https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 03:07:07 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-63278 <p>URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. The check added for CVE-2024-12426 did not recognise every way of naming the package content provider, so a URL that named it differently still reached the expansion. In fixed versions the package content provider is matched when the URL is checked.</p> <p>URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. The check added for CVE-2024-12426 did not recognise every way of naming the package content provider, so a URL that named it differently still reached the expansion. In fixed versions the package content provider is matched when the URL is checked.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-63278 https://vulnerability.circl.lu/vuln/ghsa-74rr-xj7r-w3qp <p>URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. The check added for CVE-2024-12426 did not recognise every way of naming the package content provider, so a URL that named it differently still reached the expansion. In fixed versions the package content provider is matched when the URL is checked.</p> <p>URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. The check added for CVE-2024-12426 did not recognise every way of naming the package content provider, so a URL that named it differently still reached the expansion. In fixed versions the package content provider is matched when the URL is checked.</p> https://vulnerability.circl.lu/vuln/ghsa-74rr-xj7r-w3qp https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-63278 <p><strong>Affected:</strong> Ubuntu:20.04:LTS: libreoffice, Ubuntu:22.04:LTS: libreoffice, Ubuntu:24.04:LTS: libreoffice, Ubuntu:26.04:LTS: libreoffice</p> <p>URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. The check added for CVE-2024-12426 did not recognise every way of naming the package content provider, so a URL that named it differently still reached the expansion. In fixed versions the package content provider is matched when the URL is checked.</p> <p><strong>Affected:</strong> Ubuntu:20.04:LTS: libreoffice, Ubuntu:22.04:LTS: libreoffice, Ubuntu:24.04:LTS: libreoffice, Ubuntu:26.04:LTS: libreoffice</p> <p>URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. The check added for CVE-2024-12426 did not recognise every way of naming the package content provider, so a URL that named it differently still reached the expansion. In fixed versions the package content provider is matched when the URL is checked.</p> https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-63278