CVE-2026-82631: Use After Free

A security flaw has been discovered in valkey-io valkey 9.1.0. The affected element is the function handleClientsBlockedOnKey of the file src/blocked.c of the component Blocked-on-keys Subsystem. The manipulation results in use after free. The attack may be performed from remote. A high complexit...

Linux Distros Unpatched Vulnerability : CVE-2026-82631

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A security flaw has been discovered in valkey-io valkey 9.1.0. The affected element is the function handleClientsBlockedOnKey of the file src/blocked.c of the...

CVE-2026-82640 browser-use web-ui 2.0.0 through 3.0.0 Cleartext API Key Storage

browser-use web-ui versions 2.0.0 through 3.0.0 write configured LLM API keys to disk in cleartext without encryption or access restrictions. Attackers with read access to the temporary settings directory can recover provider API keys from predictably-named JSON files...

YellowKey-Bitlocker-CVE-2026-45585

🛡️ YellowKey-Bitlocker-CVE-2026-45585 - Recover Your BitLocker Keys Safely 📋 What This Software Does YellowKey is a free open-source utility for Windows 10 and Windows 11. It helps you extract, backup, and view your BitLocker recovery keys. This is useful if you lost access to your encrypted drive...

CVE-2026-82652: Exposure of Resource to Wrong Sphere

SiYuan before v3.8.1 fails to filter invisible-tier content from SQL embed blocks, attribute-view keys, and attribute-view backlinks in publish mode. Anonymous readers can enumerate invisible content through these three listing mechanisms despite admin configuration marking content unlisted...

PT-2026-83560

browser-use web-ui versions 2.0.0 through 3.0.0 write configured LLM API keys to disk in cleartext without encryption or access restrictions. Attackers with read access to the temporary settings directory can recover provider API keys from predictably-named JSON files...

CVE-2026-82641: Missing Authentication for Critical Function

Keploy versions 3.1.0 through 3.6.25, fixed in 3.6.26, bind the agent control-plane HTTP server to all interfaces without authentication, exposing endpoints that stream TLS session keys and traffic data. Attackers can access the /agent/pcap/keylog endpoint to retrieve NSS keylog lines and decrypt...

CVE-2026-82640: Cleartext Storage of Sensitive Information

browser-use web-ui versions 2.0.0 through 3.0.0 write configured LLM API keys to disk in cleartext without encryption or access restrictions. Attackers with read access to the temporary settings directory can recover provider API keys from predictably-named JSON files...

CVE-2026-82562 qs.parse does not enforce arrayLimit on comma groups under bracket-push keys when throwOnLimitExceeded is set (incomplete fix for CVE-2026-2391)

Summary When qs.parse is called with comma: true and throwOnLimitExceeded: true, a comma-separated value under a bracket-push key a=1,2,3,4 is split into an array without being compared against arrayLimit, while the same value under a flat key a=1,2,3,4, an indexed key a0=, a nested key ab=, or a...

CVE-2026-82562 qs.parse does not enforce arrayLimit on comma groups under bracket-push keys when throwOnLimitExceeded is set (incomplete fix for CVE-2026-2391)

Summary When qs.parse is called with comma: true and throwOnLimitExceeded: true, a comma-separated value under a bracket-push key a=1,2,3,4 is split into an array without being compared against arrayLimit, while the same value under a flat key a=1,2,3,4, an indexed key a0=, a nested key ab=, or a...

CVE-2026-81849

Improper limitation of a pathname to a restricted directory in the aws:downloadContent plugin in amazon-ssm-agent before 3.3.4515.0 might allow an authenticated remote user whose ssm:SendCommand permission is restricted to the AWS-DownloadContent document, to write arbitrary files outside the...

CVE-2026-51634

Incorrect access control in the getWiFiBasicCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain core wireless settings, including SSIDs and Wi-Fi keys, via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51625

Incorrect access control in the getWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain sensitive information such as SSIDs and Wi-Fi keys, via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51617

Incorrect access control in the getSysStatusCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain sensitive information such as operation mode, firmware version, serial number, WAN/LAN IP addresses, WiFi SSID, encryption keys, and connected client statistics...

CVE-2026-81849

amazon-ssm-agent prior to version 3.3.4515.0 contains a path traversal vulnerability in its aws:downloadContent plugin. The root cause is an improper limitation of a pathname to a restricted directory, allowing an authenticated remote user with restricted ssm:SendCommand permission (limited to th...

CVE-2026-81849 Path traversal in the aws:downloadContent plugin in amazon-ssm-agent

Improper limitation of a pathname to a restricted directory in the aws:downloadContent plugin in amazon-ssm-agent before 3.3.4515.0 might allow an authenticated remote user whose ssm:SendCommand permission is restricted to the AWS-DownloadContent document, to write arbitrary files outside the...

SUSE CVE-2026-14457

Issue summary: In a server or client configuration with RFC7250 Raw Public Keys RPKs enabled, and only the private key with no associated certificate configured locally, a NULL pointer dereference may occur when the remote peer solicits raw public keys and also sends the typically omitted...

Malicious code in 3layerdipstackcbatl4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a30def8fc50c8441045d1cfd0336be80147068e7396f8acac04c34d24971b9d The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Chromium: CVE-2026-79108 UI misrepresentation in Web Authentication (Passkeys & Security Keys)

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium: CVE-2026-79178 Incorrect authorization in Web Authentication (Passkeys & Security Keys)

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...