8091 matches found
PT-2026-103544
Name of the Vulnerable Software and Affected Versions Kiteworks affected versions not specified Description An authenticated administrator can set a configurable security-policy setting to a value exceeding the maximum permitted limit. This allows the associated security control to be rendered...
Rocky Linux 9.6 [TuxCare] Security Update: mariadb / mariadb-backup / mariadb-common / mariadb-devel / etc (ALMALINUX9.6:CLSA-2026:1787212689)
The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787212689 advisory. - In MariaDB server version through 11.8.5, when server audit plugin is enabled with serverauditevents variable configured with QUERYDCL,...
AlmaLinux 9.6 [TuxCare] Security Update: mariadb / mariadb-backup / mariadb-common / mariadb-devel / etc (ALMALINUX9.6:CLSA-2026:1787212689)
The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787212689 advisory. - In MariaDB server version through 11.8.5, when server audit plugin is enabled with serverauditevents variable configured with QUERYDCL,...
CVE-2026-63713
The "search" parameter in the view audit logs feature within the utilities section is susceptible to a time-based blind SQL injection vulnerability...
CVE-2026-63713 Toptech TMS7 and TopHAT SQL Injection
The "search" parameter in the view audit logs feature within the utilities section is susceptible to a time-based blind SQL injection vulnerability...
CVE-2026-63713
The Toptech TMS7 and TopHAT systems are vulnerable to a time-based blind SQL injection vulnerability. This security flaw exists within the "search" parameter of the view audit logs feature, located in the utilities section. Impacting the confidentiality and availability of the system, the vulnera...
CVE-2026-63713 Toptech TMS7 and TopHAT SQL Injection
The "search" parameter in the view audit logs feature within the utilities section is susceptible to a time-based blind SQL injection vulnerability...
CLEANSTART-2026-MZ33445 When audit logging is enabled (zookeeper
Security vulnerability affects the apache-hive package. When audit logging is enabled zookeeper...
Does the Readout Bypass Leak the Input? A Feature-Visibility Audit of Hybrid Quantum-Classical Models
Readout-side residual hybrids concatenate raw inputs with measured quantum features. Under single-example gradient sharing, a biased first linear layer admits standard analytic recovery of its input, so the bypass exposes raw coordinates without requiring inversion of the quantum circuit. We audi...
PT-2026-102898
The "search" parameter in the view audit logs feature within the utilities section is susceptible to a time-based blind SQL injection vulnerability...
CVE-2026-63713: Improper Neutralization of Special Elements used in an SQL Command
The "search" parameter in the view audit logs feature within the utilities section is susceptible to a time-based blind SQL injection vulnerability...
PT-2026-108480
Security vulnerability affects the apache-hive package. When audit logging is enabled zookeeper...
How we found 24 Android vulnerabilities using our open source AI security agent
With the rise of AI in the security space, our team created the GitHub Security Lab Taskflow Agent as a way for security researchers to easily automate, package, and share the AI prompts and workflows that they find effective for their work. In this blog post, I'll share how I created auditing...
Tracekit: Tamper-Evident Intent-Reasoning-Action Auditing for Autonomous Coding Agents
Autonomous coding agents read untrusted files, run shell commands and spawn sub-agents with little supervision, yet their record is usually an editable log. We present Tracekit, an open-source, dependency-free system that captures three channels for every agent session: what the human asked inten...
BIT-AIRFLOW-2026-82355 Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation
When a request to the Airflow core API carries both a session cookie and an explicit Authorization: Bearer token, Airflow resolves the caller from the cookie and ignores the bearer token, inverting the intended precedence of bearer over cookie. The request then executes -- and is recorded in the...
CVE-2026-86066
The HR and CRM software Horilla is vulnerable to a Cross-Site Request Forgery (CSRF) flaw in versions prior to 2.0.0 . The approve_validate_attendance_request function at /attendance/approve-validate-attendance-request/ performs state-changing actions (such as updating attendance_validated and ap...
CVE-2026-85290
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Cron::recur method writes an invalid cron key from the URL path directly to the application log without neutralizing CRLF characters. An unauthenticated requester can...
CVE-2026-85290 InvoicePlane: Log Injection via Unsanitized User Input in Cron Key Error Logging
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Cron::recur method writes an invalid cron key from the URL path directly to the application log without neutralizing CRLF characters. An unauthenticated requester can...
EUVD-2026-87123
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Cron::recur method writes an invalid cron key from the URL path directly to the application log without neutralizing CRLF characters. An unauthenticated requester can...
CVE-2026-85290 InvoicePlane: Log Injection via Unsanitized User Input in Cron Key Error Logging
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Cron::recur method writes an invalid cron key from the URL path directly to the application log without neutralizing CRLF characters. An unauthenticated requester can...