WeKnora Vulnerable to Remote Code Execution via SQL Injection Bypass in AI Database Query Tool

Summary A critical Remote Code Execution RCE vulnerability exists in the application's database query functionality. The validation system fails to recursively inspect child nodes within PostgreSQL array expressions and row expressions, allowing attackers to bypass SQL injection protections. By...

GHSA-8W32-6MRW-Q5WV WeKnora Vulnerable to Remote Code Execution via SQL Injection Bypass in AI Database Query Tool

Summary A critical Remote Code Execution RCE vulnerability exists in the application's database query functionality. The validation system fails to recursively inspect child nodes within PostgreSQL array expressions and row expressions, allowing attackers to bypass SQL injection protections. By...

CVE-2026-29091

Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to version 3.0.0, a remote code execution RCE flaw was discovered in the locutus project, specifically within the calluserfuncarray function implementation. The vulnerability allows an attacker to...

CVE-2026-29091 Locutus: Remote Code Execution (RCE) in locutus call_user_func_array due to Code Injection

Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to version 3.0.0, a remote code execution RCE flaw was discovered in the locutus project, specifically within the calluserfuncarray function implementation. The vulnerability allows an attacker to...

CVE-2026-29091

CVE-2026-29091 concerns Locutus, a project that ports stdlibs to JavaScript. Red Hat and NVD descriptions detail an RCE in the call_user_func_array wrapper, where an insecure validation of the callback array before eval() allows arbitrary JavaScript execution in the runtime. The issue is specific...

RHEL 10 : postgresql16 (RHSA-2026:3887)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:3887 advisory. PostgreSQL is an advanced Object-Relational database management system DBMS. The base postgresql package contains the client programs that...

PT-2026-39114

Name of the Vulnerable Software and Affected Versions Linux kernel versions 5.10 through 6.19 Description A stack out-of-bounds read exists in the nftables pipapo set backend within the pipapo drop function. The issue occurs because the function passes rulemapi + 1.n to pipapo unmap as the to...

PT-2026-23803

Name of the Vulnerable Software and Affected Versions WeKnora versions prior to 0.2.12 Description WeKnora, an LLM-powered framework for deep document understanding and semantic retrieval, contains a remote code execution RCE issue in its database query functionality. The application's validation...

Linux kernel md_bitmap_read_sb Heap Buffer Overflow DoS

The vulnerability of the mdbitmapreadsb function in the drivers/md/md-bitmap.c file of the Linux support module for multiple devices RAID and LVM involves an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to cause a service failure...

OSV-2026-356 Security exception in org.apache.lucene.util.ArrayUtil.copyOfSubArray

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=489370855 Crash type: Security exception Crash state: org.apache.lucene.util.ArrayUtil.copyOfSubArray org.apache.lucene.util.BytesRef.deepCopyOf org.apache.lucene.index.Term...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-005801)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005801 advisory. In the Linux kernel, the following vulnerability has been resolved: phy: hisilicon: Fix an out of bounds check in hisiinnophyprobe The size of array 'priv-ports' is...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-005686)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005686 advisory. In the Linux kernel, the following vulnerability has been resolved: fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev Syzkaller reported the following...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-005569)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005569 advisory. In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Fix memcpy field-spanning write warning in mwifiexcmd80211scanext Replace...

Security Bulletin: A vulnerability in JavaScript qs package affect IBM® Db2® Big SQL on IBM Cloud Pak for Data.

Summary A vulnerability in JavaScript qs package affect IBM® Db2® Big SQL 8.3 on IBM Cloud Pak for Data 5.3 and earlier. Vulnerability Details CVEID:CVE-2025-15284 DESCRIPTION: Improper Input Validation vulnerability in qs parse modules allows HTTP DoS.This issue affects qs: 6.14.1. Summary The...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-005708)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005708 advisory. An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro could lead to a miscalculation of the h-nets array offset,...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-005455)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005455 advisory. In the Linux kernel, the following vulnerability has been resolved: parport: Proper fix for array out-of-bounds access The recent fix for array out-of-bounds accesse...

PHP Object Model Bypass OS Command Execution

The vulnerability of the mechanism for destroying arrays containing objects of the PHP interpreter’s object model is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to bypass the disablefunctions protection mechanism and invoke operating syste...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-005543)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005543 advisory. In the Linux kernel, the following vulnerability has been resolved: ALSA: asihpi: Fix potential OOB array access ASIHPI driver stores some values in the static array...

OpenClaw has an unspecified vulnerability (CNVD-2026-13378)

OpenClaw is openclaw open source an intelligent artificial assistant. A security vulnerability exists in OpenClaw that stems from the normalizeForHash function mishandling array sorting, which can be exploited by an attacker to cause a compromise in the integrity of a sandboxed configuration...

Allocation of Resources Without Limits or Throttling

Overview @sveltejs/kit is a SvelteKit framework and CLI Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the deserializebinaryform function in the remote form handler. An attacker can exhaust application resources by sending crafted bina...