CVE-2026-57097

CVE-2026-57097 describes an Untrusted search path in Microsoft XML that allows a physical attacker to bypass a security feature. Affects Microsoft XML; impact is described as high for confidentiality, integrity, and availability with a physical attack requiring no user interaction. No exploit det...

CVE-2026-54118

Microsoft SQL Server (2019, 2022, 2025) is vulnerable to deserialization of untrusted data leading to remote code execution (CVSS 9.8, no authentication required). No in-the-wild exploitation is reported (SSVC: Exploitation none). Microsoft released July 14, 2026 patches: KB5101346 (SQL 2025 CU6)...

CVE-2026-15703

CVE-2026-15703 affects SourceCodester Simple and Nice Shopping Cart Script 1.0. The vulnerability exists in /admin/userproductdeletequery.php where manipulating the user_id parameter enables SQL injection. It can be exploited remotely and the exploit is publicly available. CVSS metrics indicate h...

CVE-2026-60081

The provided data indicate a memory‑consumption risk in DBI::ProfileData prior to version 1.651 for Perl. The issue arises from an unbounded path index in profile dump files, which can be used to allocate an excessively large array and exhaust memory. Affected component: DBI::ProfileData (Perl). ...

Microsoft XML Core Services Elevation of Privilege Vulnerability

Use after free in Microsoft XML Core Services allows an authorized attacker to elevate privileges locally...

Microsoft XML Security Feature Bypass Vulnerability

Untrusted search path in Microsoft XML allows an unauthorized attacker to bypass a security feature with a physical attack...

RLSA-2026:38493 Important: buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a...

podman security update

An update is available for podman. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The podman tool manages pods, container images, and containers. It is part of...

Authentication Bypass

9Router is vulnerable to Authentication Bypass. The vulnerability is due to missing authentication checks for the /codex endpoint, where requests bypass the API key validation before being rewritten to protected API routes, allowing unauthenticated attackers to invoke upstream LLM provider APIs...

CVE-2026-15675

The vulnerability CVE-2026-15675 affects code-projects Online Job Portal 1.0. An unknown function in /Admin/EditUser.php processes the UserId argument, and manipulating it leads to SQL injection. It can be triggered remotely, and a published exploit exists. Impact targets confidentiality, integri...

CVE-2026-15672 itsourcecode Electronic Judging System add_judges.php sql injection

A vulnerability was determined in itsourcecode Electronic Judging System 1.0. Impacted is an unknown function of the file /intrams/admin/addjudges.php. This manipulation of the argument fname causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and m...

CVE-2026-50649

Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally...

ALSA-2026:39553 Important: perl-XML-LibXML security update

This module implements a Perl interface to the GNOME libxml2 library which provides interfaces for parsing and manipulating XML files. This module allows Perl programmers to make use of the highly capable validating XML parser and the high performance DOM implementation. Security Fixes:...

git-lfs security update

3.4.1-12 - Rebuild with new Golang - Resolves: RHEL-187191...

This Week in Spring - July 14th, 2026

This Week in Spring - July 14th, 2026 In two short months, on this date in September, Java 27 will be here! Who's excited? I'm excited! I'm in delightful Denver, CO, for the amazing UberConf. I just delivered a workshop that was scheduled from 09:00 to 17:00, but it went into overtime, and we jus...

CVE-2026-50650

Improper control of generation of code 'code injection' in .NET Framework allows an unauthorized attacker to elevate privileges locally...

AlmaLinux 10 : podman (ALSA-2026:38495)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:38495 advisory. os: golang: Go os.Root: Symlink following vulnerability allows directory traversal CVE-2026-39822 Tenable has extracted the preceding description block directly...

CVE-2026-15597 SourceCodester Class and Exam Timetabling System edit_exam2.php sql injection

A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0/2.php. This affects an unknown function of the file /editexam2.php. Performing a manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit has been release...

CVE-2026-55773 CedarJava has a policy injection vulnerability

CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 2.3.6, 3.4.1 and 4.9.0, under certain circumstances, improper input handling could allow Cedar-expression injection via unescaped toCedarExpr. The...

GHSA-M4M7-4CW8-62J6 DIRAC is vulnerable to RCE in FileCatalog DatasetManager via SQL injection + eval

Summary The FileCatalog DatasetManager runs a query on the database and passes the result to eval. The SQL query contains an injection vulnerability which allows an authenticated user to control the parameter returned to the eval resulting in remote code execution. Details The FileCatalog...