GHSA-8GQ3-VP5J-2GRP

creationtimestamp| type| source ---|---|--- 2026-08-22 01:32:06+00:00| seen| https://gist.github.com/alon710/1b32b1920b2d1520540a780d7d0490bd...

GHSA-2943-5XFG-GQ5F

creationtimestamp| type| source ---|---|--- 2026-08-21 21:32:06+00:00| seen| https://gist.github.com/alon710/c3aaed90ea510257bc4b82da4dd81787...

MINI-H7RG-WV6V-MJFP

Bulletin has no description...

CGA-FR89-RM6F-PMG5

Bulletin has no description...

GHSA-8CFW-PCWH-V63W

creationtimestamp| type| source ---|---|--- 2026-08-21 19:32:14+00:00| seen| https://gist.github.com/alon710/5476f02ee350d0dd102b681b35e1425f...

CVE-2026-48752

Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image or instance backup can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Version 7.2.0 patches the issue...

ECHO-37EC-7E98-5F4F

Bulletin has no description...

CVE-2026-48756

Incus is a system container and virtual machine manager. Prior to version 7.1.0, backend.CreateCustomVolumeFromBackup in internal/server/storage/backend.go contains an unguarded time.Time dereference on the ExpiresAt field of every volume-snapshot entry in an imported custom-volume backup. An...

CGA-7QJV-JH75-HCJ9

Bulletin has no description...

MINI-RFG4-62MF-J62H

Bulletin has no description...

CVE-2026-74018

creationtimestamp| type| source ---|---|--- 2026-08-20 14:09:48+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtjgdd73qh2t 2026-08-20 14:20:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtjgvo56pl2u...

cve-2026-47849 - HIGH - Spring Data REST allows mutation of identifier and version properties via JSON Patch

cve-2026-47849 - HIGH - Spring Data REST allows mutation of identifier and version properties via JSON Patch...

CVE-2026-76240

stigmem-node 0.9.0a1 interpolates Postgres backend schema identifiers into SQL strings without defensive quoting. In the affected code path the schema value is operator-controlled, but the unsafe pattern could allow SQL injection if a schema name were derived from tenant, request, or user input...

CVE-2026-76240 stigmem Postgres SQL Injection via Schema Identifier

stigmem-node 0.9.0a1 interpolates Postgres backend schema identifiers into SQL strings without defensive quoting. In the affected code path the schema value is operator-controlled, but the unsafe pattern could allow SQL injection if a schema name were derived from tenant, request, or user input...

CVE-2026-76240

stigmem-node 0.9.0a1 contains a SQL injection vulnerability in its Postgres backend. Schema identifiers are interpolated into SQL strings without defensive quoting. In the affected code path the schema value is operator-controlled, but the unsafe pattern could allow SQL injection if a schema name...

CVE-2026-76240 stigmem Postgres SQL Injection via Schema Identifier

stigmem-node 0.9.0a1 interpolates Postgres backend schema identifiers into SQL strings without defensive quoting. In the affected code path the schema value is operator-controlled, but the unsafe pattern could allow SQL injection if a schema name were derived from tenant, request, or user input...

BIT-KIBANA-2026-72680 Authorization Bypass Through User-Controlled Key in Kibana Agent Builder Leading to Unauthorized Data Modification

Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership check on that identifier does not distinguish between a conversation that does not exist and one that exists but belongs to another user. As a result, an...

BIT-ELK-2026-72680 Authorization Bypass Through User-Controlled Key in Kibana Agent Builder Leading to Unauthorized Data Modification

Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership check on that identifier does not distinguish between a conversation that does not exist and one that exists but belongs to another user. As a result, an...

BIT-ELASTICSEARCH-2026-72687 Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service

A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small request containing a forged opaque identifier. Elasticsearch decodes and deserializes the identifier before confirming that it was legitimately issued by the cluster, and a size value carried inside the...

CVE-2026-70980

creationtimestamp| type| source ---|---|--- 2026-08-19 07:40:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtga3iytc32e 2026-08-19 16:47:54+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10 2026-08-26 00:37:07+00:00| seen|...