80638 (HIGH 8.8) — In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix out-of-bounds write in ocfs2_remove_refcount_extent [BUG] Unlinking a refcounted file whose refcount tree has leaf blocks triggers a fortify panic due to an out-of-bounds write. [CAUSE] When the lasnvd · 2026-08-28
[NVD] CVE-2026-80637 (HIGH 7.5) — In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: fix unaligned memory access in timestamp adjustment Use get_unaligned_be32() and put_unaligned_be32() to safely read and write the timestamp fields. This prevents performance degradation dunvd · 2026-08-28
[NVD] CVE-2026-80635 (HIGH 8.8) — In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix OOB read from short trigger BA firmware response The firmware response length is only checked against sizeof(*rsp) (20 bytes), but when candidate_cnt >= 1, a 22-byte candidate struct is read nvd · 2026-08-28
[NVD] CVE-2026-80634 (CRITICAL 9.8) — In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag The DEV_PATH_BR_VLAN_UNTAG case post-decrements info->num_encaps inside WARN_ON_ONCE(). num_encaps is u8, so if it's already 0 the decrementnvd · 2026-08-28
[NVD] CVE-2026-80633 (HIGH 8.8) — In the Linux kernel, the following vulnerability has been resolved: iommufd: Take dma_resv lock before dma_buf_unpin() in release path dma_buf_unpin() requires the caller to hold the exporter's dma_resv lock: void dma_buf_unpin(struct dma_buf_attachment *attach) { nvd · 2026-08-28
[NVD] CVE-2026-80631 (HIGH 7.5) — In the Linux kernel, the following vulnerability has been resolved: btrfs: lzo: reject compressed segment that overflows the compressed input lzo_decompress_bio() validates each on-disk segment length seg_len only against the workspace cbuf size, not against the compressed inpunvd · 2026-08-28
[NVD] CVE-2026-80630 (CRITICAL 9.8) — In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen Whenever fq_codel drops packets during peek, it calls qdisc_tree_reduce_backlog. An issue arises because it callsnvd · 2026-08-28
[NVD] CVE-2026-80628 (HIGH 7.8) — In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Serialize readq reset state with q->lock snd_seq_oss_readq_clear() resets qlen, head, and tail without q->lock even though the normal reader and producer paths serialize the same ring state undenvd · 2026-08-28
[NVD] CVE-2026-80622 (HIGH 7.8) — In the Linux kernel, the following vulnerability has been resolved: char: tlclk: fix use-after-free in tlclk_cleanup() This patch improves the module cleanup process in the tlclk driver to prevent potential use-after-free and race conditions. Currently, the file_operations strnvd · 2026-08-28
[NVD] CVE-2026-80619 (HIGH 7.8) — In the Linux kernel, the following vulnerability has been resolved: apparmor: fix potential UAF in aa_replace_profiles The function aa_replace_profiles was accessing udata->size after calling aa_put_loaddata(udata), causing a potential UAF. Fixed this by saving the size to a lnvd · 2026-08-28
[NVD] CVE-2026-80617 (CRITICAL 9.8) — In the Linux kernel, the following vulnerability has been resolved: net: airoha: fix foe_check_time allocation size foe_check_time is declared as u16 pointer but was allocated with only ppe_num_entries bytes instead of ppe_num_entries * sizeof(u16). When airoha_ppe_foe_verify_nvd · 2026-08-28
[NVD] CVE-2026-80615 (HIGH 8.2) — In the Linux kernel, the following vulnerability has been resolved: net: dst_metadata: fix false-positive memcpy overflow in tun_dst_unclone kmalloc_flex() in metadata_dst_alloc() sets __counted_by for the structure to the options_len, which is then initialized to zero. Later, nvd · 2026-08-28
[NVD] CVE-2026-80614 (HIGH 7.5) — In the Linux kernel, the following vulnerability has been resolved: net: emac: Fix NULL pointer dereference in emac_probe Move devm_request_irq() after devm_platform_ioremap_resource() so that dev->emacp is mapped before the interrupt handler can fire. An early interrupt hittinvd · 2026-08-28
[NVD] CVE-2026-80613 (HIGH 7.8) — In the Linux kernel, the following vulnerability has been resolved: veth: fix NAPI leak in XDP enable error path During XDP enablement in veth, if xdp_rxq_info_reg() or xdp_rxq_info_reg_mem_model() fails, the driver rolls back the changes. However, the rollback loop: for (i--nvd · 2026-08-28
[NVD] CVE-2026-80612 (CRITICAL 9.8) — In the Linux kernel, the following vulnerability has been resolved: net: lwtunnel: Drop skb metadata before LWT encapsulation skb metadata is meant for passing information between XDP and TC. It lives in the skb headroom, immediately before skb->data. LWT programs cannot accessnvd · 2026-08-28
[NVD] CVE-2026-80608 (HIGH 8.8) — In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix iommu domain lifetime race during device removal When force_iova mode is enabled, amdxdna_remove() frees xdna->domain. If amdxdna_gem_obj_free() is called after device removal, it may attemptnvd · 2026-08-28
[NVD] CVE-2026-80606 (HIGH 7.8) — In the Linux kernel, the following vulnerability has been resolved: drm/xe/userptr: Hold notifier_lock for write on inject test path When CONFIG_DRM_XE_USERPTR_INVAL_INJECT=y, xe_pt_svm_userptr_pre_commit() runs vma_check_userptr() with the svm notifier_lock taken for read. Thenvd · 2026-08-28
[NVD] CVE-2026-80604 (HIGH 8.8) — In the Linux kernel, the following vulnerability has been resolved: HID: core: Fix OOB read in hid_get_report for numbered reports When a caller passes a size of 0 to hid_report_raw_event() for a numbered report, the function originally called hid_get_report() before performingnvd · 2026-08-28
[NVD] CVE-2026-80603 (CRITICAL 9.1) — In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read parse_dcc() treats data_end as an inclusive end pointer, but its only caller passes data_limit = ib_ptr + datalen, which points one past the lastnvd · 2026-08-28
[NVD] CVE-2026-80601 (HIGH 8.8) — In the Linux kernel, the following vulnerability has been resolved: batman-adv: gw: acquire ethernet header only after skb realloc The pskb_may_pull() called by batadv_get_vid() could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to nvd · 2026-08-28
[NVD] CVE-2026-80600 (CRITICAL 9.8) — In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: acquire ARP hw source only after skb realloc The pskb_may_pull() called by batadv_get_vid() could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to bnvd · 2026-08-28
[NVD] CVE-2026-80599 (HIGH 8.1) — In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: ensure accessible eth_hdr proto field When batadv_get_vid() accesses the proto field of the ethernet header, it is not checking if the data itself is accessible. The caller is responsible for invd · 2026-08-28
[NVD] CVE-2026-80598 (HIGH 7.8) — In the Linux kernel, the following vulnerability has been resolved: ntfs3: fix out-of-bounds read in decompress_lznt decompress_lznt() does not validate array index bounds before accessing the decompression table. A corrupted NTFS3 image with invalid compressed data can triggernvd · 2026-08-28
[NVD] CVE-2026-80596 (HIGH 8.4) — In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - only expose sysfs attributes on control interface When the driver was converted to use the driver core to instantiate device attributes (via .dev_groups in the usb_driver structure), the attribnvd · 2026-08-28
[NVD] CVE-2026-80593 (HIGH 8.4) — In the Linux kernel, the following vulnerability has been resolved: hwmon: (asus_atk0110) Check package count before accessing element atk_ec_present() walks the management group package returned by the GGRP ACPI method and, for each sub-package, reads its first element: id =nvd · 2026-08-28
[NVD] CVE-2026-80591 (HIGH 7.8) — In the Linux kernel, the following vulnerability has been resolved: f2fs: fix listxattr handling of corrupted xattr entries Validate the xattr entry before reading its fields in f2fs_listxattr(). Return -EFSCORRUPTED when the entry is outside the valid xattr storage area insteanvd · 2026-08-28
[NVD] CVE-2026-80590 (HIGH 8.6) — In the Linux kernel, the following vulnerability has been resolved: inet: frags: strip GSO state from fragments before reassembly A virtio_net_hdr (tun/tap, or AF_PACKET with PACKET_VNET_HDR) can mark an IPv4 or IPv6 fragment as GSO; nothing relates gso_type to frag_off. inet_fnvd · 2026-08-28
Some Malicious PE Stats, (Thu, Aug 27th)sans_isc · 2026-08-28
[ShadowByt3$] Bayview Real Estate WARNING posted to leak siteransomware_live · 2026-08-28
[NVD] CVE-2026-3129 (MEDIUM 6.4) — The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via crafted `<img>` tag attributes in all versions up to, and including, 7.7. This is due to a flawed regular expression that is used to strip `width` and `height` attributes from images when thnvd · 2026-08-28
Risky Bulletin: Two TeamPCP members arrested in Australiariskybiz_news · 2026-08-28
[lockbit5] tnmed.org posted to leak siteransomware_live · 2026-08-28
[anubis] Caduceus Medical Group posted to leak siteransomware_live · 2026-08-28
[NVD] CVE-2026-78008 — A buffer overflow vulnerability in the WatchGuard Fireware OS Management Web UI allows an authenticated administrator with network access to cause a denial of service (DoS) condition or potentially execute arbitrary code by sending specially crafted network traffic.nvd · 2026-08-28
[NVD] CVE-2026-61802 (MEDIUM 6.5) — Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, a low-privilege API user can read the cleartext cluster key from a configuration endpoint that fails to redact it. The REST APnvd · 2026-08-28
[NVD] CVE-2026-61800 (CRITICAL 9.1) — Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.4.0 through 4.14.6, a party holding the cluster key can write, overwrite, or delete arbitrary files under /var/ossec on worker nodes, leading to renvd · 2026-08-28
[NVD] CVE-2026-61783 (MEDIUM 6.5) — Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, an authenticated low-privilege user can read the cluster secret from the manager configuration because the logic that masks senvd · 2026-08-28
[NVD] CVE-2026-54085 (HIGH 7.1) — Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.2.0 through 4.14.6, multiple active response scripts pass attacker-influenced alert fields to privileged system commands without validating their fnvd · 2026-08-28
[NVD] CVE-2026-54084 (MEDIUM 5.3) — Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.0.0 through 4.14.6, a malicious or man-in-the-middle enrollment manager can crash a Wazuh agent during enrollment by returning a malformed key respnvd · 2026-08-28
[NVD] CVE-2026-54083 (HIGH 8.1) — Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. The ip-customblock active response script contains a path traversal vulnerability that lets an attacker create or delete arbitrary files on the filesystem as rnvd · 2026-08-28
From 88 lines to 1: Detecting DLL hijacking with Elastic Defendelastic_security · 2026-08-28
[CISA KEV] CVE-2026-82078 — PaperCut NG/MF: PaperCut NG/MF Unsafe Reflection Vulnerabilitycisa_kev · 2026-08-28
[CISA KEV] CVE-2026-81578 — PaperCut NG/MF: PaperCut NG/MF Missing Authentication for Critical Function Vulnerabilitycisa_kev · 2026-08-28
[GHSA] GHSA-vxj7-4xrp-5vr4 (medium) — aiosmtplib: STARTTLS response injectiongithub_advisories · 2026-08-27
bubblewrap 0.12.0 fixes writes outside sandboxoss_sec · 2026-08-27
[GHSA] GHSA-6hx8-3wjj-gr8g (medium) — WebOb: Open redirect in Location header normalization via leading C0 control / space charactersgithub_advisories · 2026-08-27
[Eclipse] ETNA Software posted to leak siteransomware_live · 2026-08-27
[chaos] singleton.com posted to leak siteransomware_live · 2026-08-27
[SilentRansomGroup] Ne...n M... posted to leak siteransomware_live · 2026-08-27
[NVD] CVE-2026-81522 (HIGH 8.1) — A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers. An application that builds a namespace identifier from untrusted input without validating it may therefore have its operation directednvd · 2026-08-27
[NVD] CVE-2026-74820 — ServiceNow has remediated a SQL injection vulnerability that was identified in in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary SQL statements against the instance's underlying database and gainnvd · 2026-08-27
[NVD] CVE-2026-6876 — ServiceNow has remediated a sandbox escape security issue that was identified in the Now Platform. This security issue could allow an unauthenticated user to execute arbitrary code within the Now Platform, potentially leading to more access to the Now Platform than intended. nvd · 2026-08-27
[NVD] CVE-2026-59324 (HIGH 8.2) — When an IntegrationFlow uses .fluxTransform() with an asynchronous/reordering fluxFunction that emits raw payloads, concurrent requests on the same FluxMessageChannel subscription have their reply headers (replyChannel, errorChannel, correlationId, any propagated security/tenant nvd · 2026-08-27
[NVD] CVE-2026-59322 (MEDIUM 6.3) — The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its constructor. When decodeNativeFormat processes raw byte payloads, it deserializes embedded JSON headers into a plain Map and constructs a GenericMessage with MutableMessageHeaders nvd · 2026-08-27
[NVD] CVE-2026-59321 (MEDIUM 4.2) — A single ScriptEngine instance is reused for every message on a script-backed channel. For JSR-223 engines that report THREADING=null (not thread-safe, e.g. the Kotlin kts engine), concurrent message processing can corrupt engine-internal state, potentially leaking one message's nvd · 2026-08-27
[NVD] CVE-2026-59320 (MEDIUM 6.5) — When a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing throws still permanently consumes one link credit. After initialCredits (default 100) failing messages the receiver's credit reaches zero and the broker stops delnvd · 2026-08-27
[NVD] CVE-2026-59319 (MEDIUM 4.3) — RedisChatMemoryRepository.findByMetadata() builds RediSearch tag and text queries from caller-supplied metadata values without applying RediSearchUtil.escape(), unlike get(), clear(), and findByTimeRange() in the same class which do escape their inputs. An application that passesnvd · 2026-08-27
[NVD] CVE-2026-59317 (MEDIUM 6.5) — DeadLetterPublishingRecovererFactory reads the retry_topic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new BigInteger(header.value()) with no length or format validation. Spring for Apache Kafka 4.1.0 Spring for Apache Kafka 4.0.0nvd · 2026-08-27
[NVD] CVE-2026-59316 (HIGH 8.2) — Spring Authorization Server's default consent page renders user-controlled values without HTML entity encoding. When using the DefaultConsentPage, an attacker can craft an OAuth2 authorization request containing a malicious value that is stored server-side and later rendered unennvd · 2026-08-27
[NVD] CVE-2026-59315 (MEDIUM 5.3) — The Spring Cloud Config Monitor is susceptible to Denial of Service attacks via malicious payloads. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config 4.0.0 - 4.2.8 Spring Cloud Config 3.1.14 and earliernvd · 2026-08-27
[NVD] CVE-2026-59313 (CRITICAL 9.8) — Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE). Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.nvd · 2026-08-27
[NVD] CVE-2026-59311 (MEDIUM 6.8) — A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their choosing by pre-creating /tmp/ziptransformer as a symlink before the application starts. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integrationnvd · 2026-08-27
[NVD] CVE-2026-59307 (HIGH 8.0) — An operator who calls JdbcMessageStore.addAllowedPatterns(...) to restrict deserialization receives no protection at all when the store is a Spring-managed bean. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 -nvd · 2026-08-27
[NVD] CVE-2026-48996 — Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter does not sanitize note titles, and the GeoMap note view interpolates a marker note's title into raw HTML that is rendered as innerHTML, allnvd · 2026-08-27
[NVD] CVE-2026-47727 — Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the default-on "Safe import" filter fails to neutralize the shareTemplate relation because that relation is not marked as dangerous, allowing an attacker-supplied import archive to plantnvd · 2026-08-27
[NVD] CVE-2026-37067 (MEDIUM 5.3) — Incorrect access control in /vfm-admin/admin-panel/view/save-cvs.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to extract all application logs from a desired date forwards via a specially crafted POST request.nvd · 2026-08-27
[NVD] CVE-2026-18886 — ServiceNow has remediated an improper access control vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to create or modify instance data beyond what was intended, resulting in privilnvd · 2026-08-27
[NVD] CVE-2026-18885 — ServiceNow has remediated a code injection vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary code in the ServiceNow platform and gain access to, or modify, instanvd · 2026-08-27
Join OpenSSF at AGNTCon + MCPCon North America: Securing Agentic AIopenssf_blog · 2026-08-27
The GNU C Library security advisory update for 2026-08-27oss_sec · 2026-08-27
Wordfence Argus: Moving Beyond Human Research Capabilitywordfence · 2026-08-27
OpenAI Says Reward Hacking Drove AI Agents to Exploit Zero-Days and Breach Hugging Facethehackernews · 2026-08-27
[qilin] Globalport Terminals posted to leak siteransomware_live · 2026-08-27
[Storm] Agrimac posted to leak siteransomware_live · 2026-08-27
[Storm] Our Hospice Of South Central Indiana posted to leak siteransomware_live · 2026-08-27
“Sorry, I can’t help with that”: How your guardrails might become the attacker’s best friendtalos · 2026-08-27
Zero Breach vs. Zero Impact: Key Takeaways From Cloud Security LIVE 2026orca_security · 2026-08-27
Vulnerability Prioritization: Modern Methods & Toolsorca_security · 2026-08-27
[incransom] BENCIVIL posted to leak siteransomware_live · 2026-08-27
[lockbit5] fpmanagement.nl posted to leak siteransomware_live · 2026-08-27
PCI DSS 4.0.1: Application Requirements You’re Being Assessed On in 2026qualys · 2026-08-27
Why SpecterOps Signed OpenAI’s Call for Collective Cyber Defensespecterops · 2026-08-27
Wordfence Argus Finds Critical Authentication Bypass in WPMU DEV Dashboard Pluginwordfence · 2026-08-27
[GHSA] GHSA-mf7q-r4rv-jv94 (high) — Crossplane's TOCTOU between cosign verification and image fetch in xpkg.CachedClient allows tag-based package install to bypass signature checkgithub_advisories · 2026-08-27
[GHSA] GHSA-gmxc-r82q-347r (medium) — libreoffice-convert vulnerable to path traversal / arbitrary file writegithub_advisories · 2026-08-27