postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module

A flaw was found in PostgreSQL. A type confusion vulnerability in the 'refint' module allows an object creator to execute arbitrary code as the operating system user running the database. This could lead to a complete compromise of the database server...

CVE-2026-101899

creationtimestamp| type| source ---|---|--- 2026-09-16 09:03:23+00:00| published-proof-of-concept| https://github.com/axios/axios/security/advisories/GHSA-44g4-m2mj-wpvx...

Security Bulletin: A vulnerability in logback-core-1.3.14.jar found in IBM Devops Code ClearCase

Summary A vulnerability in logback-core-1.3.14.jar found in IBM Devops Code ClearCase CVE-2026-9828 Vulnerability Details CVEID:CVE-2026-9828 DESCRIPTION: Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core HardenedObjectInputStream logback-core modules allows Obje...

CVE-2026-89063

The Bookly WordPress plugin (Online Scheduling and Appointment Booking System) is vulnerable to an Insecure Direct Object Reference (IDOR) via the conversation_id parameter in all versions up to and including 28.1 . Due to missing validation on this user-controlled key, unauthenticated attackers ...

CVE-2026-92217

A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This affects the function processMessages of the file renderers/webcore/src/v09/processing/message-processor.ts of the component Message Parsing. This manipulation causes dynamically-determined object attributes. The attack can be...

EUVD-2026-80080

A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This affects the function processMessages of the file renderers/webcore/src/v09/processing/message-processor.ts of the component Message Parsing. This manipulation causes dynamically-determined object attributes. The attack can be...

CVE-2026-92217 a2ui-project a2ui Message Parsing message-processor.ts processMessages dynamically-determined object attributes

A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This affects the function processMessages of the file renderers/webcore/src/v09/processing/message-processor.ts of the component Message Parsing. This manipulation causes dynamically-determined object attributes. The attack can be...

CVE-2026-92217

a2ui-project a2ui versions up to 0.10.6 are affected by a vulnerability in the Message Parsing component, specifically the processMessages function in renderers/web_core/src/v0_9/processing/message-processor.ts. The root cause is dynamically-determined object attributes during message processing....

CVE-2026-92217 a2ui-project a2ui Message Parsing message-processor.ts processMessages dynamically-determined object attributes

A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This affects the function processMessages of the file renderers/webcore/src/v09/processing/message-processor.ts of the component Message Parsing. This manipulation causes dynamically-determined object attributes. The attack can be...

[SECURITY] Fedora 45 Update: ruby-4.0.6-38.fc45

Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks as in Perl. It is simple, straight-forward, and extensible...

WordPress Blog2Social: Social Media Auto Post & Scheduler plugin <= 9.0.0 - Insecure Direct Object Reference vulnerability

Insecure Direct Object Reference vulnerability discovered by Choriyev Qahramon in WordPress Plugin Blog2Social versions = 9.0.0...

PT-2026-93256

Name of the Vulnerable Software and Affected Versions a2ui versions prior to 0.10.7 Description A remote attack can be initiated against the Message Parsing component. The issue resides in the processMessages function within the renderers/web core/src/v0 9/processing/message-processor.ts file,...

PT-2026-93274

Name of the Vulnerable Software and Affected Versions Bookly versions prior to 28.2 Description An Insecure Direct Object Reference IDOR exists due to missing validation on a user-controlled key. Unauthenticated attackers can enumerate customer conversations by incrementing the conversation id...

CVE-2026-92605: Authorization Bypass Through User-Controlled Key

IRIS through 2.4.29 fails to properly validate case authorization in comment listing endpoints for notes, tasks, IOCs, assets, and evidence items. Attackers with access to any single case can enumerate sequential object identifiers and read comment threads from cases they have no authorization to...

CVE-2026-20121: Improper Access Control

A vulnerability in the access control list ACL Object Group Search OGS implementation of Cisco Secure Firewall Adaptive Security Appliance ASA Software and Cisco Secure Firewall Threat Defense FTD Software could allow an unauthenticated, remote attacker to bypass configured access controls. This...

CVE-2026-61598: Improperly Controlled Modification of Dynamically-Determined Object Attributes

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust.mixins.modelbinding.ModelBindingMixin provides a default updatemodel event handler and is part of the LiveView base MRO, so every LiveView exposes it. It...

CVE-2026-89063: Authorization Bypass Through User-Controlled Key

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 28.1 via the 'conversationid' parameter due to missing validation on a user controlled key. This makes it possible for...

CVE-2026-61596: Authorization Bypass Through User-Controlled Key

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust's per-object authorization getobject + hasobjectpermission, ADR-017 was enforced on the WebSocket mount and event paths but not on three other render entry...

CVE-2026-20120: Improper Access Control

A vulnerability in the access control list ACL Object Group Search OGS implementation of Cisco Secure Firewall Adaptive Security Appliance ASA Software and Cisco Secure Firewall Threat Defense FTD Software could allow an unauthenticated, remote attacker to bypass configured access controls. This...

CVE-2026-91939

Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize without allowedclasses restriction, allowing unauthenticated attackers to instantiate arbitrary PHP classes with attacker-controlled properties. Attackers can exploit PHP object injection through crafted serialized payloads ...