CVE-2026-66782: Improper Privilege Management

A flaw was found in the Submariner operator. This vulnerability allows for the exposure of a long-lived broker service account SA bearer token within the Submariner Custom Resource CR specification. An attacker with access to the cluster's etcd database or through kubectl get commands could obtai...

PT-2026-76944

ArcadeDB versions before 26.8.1 contain a server-side request forgery vulnerability in the IMPORT DATABASE command where the security validator resolves and checks hostnames but the subsequent connection re-resolves the raw URL and follows redirects. Authenticated attackers can bypass the validat...

PT-2026-76952

ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database and drop database commands, allowing authenticated root users to write and delete arbitrary files outside the configured database directory. Attackers can supply database names...

ROS-20260818-73-0033

The vulnerability in Mariadb is related to the incorrect assignment of privileges. Exploiting this vulnerability can allow attackers to enhance their privileges...

ROS-20260818-73-0034

A vulnerability in Mariadb 10.6 is related to incorrect privilege assignment. Exploiting this vulnerability can allow an attacker to enhance their privileges...

ROS-20260818-73-0035

A vulnerability in Mariadb 11.4 is related to incorrect privilege assignment. Exploiting this vulnerability can allow an attacker to enhance their privileges...

ROS-20260818-73-0028

The vulnerability in Mariadb 11.8 is related to the failure to take measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

GHSA-3P64-6GVH-82V5

creationtimestamp| type| source ---|---|--- 2026-08-17 23:31:40+00:00| seen| https://gist.github.com/alon710/bb0c1f0112166e936833a909d435a77a 2026-08-18 00:01:16+00:00| seen| https://gist.github.com/alon710/bb0c1f0112166e936833a909d435a77a...

CVE-2026-65822 ERPNext: SQL Injection in "Inactive Customers" report via unvalidated `doctype` filter

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.116.0 and 16.23.0, erpnext/selling/report/inactivecustomers/inactivecustomers.py accepts an unvalidated doctype filter and interpolates it into raw SQL in getsalesdetails and getlastsalesamt, allowing an authenticate...

SUSE-SU-2026:23204-1 Security update for rpm

This update for rpm fixes the following issue: - CVE-2026-44605: heap buffer overflow in NDB database backend due to unchecked 32-bit arithmetic when parsing the slot table bsc1269584...

Information Exposure

Overview openssl-encrypt is an A package for secure file encryption and decryption based on modern ciphers using heavy-compute-load chaining of hashing and KDF to generate strong encryption password based on users provided password to ensure secure encryption of files Affected versions of this...

Use of Hard-coded Credentials

Overview openssl-encrypt is an A package for secure file encryption and decryption based on modern ciphers using heavy-compute-load chaining of hashing and KDF to generate strong encryption password based on users provided password to ensure secure encryption of files Affected versions of this...

EUVD-2026-60244

In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download database backups via shared draft signature...

CVE-2026-75045

In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download database backups via shared draft signature...

CVE-2026-75045

In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download database backups via shared draft signature...

CVE-2026-75045

In JetBrains YouTrack versions before 2025.3.156085, 2026.1.13913, and 2026.2.18112, an unauthenticated attacker can download database backups via a shared draft signature, yielding CVSS 9.1 (CRITICAL) with high confidentiality and integrity impact. Exploitation details are not provided; affected...

sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5

A flaw was found in SQLite, specifically within its FTS5 full-text search extension. Attackers can exploit a heap-based buffer overflow by providing a specially crafted database. This crafted database contains malicious metadata that triggers an integer underflow during FTS5 MATCH query processin...

GHSA-P3GQ-PCG9-QVFV

creationtimestamp| type| source ---|---|--- 2026-08-17 13:48:35+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mtbtqn42ra2c...

CVE-2026-75004

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper rule name quoting could lead to managesievedisabledactions setting bypass via a crafted rule name in a Sieve script. This issue only affects Roundcube instances using the managesieve plugin...

sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5

A flaw was found in SQLite, specifically within its FTS5 full-text search extension. Attackers can exploit a heap-based buffer overflow by providing a specially crafted database. This crafted database contains malicious metadata that triggers an integer underflow during FTS5 MATCH query processin...