CVE-2026-56679 9Router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade

9Router is an AI router & token saver. Prior to 0.5.4, the PATCH /api/settings endpoint writes the entire request body to persistent settings without a field whitelist, allowing an authenticated user to set security-critical fields such as requireLogin and disable authentication for the whole...

CVE-2026-56679

9Router (AI router & token saver) contains a mass-assignment vulnerability in PATCH /api/settings prior to version 0.5.4. The endpoint writes the entire request body to persistent settings without a field whitelist, enabling an authenticated user to modify security-critical fields such as require...

CVE-2026-56679 9Router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade

9Router is an AI router & token saver. Prior to 0.5.4, the PATCH /api/settings endpoint writes the entire request body to persistent settings without a field whitelist, allowing an authenticated user to set security-critical fields such as requireLogin and disable authentication for the whole...

SUSE-SU-2026:22745-1 Security update for the Linux Kernel (Live Patch 14 for SUSE Linux Enterprise 16)

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.35.1 fixes various security issues The following security issues were fixed: - CVE-2026-46120: ip6gre: Use cached t-net in ip6erspanchangelink bsc1267893. - CVE-2026-46173: exit: prevent preemption of oopsing TASKDEAD task bsc1267723....

Security update for the Linux Kernel (Live Patch 74 for SUSE Linux Enterprise 12 SP5)

This update for the SUSE Linux Enterprise Kernel 4.12.14-122.280 fixes various security issues The following security issues were fixed: CVE-2026-31685: netfilter: ip6teui64: reject invalid MAC header for all packets bsc1263670. CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new...

CVE-2026-45337

Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the deviceAuthorization plugin treats any authenticated session as the owner of any pending device code because GET /device does not claim the row and POST /device/approve and POST /device/deny...

Exploit for CVE-2026-53359

AlmaLinux 9.5 — Mitigasi Januscape CVE-2026-53359 & Bad Epol...

CVE-2026-54560 Cloudreve: OAuth access tokens bypass scope enforcement due to missing client_id claim

Cloudreve is a self-hosted file management and sharing system. From 4.12.0 until 4.16.1, Cloudreve's OAuth access tokens are issued without the OAuth clientid claim, so the JWT verifier does not load token scopes into request context and RequiredScopes treats the request like non-scoped session...

July 2026 Patch Tuesday fixes 622 Microsoft CVEs, including three zero-days

Just one month ago, June 2026 Patch Tuesday broke Microsoft’s previous record with 206 CVEs and three zero‑days. July now triples that count, reinforcing that the era of “small” Patch Tuesdays may be over as AI‑driven vulnerability discovery ramps up. The update includes 59 critical...

Microsoft’s July 2026 Patch Tuesday fixes 622 flaws and 2 exploited zero-days

Microsoft’s July 2026 Patch Tuesday fixes 622 CVEs, including exploited AD FS and SharePoint flaws, plus the disclosed BitLocker bypass requiring urgent action...

Security update for gnutls

This update for gnutls fixes the following issue Rebase the CVE-2026-42014 patch to include a missing call to p11kiturifree in gnutlspkcs11tokensetpin bsc1263713. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

Security update for yelp

This update for yelp fixes the following issue CVE-2026-13601: overly permissive Content Security Policy allows host file disclosure via Flatpak applications bsc1269625. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper...

Security update for yelp

This update for yelp fixes the following issue CVE-2026-13601: overly permissive Content Security Policy allows host file disclosure via Flatpak applications bsc1269625. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper...

EUVD-2026-44644

PraisonAI Platform before 0.1.9 fails to properly authorize label and issue-label mutations, allowing workspace members to rename and recolor shared labels and add or remove labels on owner-created issues. Attackers with workspace member privileges can exploit PATCH and POST/DELETE endpoints to...

CVE-2026-61440

CVE-2026-61440 affects the PraisonAI Platform prior to 0.1.9. The issue is an authorization flaw in label and issue-label mutations that lets workspace members with basic privileges rename and recolor shared labels and add/remove labels on owner-created issues. The root cause is improper authoriz...

CVE-2026-61440 PraisonAI Platform before 0.1.9 Authorization Bypass via Label Endpoints

PraisonAI Platform before 0.1.9 fails to properly authorize label and issue-label mutations, allowing workspace members to rename and recolor shared labels and add or remove labels on owner-created issues. Attackers with workspace member privileges can exploit PATCH and POST/DELETE endpoints to...

Researcher Drops New Windows Zero-Day PoC Hours After Microsoft Patch Tuesday

Security researcher Chaotic Eclipse aka Nightmare-Eclipse has released a new proof-of-concept PoC exploit called LegacyHive. It has been described as a Windows User Profile Service arbitrary hive load elevation of privileges vulnerability. The Windows User Profile Service, also referred to as...

SUSE-SU-2026:22864-1 Security update for the Linux Kernel (Live Patch 1 for SUSE Linux Enterprise 16)

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.6.1 fixes various security issues The following security issues were fixed: - CVE-2025-71089: iommu: disable SVA when CONFIGX86 is set bsc1256615. - CVE-2026-23393: bridge: cfm: Fix race condition in peermep deletion bsc1260524. -...

Security update for the Linux Kernel (Live Patch 82 for SUSE Linux Enterprise 12 SP5)

This update for the SUSE Linux Enterprise Kernel 4.12.14-122.307 fixes various security issues The following security issues were fixed: CVE-2026-31685: netfilter: ip6teui64: reject invalid MAC header for all packets bsc1263670. CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new...

SUSE-SU-2026:3011-1 Security update for the Linux Kernel (Live Patch 82 for SUSE Linux Enterprise 12 SP5)

This update for the SUSE Linux Enterprise Kernel 4.12.14-122.307 fixes various security issues The following security issues were fixed: - CVE-2026-31685: netfilter: ip6teui64: reject invalid MAC header for all packets bsc1263670. - CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on...