CVE-2026-107822

A flaw was found in MariaDB. An issue in the Access Control List ACL cache causes identical privilege cache keys to be generated when a role and a local user share the same name. An attacker with user creation privileges can exploit this key collision by creating a matching account, allowing them...

DEBIAN-CVE-2026-107822

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. ...

CVE-2026-107822

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. ...

CVE-2026-107822

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. ...

EUVD-2026-95922

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. ...

CVE-2026-107822 MariaDB: database privilege escalation via user / role name collision in the acl cache

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. ...

CVE-2026-107822 MariaDB: database privilege escalation via user / role name collision in the acl cache

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. ...

CVE-2026-107822

MariaDB servers versions 10.6.1 through 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2 are vulnerable to a database privilege escalation flaw. The root cause is a user/role name collision in the ACL cache, where the system generates identical cache keys for roles and localhost user names ...

GHSA-R44W-V6GF-X3P6 pyLoad has an authentication bypass in API key validation (check_apikey cache)

Summary The API-key cache in checkapikey allows an attacker to authenticate with a forged API key as long as the legitimate key for the same keyid has been used recently. On a cache hit, the API key secret is never verified, resulting in a complete authentication bypass during the cache lifetime...

CVE-2026-61642

A flaw was found in Squid. Due to improper handling of HTTP/1.1 Transfer-Encoding headers, a trusted client can perform an HTTP request smuggling attack, interfering with how web requests are processed. This vulnerability allows an attacker to bypass intermediate security controls. When an HTTP...

CVE-2022-0847-Linux

CVE-2022-0847 Description - POC for CVE-2022-0847: Linux Kernel Local Privilege Escalation Vulnerability. - create by antx at 2022-03-08. Detail - Security researcher Max Kellermann responsibly disclosed the 'Dirty Pipe' vulnerability and stated that it affects Linux Kernel 5.8 and later...

CVE_2026_31694

CVE-2026-31694 Passive Scanner A passive Linux host assessment tool for CVE-2026-31694 , a FUSE readdir-cache out-of-bounds write in the Linux kernel. The scanner evaluates the running kernel, FUSE exposure, local package metadata, kernel source evidence, execution environment, and operating-syst...

cve-2026-31431

CVE-2026-31431 — Copy Fail: Linux Kernel LPE Research Lab Educational purposes only. Do NOT use on systems without explicit authorization. Index Description of the vulnerability Affected components How it works Lab setup Docker PoC — Demonstration Mitigation References Vulnerability Description...

CVE-2026-97468 Apache CXF: Authentication bypass via weak cache keys for validated STS tokens

Apache CXF's STSTokenValidator and Security Token Service STS cached validated security tokens under a non-cryptographic 32-bit hash of the token Java Arrays.hashCode/hashCode, and treated a cache hit as proof that the presented token had already been validated. An attacker could craft a token fo...

RLSA-2026:79113 Important: bind9.16 security, bug fix, and enhancement update

The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server is operating correctly. Security Fixes:...

CLEANSTART-2026-XX88354 crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning

Security vulnerability affects the apache2 package. A crafted method sent through HTTP/2 will bypass validation and be forwarded by modproxy, which can lead to request splitting or cache poisoning...

CLEANSTART-2026-RO28104 malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go ...

Security vulnerability affects the syft package. A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache...

RHEL 8 : bind9.16 (RHSA-2026:79160)

"The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:79160 advisory. The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named...

AlmaLinux 8 : bind (ALSA-2026:79162)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:79162 advisory. bind9: bind: BIND 9: Denial of Service via 16-bit length truncation in DNS negative cache handling CVE-2026-19667 bind: BIND: Denial of Service via craft...

CVE-2026-107822: Use of Incorrectly-Resolved Name or Reference

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. ...