MariaDB: Stack Buffer Overflow in MariaDB CONNECT storage engine when reading DOUBLE columns from TABLE_TYPE=DOS tables

A stack buffer overflow vulnerability was identified in the CONNECT storage engine. The vulnerability existed in a function that converts character data to double-precision floating-point values. When reading DOUBLE columns from DOS table files, the function copied data into a 64-byte buffer but...

com.arcadedb:arcadedb-bolt (>=26.2.1, <=26.7.2), com.arcadedb:arcadedb-console (>=21.9.1-beta, <=26.7.2) +20 more potentially affected by CVE-2026-67356 via com.arcadedb:arcadedb-engine (>=21.9.1-beta, <=26.7.2)

com.arcadedb:arcadedb-engine MAVEN version =21.9.1-beta, =26.2.1, =21.9.1-beta, =21.9.1-beta, =21.12.1, =21.9.1-beta, =25.9.1, =25.9.1, =25.9.1, =26.4.2, =21.9.1-beta, =25.1.1, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =26.7.2 and more Source cves: CVE-2026-67356 Source advisory:...

com.arcadedb:arcadedb-bolt (>=26.2.1, <=26.7.1), com.arcadedb:arcadedb-console (>=21.9.1-beta, <=26.7.1) +20 more potentially affected by CVE-2026-67340 via com.arcadedb:arcadedb-engine (>=21.9.1-beta, <=26.7.1)

com.arcadedb:arcadedb-engine MAVEN version =21.9.1-beta, =26.2.1, =21.9.1-beta, =21.9.1-beta, =21.12.1, =21.9.1-beta, =25.9.1, =25.9.1, =25.9.1, =26.4.2, =21.9.1-beta, =25.1.1, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =26.7.1 and more Source cves: CVE-2026-67340 Source advisory:...

com.arcadedb:arcadedb-bolt (>=26.2.1, <=26.7.1), com.arcadedb:arcadedb-console (>=21.9.1-beta, <=26.7.1) +20 more potentially affected by CVE-2026-67344 via com.arcadedb:arcadedb-engine (>=21.9.1-beta, <=26.7.1)

com.arcadedb:arcadedb-engine MAVEN version =21.9.1-beta, =26.2.1, =21.9.1-beta, =21.9.1-beta, =21.12.1, =21.9.1-beta, =25.9.1, =25.9.1, =25.9.1, =26.4.2, =21.9.1-beta, =25.1.1, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =26.7.1 and more Source cves: CVE-2026-67344 Source advisory:...

CVE-2026-67340

ArcadeDB before 26.7.2 arcadedb-engine allows trigger scripts to look up host classes in java.lang. via Java.type because ScriptTriggerExecutor adds java.lang. to the allowed packages. An authenticated user with UPDATESCHEMA permission can create a JavaScript trigger that invokes...

com.arcadedb:arcadedb-bolt (>=26.2.1, <=26.7.1), com.arcadedb:arcadedb-console (>=21.9.1-beta, <=26.7.1) +20 more potentially affected by CVE-2026-67341 via com.arcadedb:arcadedb-engine (>=21.9.1-beta, <=26.7.1)

com.arcadedb:arcadedb-engine MAVEN version =21.9.1-beta, =26.2.1, =21.9.1-beta, =21.9.1-beta, =21.12.1, =21.9.1-beta, =25.9.1, =25.9.1, =25.9.1, =26.4.2, =21.9.1-beta, =25.1.1, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =26.7.1 and more Source cves: CVE-2026-67341 Source advisory:...

CVE-2026-15988

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.5 This is due to missing or incorrect nonce validation on the reauthforauthorize function. This makes it possible for...

CVE-2026-15988 AI Engine <= 3.6.5 - Cross-Site Request Forgery to Privilege Escalation via REQUEST_URI Substring Match

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.5 This is due to missing or incorrect nonce validation on the reauthforauthorize function. This makes it possible for...

CVE-2026-15988 AI Engine <= 3.6.5 - Cross-Site Request Forgery to Privilege Escalation via REQUEST_URI Substring Match

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.5 This is due to missing or incorrect nonce validation on the reauthforauthorize function. This makes it possible for...

CVE-2026-15988

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.5 This is due to missing or incorrect nonce validation on the reauthforauthorize function. This makes it possible for...

CVE-2026-15988: Cross-Site Request Forgery (CSRF)

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.5 This is due to missing or incorrect nonce validation on the reauthforauthorize function. This makes it possible for...

CVE-2026-67340: Improper Control of Generation of Code

ArcadeDB before 26.7.2 arcadedb-engine allows trigger scripts to look up host classes in java.lang. via Java.type because ScriptTriggerExecutor adds java.lang. to the allowed packages. An authenticated user with UPDATESCHEMA permission can create a JavaScript trigger that invokes...

PT-2026-67088

Name of the Vulnerable Software and Affected Versions The AI Engine – The Chatbot, AI Framework & MCP for WordPress versions prior to 3.6.6 Description A Cross-Site Request Forgery CSRF issue exists due to missing or incorrect nonce validation in the reauth for authorize function. This allows...

Securekit — Updated!

Securekit Securekit protects what your models execute—across any AI system. Securekit is a protocol-agnostic security kernel for AI tool execution. It sits between any LLM or agent system and the tools they use, enforcing zero-trust execution, sandbox isolation, and policy-driven control. It is...

kernel: net: sched: UAF via missing handler for TC_ACT_CONSUMED in tcf_qevent_handle

A flaw was found in the Linux kernel's traffic control TC classifier application programming interface API. The tcfqeventhandle function does not properly handle a consumed socket buffer skb when it is processed by the defragmentation engine. This can lead to a Use-After-Free UAF vulnerability,...

kernel: net: sched: UAF via missing handler for TC_ACT_CONSUMED in tcf_qevent_handle

A flaw was found in the Linux kernel's traffic control TC classifier application programming interface API. The tcfqeventhandle function does not properly handle a consumed socket buffer skb when it is processed by the defragmentation engine. This can lead to a Use-After-Free UAF vulnerability,...

thumbor-piliptc-engine (>=7.4.7.3, <=7.4.7.4) potentially affected by CVE-2026-53502 via thumbor (7.4.7)

thumbor PYPI version 7.4.7 is affected by a known vulnerability. The following packages have a transitive dependency on thumbor and may be impacted: - thumbor-piliptc-engine =7.4.7.3, =7.4.7.4 Source cves: CVE-2026-53502 Source advisory: GHSA-CJ54-HPCC-GJ6H...

thumbor-piliptc-engine (>=7.4.7.3, <=7.4.7.4) potentially affected by CVE-2026-53502 via thumbor (7.4.7)

thumbor PYPI version 7.4.7 is affected by a known vulnerability. The following packages have a transitive dependency on thumbor and may be impacted: - thumbor-piliptc-engine =7.4.7.3, =7.4.7.4 Source cves: CVE-2026-53502 Source advisory: SNYK:PYTHON-THUMBOR-18507992...

thumbor-piliptc-engine (>=7.4.7.3, <=7.4.7.4) potentially affected by CVE-2026-53502 via thumbor (7.4.7)

thumbor PYPI version 7.4.7 is affected by a known vulnerability. The following packages have a transitive dependency on thumbor and may be impacted: - thumbor-piliptc-engine =7.4.7.3, =7.4.7.4 Source cves: CVE-2026-53502 Source advisory: OSV:GHSA-CJ54-HPCC-GJ6H...

thumbor-piliptc-engine (>=7.4.7.3, <=7.4.7.4) potentially affected by CVE-2026-53502 via thumbor (7.4.7)

thumbor PYPI version 7.4.7 is affected by a known vulnerability. The following packages have a transitive dependency on thumbor and may be impacted: - thumbor-piliptc-engine =7.4.7.3, =7.4.7.4 Source cves: CVE-2026-53502 Source advisory: MEND:CVE-2026-53502...