CVE-2026-57495 AgenticMail: Unauthenticated inbound mail triggers bypassPermissions resume of the operator's Claude Code session (bridge-wake)

AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/claudecode prior to version 0.2.39, @agenticmail/codex prior to version 0.1.33, @agenticmail/core prior to version 0.9.43, and @agenticmail/openclaw prior to version 0.5.71, two inbound-mail handlers act on a...

CVE-2026-57852

Grav CMS scheduler-webhook plugin contains an authentication bypass vulnerability that allows unauthenticated remote attackers to trigger configured scheduled jobs by exploiting a short-circuit logic flaw in the webhook token validation. Attackers can send a single unauthenticated POST request to...

Important: Red Hat Security Advisory: RHTAS 1.3.6 - Red Hat Trusted Artifact Signer Release

The 1.3.6 release of Red Hat Trusted Artifact Signer OpenShift Operator. For more details please visit the product documentation at https://access.redhat.com/documentation/en-us/redhattrustedartifactsigner/1.3 The RHTAS Operator can be used with OpenShift Container Platform 4.16, 4.17, 4.18, 4.19...

Important: Red Hat Security Advisory: Red Hat Web Terminal Operator 1.13.0 release.

Red Hat Web Terminal Operator 1.13.0 has been released. The Web Terminal provides a way to access a fully in-browser terminal emulator within the OpenShift Console. Command-line tools for interacting with the OpenShift cluster are pre-installed...

Important: Red Hat Security Advisory: Red Hat Web Terminal Operator 1.15.1 release.

Red Hat Web Terminal Operator 1.15.1 has been released. The Web Terminal provides a way to access a fully in-browser terminal emulator within the OpenShift Console. Command-line tools for interacting with the OpenShift cluster are pre-installed...

Important: Red Hat Security Advisory: Red Hat Web Terminal Operator 1.12.1 release.

Red Hat Web Terminal Operator 1.12.1 has been released. The Web Terminal provides a way to access a fully in-browser terminal emulator within the OpenShift Console. Command-line tools for interacting with the OpenShift cluster are pre-installed...

Important: Red Hat Security Advisory: Red Hat Web Terminal Operator 1.11.1 release.

Red Hat Web Terminal Operator 1.11.1 has been released. The Web Terminal provides a way to access a fully in-browser terminal emulator within the OpenShift Console. Command-line tools for interacting with the OpenShift cluster are pre-installed...

CVE-2026-63737

SurrealDB versions before 3.1.5 contain a denial of service vulnerability where authenticated users can crash the server with queries containing long chains of operators. Attackers can submit queries with tens of thousands of chained operators that create unbounded expression trees, causing stack...

CVE-2026-63737

SurrealDB versions before 3.1.5 contain a denial of service vulnerability where authenticated users can crash the server with queries containing long chains of operators. Attackers can submit queries with tens of thousands of chained operators that create unbounded expression trees, causing stack...

CVE-2026-63737

CVE-2026-63737 affects SurrealDB versions before 3.1.5. Authenticated users can trigger a denial-of-service by submitting queries with extremely long chains of operators, which create unbounded expression trees and cause a stack overflow during query processing, aborting the server. The vulnerabi...

CVE-2026-63737 SurrealDB before 3.1.5 Denial of Service via deep operator chains

SurrealDB versions before 3.1.5 contain a denial of service vulnerability where authenticated users can crash the server with queries containing long chains of operators. Attackers can submit queries with tens of thousands of chained operators that create unbounded expression trees, causing stack...

CVE-2026-63737 SurrealDB before 3.1.5 Denial of Service via deep operator chains

SurrealDB versions before 3.1.5 contain a denial of service vulnerability where authenticated users can crash the server with queries containing long chains of operators. Attackers can submit queries with tens of thousands of chained operators that create unbounded expression trees, causing stack...

EUVD-2026-45908

SurrealDB versions before 3.1.5 contain a denial of service vulnerability where authenticated users can crash the server with queries containing long chains of operators. Attackers can submit queries with tens of thousands of chained operators that create unbounded expression trees, causing stack...

CVE-2026-6656

Crypt::Password versions through 0.28 for Perl are susceptible to timing attacks. The checkpassword method uses the built-in eq operator. This allows discrepancies in timing to be used to guess the underlying hash...

PT-2026-61553

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 3.1.5 Description Authenticated users can cause a denial of service by submitting queries containing long chains of operators. This occurs when tens of thousands of chained operators create unbounded expression tree...

PT-2026-61535

Crypt::Password versions through 0.28 for Perl are susceptible to timing attacks. The check password method uses the built-in eq operator. This allows discrepancies in timing to be used to guess the underlying hash...

CVE-2026-6656: Observable Timing Discrepancy

Crypt::Password versions through 0.28 for Perl are susceptible to timing attacks. The checkpassword method uses the built-in eq operator. This allows discrepancies in timing to be used to guess the underlying hash...

CVE-2026-56742 vulnerabilities

Vulnerabilities for packages: cilium, kubescape-operator-fips, kubescape-operator, hubble-ui-backend-fips, hubble, kubescape-server-fips, kubescape, hubble-ui, kubescape-server, hubble-fips...

Authentication Bypass

netlicensing-mcp is vulnerable to Authentication Bypass. The vulnerability is due to the API key middleware failing to enforce authentication and falling back to the server operator's API key, which allows an unauthenticated attacker to invoke privileged MCP operations under the operator's identi...

GO-2026-5998 open-feature-operator: Cross-namespace FeatureFlagSource and InProcessConfiguration resolution exposes spec contents on multi-tenant clusters in github.com/open-feature/open-feature-operator

open-feature-operator: Cross-namespace FeatureFlagSource and InProcessConfiguration resolution exposes spec contents on multi-tenant clusters in github.com/open-feature/open-feature-operator...