PYSEC-2026-4294 pymongo: PYTHON-5994 Use exact match for file ID in GridFS delete methods

Impact When reading/writing via an ID with the GridFS API, require an exact match on the given ID. Otherwise, if a Hash is given in place of the ID, it may be interpreted as criteria, overriding the ID match. Patches Patch available in pymongo = 4.18.1 Workarounds Ensure your existing workflow on...

CVE-2026-58393: Improper Limitation of a Pathname to a Restricted Directory

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN Client Specific Override commonname field accepts path traversal sequences and openvpncscconfwrite concatenates the value into /var/etc/openvpn-csc/ / without normalization or a basename check. The...

curl: libcurl: Curl out of bounds read for cookie path

An out of bounds read flaw has been discovered in the curl project. Under specific conditions the path comparison logic makes curl read outside a heap buffer boundary. This bug either causes a crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site...

macstealer

MacStealer: Bypass dell'isolamento client Wi-Fi 1. Introduzione Questo repository contiene MacStealer. Può testare le reti Wi-Fi per bypass dell'isolamento client CVE-2022-47522. Il nostro attacco può intercettare rubare il traffico verso altri client a livello MAC, anche se ai client è impedito...

SUSE-SU-2026:24125-1 Security update for python-urllib3

This update for python-urllib3 fixes the following issues: - CVE-2026-97687: traffic interception due to possible HTTPS proxy TLS configuration override bsc1283908. - CVE-2026-97688: denial of service due to infinite loop during chunked Deflate decoding bsc1283909. - CVE-2026-97689: denial of...

EUVD-2026-95341

Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.0, Banks Prompt.chatmessages attempts to parse every line of rendered template output as ChatMessage JSON. When an application renders untrusted data and passes the returned ChatMessage objects to an LLM provide...

Prompt Injection Bypass

PraisonAI is vulnerable to a Prompt Injection Bypass. The vulnerability is due to the block threshold defaulting to CRITICAL severity, which allows an attacker to submit instruction override or financial manipulation prompts that evade blocking, potentially enabling system prompt extraction and...

CVE-2026-107717: Improper Input Validation

Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.0, Banks Prompt.chatmessages attempts to parse every line of rendered template output as ChatMessage JSON. When an application renders untrusted data and passes the returned ChatMessage objects to an LLM provide...

CVE-2026-107228 AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix)

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 3.0.14, the enabled-by-default cookie store replaces a Cookie header explicitly supplied through setHeader or addHeader whenever the store contribut...

GHSA-FJ8F-M44G-C479 PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats

Summary Injection Defense is a purpose-built prompt injection defense layer. It scans LLM inputs through six detection categories: instruction overrides, authority claims, boundary manipulation, obfuscation, financial manipulation, and self-harm instructions. The defense is misconfigured by...

CVE-2026-57546

Transient DOS when processing a continuous receive command with a zero-sized global configuration override...

CVE-2026-57546 Buffer Over-read in WLAN HAL

Transient DOS when processing a continuous receive command with a zero-sized global configuration override...

EUVD-2026-92981

Transient DOS when processing a continuous receive command with a zero-sized global configuration override...

CVE-2026-57546: Buffer Over-read

Transient DOS when processing a continuous receive command with a zero-sized global configuration override...

Cisco ASA Authentication Bypass by Spoofing (CVE-2023-20256)

Multiple vulnerabilities in the per-user-override feature of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to bypass a configured access control list ACL and allow traffic that should be denied to flo...

Cisco ASA Authentication Bypass by Spoofing (CVE-2023-20245)

Multiple vulnerabilities in the per-user-override feature of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to bypass a configured access control list ACL and allow traffic that should be denied to flo...

PT-2026-106355

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A transient Denial of Service DOS occurs when processing a continuous receive command that includes a zero-sized global configuration override. Recommendations A...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: powerpc/memhotplug: Added an addpages override for PPC. With the commit ffa0b64e3be5 “powerpc: Fix virtaddrvalid for 64-bit Book3E & 32-bit”, the kernel now validates the addr against the highmemory value. This results in the...

Cisco ASA Improper Access Control (CVE-2018-15398)

A vulnerability in the per-user-override feature of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to bypass an access control list ACL that is configured for an interface of an affected device. The...

axios: axios: Unintended HTTP method override via prototype pollution gadget

A flaw was found in axios. When sending HTTP requests that omit an explicit request method, Axios can inherit properties from the JavaScript prototype chain rather than using safe internal defaults. If an attacker manipulates shared object properties through a separate vulnerability in the same...