CVE-2026-72175

A flaw was found in the Linux kernel. A race condition exists in the makeuffdwphugepte function, which is responsible for managing large memory pages HugeTLB Page Table Entries. This vulnerability occurs when the system attempts to update these memory entries, but a timing issue allows older,...

EUVD-2026-60952

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings GraphQL paths expose another workspace member's private User data, while...

GO-2026-6233 Openshift Migration Advisor: Improper input sanitization allows specially crafted RVTools .xlsx files to include malicious SQL commands in github.com/kubev2v/migration-planner

Openshift Migration Advisor: Improper input sanitization allows specially crafted RVTools .xlsx files to include malicious SQL commands in github.com/kubev2v/migration-planner...

CVE-2026-23937

The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading to potential loss of data integrity...

CVE-2026-23937

The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading to potential loss of data integrity...

CVE-2026-23937

The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading to potential loss of data integrity...

EUVD-2026-60740

The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading to potential loss of data integrity...

CVE-2026-23937

The Zabbix API host.get action allows authenticated users to extract a host's PSK key. With low privileges and network access, an attacker can compromise the pre-shared key used for TLS connections, enabling potential data integrity attacks (CVSS 6.0 MEDIUM, VI:H). The Zabbix Jira ticket ZBX-2807...

CVE-2026-23937 Host PSK extraction in Zabbix API

The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading to potential loss of data integrity...

CVE-2026-75846

ArcadeDB before 26.8.1 affected versions = 26.7.3 contains a missing authorization vulnerability in the DELETE FUNCTION SQL statement. DeleteFunctionStatement.executeSimple unregisters and persists deletion of a server-side function without any checkPermissionsOnDatabase UPDATESCHEMA check. Any...

libssh security update

An update is available for libssh. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list libssh is a library which implements the SSH protocol. It can be used to...

CVE-2026-75846 ArcadeDB before 26.8.1 Unauthorized Function Deletion via DELETE FUNCTION

ArcadeDB before 26.8.1 affected versions = 26.7.3 contains a missing authorization vulnerability in the DELETE FUNCTION SQL statement. DeleteFunctionStatement.executeSimple unregisters and persists deletion of a server-side function without any checkPermissionsOnDatabase UPDATESCHEMA check. Any...

CVE-2026-75846

ArcadeDB before 26.8.1 affected versions = 26.7.3 contains a missing authorization vulnerability in the DELETE FUNCTION SQL statement. DeleteFunctionStatement.executeSimple unregisters and persists deletion of a server-side function without any checkPermissionsOnDatabase UPDATESCHEMA check. Any...

CVE-2026-75846 ArcadeDB before 26.8.1 Unauthorized Function Deletion via DELETE FUNCTION

ArcadeDB before 26.8.1 affected versions = 26.7.3 contains a missing authorization vulnerability in the DELETE FUNCTION SQL statement. DeleteFunctionStatement.executeSimple unregisters and persists deletion of a server-side function without any checkPermissionsOnDatabase UPDATESCHEMA check. Any...

CVE-2026-75846

In ArcadeDB versions ≤ 26.7.3, DeleteFunctionStatement.executeSimple permanently removes any registered server-side function via the command API without calling checkPermissionsOnDatabase(UPDATE_SCHEMA). Any database user can delete security-relevant logic. Upgrade to 26.8.1. No in-the-wild explo...

LLMs and Contextual Integrity

I have been thinking a lot about AI and integrity. Part of that is contextual integrity. I recently found two papers on the topic. "CIMemories: A Compositional Benchmark for Contextual Integrity of Persistent Memory in LLMs": Abstract: Large Language Models LLMs increasingly use persistent memory...

K000162961: Multiple OpenJDK vulnerabilities

Security Advisory Description CVE-2026-46917 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE: 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM...

PT-2026-77449

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware Oracle Identity Manager Connector version 12.2.1.4.0 Oracle Fusion Middleware Oracle Identity Manager Connector version 14.1.2.1.0 Description A flaw in the Core component allows a low privileged attacker with access t...

PT-2026-77795

Vulnerability in the Oracle SDP Number Portability product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle SDP Number...

PT-2026-77729

Name of the Vulnerable Software and Affected Versions Oracle Hyperion Profitability and Cost Management version 11.2.25.0.000 Description An issue in the Deployment component allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful exploitation can lead...