EUVD-2026-49153

Integer Overflow or Wraparound vulnerability in Apache Thrift C++, cglib, Go, netstd, Delphi and Haxe bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

CVE-2026-48586 Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TZlibTransport Decompression Size Limit

Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

WordPress WP Google Review Slider plugin <= 18.4 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Google Review Slider versions = 18.4...

augustus v0.14.11

Augustus - LLM vulnerability scanner for prompt injection, jailbreak, and adversarial attack testing Augustus - LLM Vulnerability Scanner Test large language models against 210+ adversarial attacks covering prompt injection, jailbreaks, encoding exploits, and data extraction. Augustus is a Go-bas...

BIT-WORDPRESS-MULTISITE-2026-63030 WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the authornotin WPQuery SQL Injection CVE-2026-60137, could allow an attacker to perform SQL Injection and achieve Remote Code Execution...

Important: Red Hat Security Advisory: go-fdo-server security update

An update for go-fdo-server is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

[SECURITY] Fedora 43 Update: libwebsockets-4.5.8-2.fc43

This is the libwebsockets C library for lightweight websocket clients and servers...

[SECURITY] Fedora 44 Update: lego-5.3.1-2.fc44

Let's Encrypt/ACME client written in Go...

PT-2026-64985

A use-after-free UAF vulnerability was discovered in the core parsing component of SQLite 3.41. The flaw occurs because the program frees an ExprList object via sqlite3ExprListDelete and then subsequently accesses the dangling pointer of the released object. A remote adversary can supply speciall...

ALIBI: Adaptive Agentic Attacks on LLM-Based Vulnerability Detectors Via Adversarial Code Comments

Large language models are increasingly deployed for security-sensitive tasks such as vulnerability detection and code review. Their reliance on natural-language context embedded in source code exposes a previously underexplored attack surface: adversarial comments that can influence a detector's...

DeepFaith: Evidence-Grounded LLMs for Faithful Incident Reporting in Multi-Stage APT Defense

Advanced Persistent Threats APTs are difficult to detect and interpret due to their multi-stage and stealthy nature. While recent autonomous defense systems leverage provenance graphs and learning-based models for detection and mitigation, their outputs remain largely machine-oriented and difficu...

PT-2026-64922

Unauthenticated SQL Injection in MapSVG = 8.14.0 versions...

Joern 4.0.589

Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...

ZIMPAF and RedPhuzz: High-Fidelity Web Application Fuzzing Via Branch, Language Construct, and Function Call Monitoring

We present ZIMPAF, runtime interpreter instrumentation, and RedPhuzz, a fuzzer, to address key limitations of state-of-the-art fuzzers: inefficient instrumentation, the lack of knowledge of the execution environment, and limited web domain knowledge. ZIMPAF implements a novel multi-granular runti...

PT-2026-64885

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.24.0 Description An integer overflow or wraparound issue exists in the C++, c glib, Go, netstd, Delphi, and Haxe bindings. The flaw is located in the checkReadBytesAvailable function of the TProtocol class...

Just Testing, Move Along: Evasion of LLM-Based System Log Interpretation by Prompt Injection

Large Language Models LLMs are increasingly integrated into Security Operations Center SOC workflows, where they support analysts in tasks such as the interpretation of system logs. However, the ability of LLMs to directly process untrusted textual input also introduces new attack surfaces. In...

go-fdo-client security update

1.0.0-5 - Rebuild against updated golang...

DarkPrompt

DarkPrompt !CIhttps://github.com/jason-allen-oneal/DarkPr...

CVE-2026-17496

NoteGen before 0.32.0 renders AI chat responses with markdown-it configured with html:true and injects the result into the DOM via dangerouslySetInnerHTML in chat-preview, without HTML sanitization and with CSP set to null. Attacker-controlled content that reaches the model prompt for example a...

[SECURITY] Fedora 44 Update: moby-engine-29.6.2-1.fc44

Docker is an open source project to build, ship and run any application as a lightweight container. Docker containers are both hardware-agnostic and platform-agnostic. This means they can run anywhere, from your laptop to the largest EC2 compute instance a nd everything in between =E2=80=94 and...