python: Python/Expat: Denial of Service via crafted XML document

A flaw was found in the python and expat components. Insufficient entropy in the hash-flooding protection mechanism of xml.parsers.expat and xml.etree.ElementTree allows a remote attacker to craft a malicious XML document. This crafted document can trigger a hash flooding attack, leading to a...

postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow

A flaw was found in PostgreSQL. A heap buffer overflow vulnerability exists in the plperl component when returning a tied hash. This allows a function owner to execute arbitrary code as the operating system user running the database by providing a specially crafted function body. This could lead ...

CVE-2026-89787

In the Linux kernel, the following vulnerability has been resolved: ext4: check dir entry fits before reading the hash trailer in ext4searchdir For casefolded encrypted directories ext4 stores an 8-byte hash trailer after the name EXT4DIRENTHASHES, at an offset derived from de-namelen. On the...

AZL-101439 CVE-2026-89787 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ext4: check dir entry fits before reading the hash trailer in ext4searchdir For casefolded encrypted directories ext4 stores an 8-byte hash trailer after the name EXT4DIRENTHASHES, at an offset derived from de-namelen. On the...

UBUNTU-CVE-2026-89787

In the Linux kernel, the following vulnerability has been resolved: ext4: check dir entry fits before reading the hash trailer in ext4searchdir For casefolded encrypted directories ext4 stores an 8-byte hash trailer after the name EXT4DIRENTHASHES, at an offset derived from de-namelen. On the...

CVE-2026-89787 ext4: check dir entry fits before reading the hash trailer in ext4_search_dir()

In the Linux kernel, the following vulnerability has been resolved: ext4: check dir entry fits before reading the hash trailer in ext4searchdir For casefolded encrypted directories ext4 stores an 8-byte hash trailer after the name EXT4DIRENTHASHES, at an offset derived from de-namelen. On the...

EUVD-2026-80308

In the Linux kernel, the following vulnerability has been resolved: ext4: check dir entry fits before reading the hash trailer in ext4searchdir For casefolded encrypted directories ext4 stores an 8-byte hash trailer after the name EXT4DIRENTHASHES, at an offset derived from de-namelen. On the...

CVE-2026-27553

A low-privileged remote attacker can manipulate the schema path parameter in the /index.php/diagnosticstab/ajaxdiagtablerows endpoint using a valid user cookie allowing disclosure of all user password hashes...

PT-2026-93630

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the validate hash algo function where the return value of dentry path is not properly validated. When a path exceeds the buffer, dentry path returns an ERR PTR...

CVE-2026-92578: Improper Authentication

WWBN AVideo through 29.0 contains an authentication bypass vulnerability where the stored password hash is accepted as a valid login credential through two independent code paths in loginFromRequest and encryptPasswordVerify. Attackers who obtain the stored users.password hash value can...

Linux Distros Unpatched Vulnerability : CVE-2026-44793

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Open Access Management OpenAM is an access management solution. Prior to 16.1.1, certain federation endpoints in a non-default clustered configuration...

PT-2026-94133

New CVE published: CVE-2026-71548 Sometimes you don't need to break the syntax, just go with it 🎯 Authenticated SQL injection in SuiteCRM's AOR Reports module High, CVSS 8.8. Any low-privileged user who can save a report could read the whole database, including the admin password hash. Fixed in...

SUSE SLES12 Security Update : kernel (Live Patch 86 for SUSE Linux Enterprise 12 SP5) (SUSE-SU-2026:4192-1)

The remote SUSE Linux SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:4192-1 advisory. This update for the SUSE Linux Enterprise Kernel 4.12.14-122.323 fixes one security issue: The following security issue was fixed: - CVE-2026-64423:...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in immutable

Summary IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in immutable Vulnerability Details CVEID:CVE-2026-59879 DESCRIPTION: Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, Listset, ListsetSize, ListsetIn, ListupdateIn, and the...

Duplicate Advisory: Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-qfwc-vx6f-3g6g. This link is maintained to preserve external references. Original Description Vikunja before 2.6.0 fails to properly restrict access to the link-share hash field in single-share read endpoints,...

CVE-2026-46488 motionEye: Authentication possible via password hash

motionEye mEye is an online interface for a piece of software called "motion," which is a video surveillance program with motion detection. Prior to 0.44.0, motionEye accepts the client-controlled meyeusername and meyepasswordhash cookies as authentication material without server-side session...

CVE-2026-91985

Vikunja before 2.6.0 fails to properly restrict access to the link-share hash field in single-share read endpoints, allowing read-only members to obtain the share's secret credential. Attackers can exchange the disclosed hash for a link-share JWT at the share's permission level to escalate...

CVE-2026-91985 Vikunja before 2.6.0 Privilege Escalation via Link Share Hash

Vikunja before 2.6.0 fails to properly restrict access to the link-share hash field in single-share read endpoints, allowing read-only members to obtain the share's secret credential. Attackers can exchange the disclosed hash for a link-share JWT at the share's permission level to escalate...

CVE-2026-91985 Vikunja before 2.6.0 Privilege Escalation via Link Share Hash

Vikunja before 2.6.0 fails to properly restrict access to the link-share hash field in single-share read endpoints, allowing read-only members to obtain the share's secret credential. Attackers can exchange the disclosed hash for a link-share JWT at the share's permission level to escalate...

CVE-2026-91985

Vikunja before 2.6.0 contains an access-control flaw in its single-share read endpoints: the link-share hash field is not properly restricted, allowing read-only members to obtain the share's secret credential. An attacker can then exchange that hash for a link-share JWT at the share's permission...