curl: curl: Insecure connection establishment due to TLS configuration mismatch

A flaw was found in curl. When a new data transfer attempts to upgrade its connection using STARTTLS, it may incorrectly reuse an existing live connection. This reuse can occur even if the Transport Layer Security TLS configuration of the new transfer does not match the existing connection,...

Self-Evolving Defense: Continual Security Policy Learning for LLM Agents

Large language models LLMs increasingly power agents that access sensitive information, use external tools, and modify software repositories. Although these capabilities offer substantial benefits, they also create security risks such as jailbreaks, prompt injection, and vulnerable code generatio...

CVE-2025-71424 Edgeless Systems Contrast before 1.9.1 Insecure Volume Mount

Contrast, Edgeless Systems' runtime for confidential containers on Kubernetes, is affected in versions up to and including 1.9.0. The VOLUME directive in a Dockerfile config.volumes in the OCI image configuration is only a hint and is not handled specially by Kubernetes, but containerd adds a mou...

CVE-2025-71424 Edgeless Systems Contrast before 1.9.1 Insecure Volume Mount

Contrast, Edgeless Systems' runtime for confidential containers on Kubernetes, is affected in versions up to and including 1.9.0. The VOLUME directive in a Dockerfile config.volumes in the OCI image configuration is only a hint and is not handled specially by Kubernetes, but containerd adds a mou...

CVE-2025-71424

Edgeless Systems Contrast versions up to and including 1.9.0 are vulnerable to an insecure volume mount issue. In bare-metal deployments, the containerd runtime adds a mount point for VOLUME directives defined in a Dockerfile when Kubernetes sets none. This allows an untrusted host to write arbit...

CVE-2026-100626

capgo through 12.128.2 contains an insecure direct object reference vulnerability in the PUT /app/:appId endpoint that accepts attacker-controlled icon storage paths. Authenticated users can supply arbitrary paths in the private images bucket and obtain service-role-signed URLs valid for 7 days t...

EUVD-2026-87770

capgo through 12.128.2 contains an insecure direct object reference vulnerability in the PUT /app/:appId endpoint that accepts attacker-controlled icon storage paths. Authenticated users can supply arbitrary paths in the private images bucket and obtain service-role-signed URLs valid for 7 days t...

CVE-2026-100626

Versions of capgo through 12.128.2 are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability in the PUT /app/:appId endpoint. The root cause is that the endpoint accepts attacker-controlled icon storage paths . This allows authenticated users to provide arbitrary paths in the pri...

CVE-2026-100609 Flowise through 3.1.4 Insecure Direct Object Reference via Credential

Flowise npm packages flowise and flowise-components through 3.1.4 looks up credentials by ID without filtering on the requesting user's workspace findOneBy id: credentialId with no workspaceId condition in several code paths: getAllOpenaiAssistants/getSingleOpenaiAssistant GET...

CVE-2026-100609 Flowise through 3.1.4 Insecure Direct Object Reference via Credential

Flowise npm packages flowise and flowise-components through 3.1.4 looks up credentials by ID without filtering on the requesting user's workspace findOneBy id: credentialId with no workspaceId condition in several code paths: getAllOpenaiAssistants/getSingleOpenaiAssistant GET...

CVE-2026-100609 Flowise through 3.1.4 Insecure Direct Object Reference via Credential

Flowise npm packages flowise and flowise-components through 3.1.4 looks up credentials by ID without filtering on the requesting user's workspace findOneBy id: credentialId with no workspaceId condition in several code paths: getAllOpenaiAssistants/getSingleOpenaiAssistant GET...

EUVD-2026-87362

Horilla is an HR and CRM software. In 1.5.0-85 and earlier, payroll/views/componentviews.py does not consistently authorize access in allowancesdeductionstab, viewsingleallowance, and viewsinglededuction before loading records selected by empid, allowanceid, or deductionid. An authenticated...

CVE-2026-84862

IBM Guardium Data Protection 12.2 is vulnerable to insecure deserialization in the Quartz JDBC job store. An authenticated attacker could exploit this vulnerability to execute arbitrary code on the affected system...

CVE-2026-84862 IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2 is vulnerable to insecure deserialization in the Quartz JDBC job store. An authenticated attacker could exploit this vulnerability to execute arbitrary code on the affected system...

CVE-2026-84862 IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2 is vulnerable to insecure deserialization in the Quartz JDBC job store. An authenticated attacker could exploit this vulnerability to execute arbitrary code on the affected system...

EUVD-2026-87106

IBM Guardium Data Protection 12.2 is vulnerable to insecure deserialization in the Quartz JDBC job store. An authenticated attacker could exploit this vulnerability to execute arbitrary code on the affected system...

CVE-2026-84862

IBM Guardium Data Protection 12.2 is vulnerable to insecure deserialization within the Quartz JDBC job store (CWE-502). An authenticated attacker could exploit this flaw to execute arbitrary code on the affected system. IBM has addressed this vulnerability in an update; customers are encouraged t...

CVE-2026-96804

A flaw was found in MLflow. The statsmodel component of MLflow fails to enforce a security control that prevents insecure deserialization during model loading. This allows a remote attacker to execute arbitrary code by submitting a specially crafted MLmodel artifact. This vulnerability can lead t...

CVE-2026-97898

Insecure Direct Object Reference / missing object-level authorization in the Akia keyless entry cloud service. The unlock action is relying on a client-supplied room/door identifier that is not properly authorized server-side against the authenticated guest's booking. An authenticated guest could...

EUVD-2026-86829

Insecure Direct Object Reference / missing object-level authorization in the Akia keyless entry cloud service. The unlock action is relying on a client-supplied room/door identifier that is not properly authorized server-side against the authenticated guest's booking. An authenticated guest could...