PT-2026-78804

In versions below 2.5.3 of the Azure AD Graph app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive password by invoking the reset password action, because the action's temp password parameter is not masked and is shown in cleartext in the user...

CVE-2026-76377: Cleartext Storage of Sensitive Information

In versions below 2.5.3 of the Azure AD Graph app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive password by invoking the reset password action, because the action's temppassword parameter is not masked and is shown in cleartext in the user...

CTIFoundry: An Agent-Native Corpus Scaffold for Cyber Threat Intelligence

Cyber threat intelligence CTI is increasingly consumed not by human analysts but by LLM agents that compose multi-step investigations at query time. The harness side of this shift has matured rapidly planning loops, tool protocols, context management, but the corpus side has not: threat reports a...

PT-2026-78808

In versions below 1.5.2 of the MS Graph for Active Directory app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive password by invoking the reset password action, because the action's temp password parameter is not masked and is shown in cleartext in...

CVE-2026-76381: Cleartext Storage of Sensitive Information

In versions below 1.5.2 of the MS Graph for Active Directory app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive password by invoking the reset password action, because the action's temppassword parameter is not masked and is shown in cleartext in...

GHSA-7CJ5-V4PP-V632 LibreNMS: Stored XSS via graph_descr admin config settings echoed without escaping to all authenticated users

Summary The graphdescr. family of settings is echoed verbatim without htmlspecialchars in includes/html/pages/graphs.inc.php:194. Any admin can store a malicious HTML payload that executes in every authenticated user's browser viewing that graph type. CVSS...

CVE-2026-74946

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

CVE-2026-74946

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

PT-2026-83378

Summary The graph descr. family of settings is echoed verbatim without htmlspecialchars in includes/html/pages/graphs.inc.php:194. Any admin can store a malicious HTML payload that executes in every authenticated user's browser viewing that graph type. CVSS...

com.gitee.dqhm:emmon-util (1.0.2), org.cqfn:reportwine (0.1) +11 more potentially affected by CVE-2026-53752 via org.docx4j:docx4j-core (8.2.9)

org.docx4j:docx4j-core MAVEN version 8.2.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.docx4j:docx4j-core and may be impacted: - com.gitee.dqhm:emmon-util 1.0.2 - org.cqfn:reportwine 0.1 - org.docx4j:docx4j-conversion-via-microsoft-graph 8.2.9 ...

com.github.paulcwarren:spring-content-docx4j (>=2.1.0, <=2.3.0), org.docx4j:docx4j-conversion-via-microsoft-graph (8.3.4) +9 more potentially affected by CVE-2026-53752 via org.docx4j:docx4j-core (8.3.4)

org.docx4j:docx4j-core MAVEN version 8.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.docx4j:docx4j-core and may be impacted: - com.github.paulcwarren:spring-content-docx4j =2.1.0, =2.3.0 - org.docx4j:docx4j-conversion-via-microsoft-graph 8.3....

com.alanpoi:alanpoi-all (>=1.3.4, <=3.0.0), com.alanpoi:alanpoi-analysis (>=1.3.4, <=3.0.0) +10 more potentially affected by CVE-2026-53752 via org.docx4j:docx4j-core (8.3.0)

org.docx4j:docx4j-core MAVEN version 8.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.docx4j:docx4j-core and may be impacted: - com.alanpoi:alanpoi-all =1.3.4, =1.3.4, =3.0.0 - org.docx4j:docx4j-conversion-via-microsoft-graph 8.3.0 -...

hu.blackbelt.bundles.docx4j:org.docx4j (8.3.14_1), org.docx4j:docx4j-bundle (8.3.14) +11 more potentially affected by CVE-2026-53752 via org.docx4j:docx4j-core (8.3.14)

org.docx4j:docx4j-core MAVEN version 8.3.14 is affected by a known vulnerability. The following packages have a transitive dependency on org.docx4j:docx4j-core and may be impacted: - hu.blackbelt.bundles.docx4j:org.docx4j 8.3.141 - org.docx4j:docx4j-bundle 8.3.14 -...

Uncontrolled Recursion

Overview deepmerge-ts is a Deeply merge 2 or more objects respecting type information. Affected versions of this package are vulnerable to Uncontrolled Recursion via the deepmerge and deepmergeInto functions. An attacker can cause a process crash or denial of service by supplying crafted recursiv...

GHSA-GGR8-5VV4-36MX DeepmergeTS has stack exhaustion when merging recursive object graphs

Summary deepmerge and deepmergeInto can be crashed with a crafted recursive object graph. When both merged values contain self-references at the same property path, the library recurses until Node throws RangeError: Maximum call stack size exceeded. Details Record merging is implemented...

PT-2026-73379

An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the $graphLookup aggregation stage is evaluated during authorization and during execution. Affected scenarios involve collections...

slater v0.25.1

Slater Current version:v0.25.2 — all releases. In one line: Slater serves graphs that don't fit in memory — hundreds of millions of nodes and billions of edges in low hundreds of MB of RAM — over standard Bolt , so any neo4j driver just works, with disk-native vector search sitting next to the...

CVE-2026-72385

In the Linux kernel, the following vulnerability has been resolved: tracing/fprobe: Fix NULL pointer dereference in fprobefgraphentry fprobefgraphentry sizes a shadow-stack reservation in one walk of the per-ip fprobe list and fills it in a second walk, both under rcureadlock only. A fprobe...

aquila-graph-poc

Aquila Graph POC A reproducible proof of concept for combinin...

Pre-Model Representation Failures in GNN-Based Smart Contract Vulnerability Detection

This paper is a failure analysis of the representation layer underlying GNN-based smart contract vulnerability detectors. These systems convert source code into graphs before any learning takes place; if the graph fails to capture the code's semantics, no model improvement can compensate. We...