CVE-2026-77360: Improper Neutralization of CRLF Sequences in HTTP Headers

oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.8, the @orpc/server CORS plugin in packages/server/src/plugins/cors.ts copies a client's incoming Vary request header into the response instead of controlling Vary as a response-only...

CVE-2026-86831: Improper Validation of Unsafe Equivalence in Input

Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS Network Policy Agent before v1.4.0 might allow an authenticated remote user to bypass NetworkPolicy enforcement on co-located pods in other namespaces via crafted pod and namespace names that produce pod...

CVE-2026-79993: Missing Authorization

The deleteContainer opcode 0x14/20 is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent. This opcode is considered internal-only and the official clie...

CVE-2026-12910

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user to bypass SAML SSO sign-in restrictions and authenticate without SSO due to missing...

EUVD-2026-79140

On affected platforms running Arista EOS with dual switch cards and with ingress Security ACLs configured on Switched Virtual Interfaces SVI in shared mode, restarting of the secondary switchcard forwarding agent or insertion of secondary switchcard, can cause security ACLs on shared SVIs to stop...

CVE-2026-18115

Concrete CMS versions 9.2.0 through 9.5.2 fail to enforce per-field edit_user_properties permissions on the REST API user write endpoints (PUT /ccm/api/1.0/users/{uID} and POST /ccm/api/1.0/users/{uID}/change_password). An authenticated user holding an update-scoped OAuth token and permission to ...

EUVD-2026-78909

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user to bypass SAML SSO sign-in restrictions and authenticate without SSO due to missing...

CVE-2026-12910

CVE-2026-12910 is a missing authentication enforcement issue in GitLab CE/EE affecting versions from 18.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 . Under certain conditions, an authenticated user could bypass SAML SSO sign-in restrictions and authenticate without SSO due to miss...

prismor v1.51.0

Prismor Runtime security for Claude Code, Codex, Langchain and other AI agents frameworks/harness. Prismor is highly customizable based on user's own policies. Observe or enforce mode to see agent activity in a local self-serve dashboard Website • Onboard with Skill...

crypto/x509: Incorrect enforcement of email constraints in crypto/x509

A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly...

crypto/x509: Incorrect enforcement of email constraints in crypto/x509

A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly...

CLEANSTART-2026-GE74044 source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2...

Multiple security vulnerabilities affect the prometheus-node-exporter-fips package. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. S...

Chromium CVE-2026-87479: Insufficient policy enforcement in Extensions

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

PT-2026-92166

Concrete CMS 9.2.0 to 9.5.2 did not enforce per-field edit user properties permissions on the REST API user write endpoints PUT /ccm/api/1.0/users/uID and POST /ccm/api/1.0/users/uID/change password. A user with an update-scoped OAuth token and permission to edit only one non-sensitive field coul...

PT-2026-92163

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 18.6 through 19.1.7 GitLab CE/EE versions 19.2 through 19.2.5 GitLab CE/EE versions 19.3 through 19.3.1 Description An issue exists where an authenticated user could bypass SAML SSO sign-in restrictions and authenticate...

CVE-2026-77191

An authenticated supplicant on an adjacent network may bypass intended network authorization policy and send unrestricted traffic during a brief window milliseconds to seconds between the completion of the authentication phase and the full enforcement of its assigned ACL...

CVE-2026-75943

A brief milliseconds to seconds traffic leak may occur when an authenticated supplicant is removed, either via the clear dot1x host all CLI command or due to a supplicant timeout. During this window, the supplicant's traffic may pass without ACL enforcement...

AI Agent Security Readiness: The Federal Standard You Should Get Ahead Of

Here's the uncomfortable part first: in August 2026, researchers found AI agents connected to Hugging Face running loose inside enterprise networks. No owner, no audit trail, nobody who could tell you they existed until something broke. If that sentence made your stomach drop a little, good,...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to bypass site isolation via a crafted Chrome Extension. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in the File System API of Google Chrome on Windows prior to version 88.0.4324.96 allowed a remote attacker to bypass filesystem restrictions through a crafted HTML page...