CVE-2026-12045

Read-only transaction bypass in the pgAdmin 4 AI Assistant allows an attacker who can influence database content that the assistant reads to execute arbitrary SQL with the privileges of the pgAdmin user's database role. The AI Assistant's executesqlquery tool runs LLM-generated SQL inside a BEGIN...

CVE-2026-12045 pgAdmin 4: AI Assistant read-only transaction bypass allows unauthorised writes and remote code execution

Read-only transaction bypass in the pgAdmin 4 AI Assistant allows an attacker who can influence database content that the assistant reads to execute arbitrary SQL with the privileges of the pgAdmin user's database role. The AI Assistant's executesqlquery tool runs LLM-generated SQL inside a BEGIN...

CVE-2026-12045 pgAdmin 4: AI Assistant read-only transaction bypass allows unauthorised writes and remote code execution

Read-only transaction bypass in the pgAdmin 4 AI Assistant allows an attacker who can influence database content that the assistant reads to execute arbitrary SQL with the privileges of the pgAdmin user's database role. The AI Assistant's executesqlquery tool runs LLM-generated SQL inside a BEGIN...

CVE-2026-12050

SQL injection in pgAdmin 4's named restore point endpoint POST /browser/server/restorepoint/gid/sid. The user-supplied 'value' field was interpolated directly into the SQL string with str.format instead of being passed as a bound parameter, allowing an authenticated pgAdmin user with a connected...

ZITADEL: Missing Token Audience Validation (`aud`) in JWT IdP Provider

Summary An authentication bypass vulnerability was discovered in ZITADEL's external JWT Identity Provider IdP implementation. When validating JSON Web Tokens JWTs from an external provider, ZITADEL properly checks the token's cryptographic signature and issuer iss, but it fails to validate the...

dropbear:fuzzer-postauth_nomaths: Global-buffer-overflow in wrapfd_new_fuzzinput

Detailed Report: https://oss-fuzz.com/testcase?key=5358753208926208 Project: dropbear Fuzzing Engine: honggfuzz Fuzz Target: fuzzer-postauthnomaths Job Type: honggfuzzasandropbear Platform Id: linux Crash Type: Global-buffer-overflow READ 4 Crash Address: 0x55555610a4b4 Crash State:...

PT-2026-50815

Name of the Vulnerable Software and Affected Versions pgAdmin 4 versions 6.0 through 9.15 Description An open redirect exists in the multi-factor authentication MFA flow. The MFA validate and register endpoints, specifically '/mfa/validate', process the user-supplied next query or form parameter...

genai-4-dps-helper (0.2.31), news-scraper-pdf (1.1.6) +6 more potentially affected by CVE-2026-49460 via pypdf (5.3.0)

pypdf PYPI version 5.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - genai-4-dps-helper 0.2.31 - news-scraper-pdf 1.1.6 - polytext =0.1.0, =0.1.0, =0.1.10 - python-pdf-toolkit 0.1.1 - synforge 0.1.0 - ta-using-llms 0.0....

genai-4-dps-helper (0.2.31), news-scraper-pdf (1.1.6) +6 more potentially affected by CVE-2026-48735 via pypdf (5.3.0)

pypdf PYPI version 5.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - genai-4-dps-helper 0.2.31 - news-scraper-pdf 1.1.6 - polytext =0.1.0, =0.1.0, =0.1.10 - python-pdf-toolkit 0.1.1 - synforge 0.1.0 - ta-using-llms 0.0....

CVE-2026-10879 affecting package perl-DBI for versions less than 1.643-4

CVE-2026-10879 affecting package perl-DBI for versions less than 1.643-4. A patched version of the package is available...

CVE-2026-11822 affecting package sqlite for versions less than 3.44.0-4

CVE-2026-11822 affecting package sqlite for versions less than 3.44.0-4. A patched version of the package is available...

CVE-2026-11824 affecting package sqlite for versions less than 3.44.0-4

CVE-2026-11824 affecting package sqlite for versions less than 3.44.0-4. A patched version of the package is available...

CVE-2026-53724

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.79 and 9.9.1-alpha.4, the default file upload extension blocklist can be bypassed by appending a trailing dot to a filename whose extension would otherwise be blocked e.g...

genai-4-dps-helper (0.2.31), news-scraper-pdf (1.1.6) +6 more potentially affected by CVE-2026-48156 via pypdf (5.3.0)

pypdf PYPI version 5.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - genai-4-dps-helper 0.2.31 - news-scraper-pdf 1.1.6 - polytext =0.1.0, =0.1.0, =0.1.10 - python-pdf-toolkit 0.1.1 - synforge 0.1.0 - ta-using-llms 0.0....

genai-4-dps-helper (0.2.31), news-scraper-pdf (1.1.6) +6 more potentially affected by CVE-2026-48155 via pypdf (5.3.0)

pypdf PYPI version 5.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - genai-4-dps-helper 0.2.31 - news-scraper-pdf 1.1.6 - polytext =0.1.0, =0.1.0, =0.1.10 - python-pdf-toolkit 0.1.1 - synforge 0.1.0 - ta-using-llms 0.0....

openSUSE 16 Security Update : ffmpeg-4 (openSUSE-SU-2026:20914-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:20914-1 advisory. Changes in ffmpeg-4: - CVE-2026-30997: avcodec/av1dec: check that primaryrefframe is within range bsc1262047 Tenable has extracted the preceding...

Debian dsa-6338 : libdbi-perl - security update

The remote Debian 12 / 13 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-6338 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6338-1 [email protected]...

PT-2026-60887

Уязвимость механизма автоматического обновления программного комплекса защиты информации ViPNet Client 4 связана с недостатками обработки относительных путей. Эксплуатация уязвимости может позволить нарушителю, действующему из смежной доверенной сети, нарушить целостности среды функционирования,...

PT-2026-54523

Уязвимость пакета html-react-parser инструмента управления базами данных pgAdmin 4 связана с неверным кодированием или экранированием данных. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, проводить межсайтовые сценарные атаки...

PT-2026-48599

Name of the Vulnerable Software and Affected Versions OpenEXR versions 3.4.0 through 3.4.11 Description The HTJ2K High-Throughput JPEG 2000 decoder in OpenEXRCore contains a heap-buffer-overflow READ in the ht undo impl function. This occurs because the function copies decoded pixels from a...