postgresql: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code

A heap based buffer overflow flaw has been discovered in PostgreSQL. This Heap buffer overflow is in the pgcrypto component and allows a ciphertext provider to execute arbitrary code as the operating system user running the database...

Exploit for Improper Control of Dynamically-Managed Code Resources in Apache Airflow_Providers_Http

CVE-2025-69219 — Apache Airflow Providers HTTP RCE via Unsafe...

Terraform Provider for SendGrid: TLS Session Resumption Bypasses Certificate Authority Trust Store Modifications in Go

Summary A critical vulnerability has been identified at https://security.snyk.io/package/linux/chainguard:latest/terraform-provider-sendgrid, associated with the underlying Go version. If the server's TLS configuration is mutated between connections — for example, a CA is removed from the trusted...

Auth 安全漏洞

Auth is a user authentication and management system developed by Supabase. Previous versions of Supabase Auth, such as 2.185.0, had security vulnerabilities. These vulnerabilities occurred when Apple or Azure providers were enabled, allowing attackers to issue session tokens for arbitrary users...

PT-2026-24800

Name of the Vulnerable Software and Affected Versions Unity Catalog versions 0.4.0 and earlier Description Unity Catalog is an open, multi-modal Catalog for data and AI. A critical authentication bypass exists in the Unity Catalog token exchange endpoint, /api/1.0/unity-control/auth/tokens. The...

PT-2026-24743

Supabase Auth is a JWT based API for managing users and issuing JWT tokens. Prior to 2.185.0, a vulnerability has been identified that allows an attacker to issue sessions for arbitrary users using specially crafted ID tokens when the Apple or Azure providers are enabled. The attacker issues a...

CVE-2025-58190 affecting package cloud-provider-kubevirt for versions less than 0.5.1-3

CVE-2025-58190 affecting package cloud-provider-kubevirt for versions less than 0.5.1-3. A patched version of the package is available...

CVE-2025-47911 affecting package kube-vip-cloud-provider for versions less than 0.0.10-5

CVE-2025-47911 affecting package kube-vip-cloud-provider for versions less than 0.0.10-5. A patched version of the package is available...

CVE-2025-47911 affecting package cloud-provider-kubevirt for versions less than 0.5.1-3

CVE-2025-47911 affecting package cloud-provider-kubevirt for versions less than 0.5.1-3. A patched version of the package is available...

CVE-2025-58190 affecting package kube-vip-cloud-provider for versions less than 0.0.10-5

CVE-2025-58190 affecting package kube-vip-cloud-provider for versions less than 0.0.10-5. A patched version of the package is available...

CVE-2026-24283 Multiple UNC Provider Kernel Driver Elevation of Privilege Vulnerability

...

CVE-2026-24283

CVE-2026-24283 involves a local elevation-of-privilege in the UNC Provider Kernel Driver. The vulnerability is rated HIGH with CVSS 3.1: 8.8, impacting confidentiality, integrity, and availability at HIGH levels, exploitable with LOCAL attack vector and LOW complexity, requiring LOW privileges an...

CVE-2025-69219

A user with access to the DB could craft a database entry that would result in executing code on Triggerer - which gives anyone who have access to DB the same permissions as Dag Author. Since direct DB access is not usual and recommended for Airflow, the likelihood of it making any damage is low...

Multiple UNC Provider Kernel Driver Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows File Server allows an authorized attacker to elevate privileges locally...

GHSA-J4J7-VW47-RHFQ vulnerabilities

Vulnerabilities for packages: apisix-ingress-controller, cluster-api-aws-controller, rancher-webhook, tempo, thanos, kyverno-policy-reporter-ui, crossplane-provider-aws-cloudfront, argo-events, kube-vip-cloud-provider, prometheus-adapter, flux-source-controller, timoni,...

CVE-2026-27142 vulnerabilities

Vulnerabilities for packages: apisix-ingress-controller, cluster-api-aws-controller, rancher-webhook, tempo, thanos, kyverno-policy-reporter-ui, crossplane-provider-aws-cloudfront, argo-events, kube-vip-cloud-provider, prometheus-adapter, flux-source-controller, timoni,...

CVE-2026-25679 vulnerabilities

Vulnerabilities for packages: container-object-storage-interface-fips, step-issuer, tkn, victoriametrics-cluster-fips, crossplane-provider-aws-sqs, nri-mssql, nova-fips, k8s-driver-manager-fips, zitadel, cluster-api-aws-controller, flux-image-reflector-controller-fips, q, argo-rollouts,...

GHSA-J4J7-VW47-RHFQ vulnerabilities

Vulnerabilities for packages: step-issuer, tkn, crossplane-provider-aws-sqs, zitadel, cluster-api-aws-controller, flux-image-reflector-controller-fips, argo-rollouts, cert-manager-google-cas-issuer-fips, headlamp-fips, prometheus-alertmanager-fips, cloudprober, vault-env, rancher-fleet-fips,...

Hackers may have breached FBI wiretap network via supply chain

Investigators are worried that a recent attack on a critical FBI system was more than just a random hit, and that another nation-state might have been involved. On February 17, the FBI flagged irregular network activity that led straight to its Digital Collection System Network. That system...

Malicious Package

Overview @platform-growth/guidance-channel-provider is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that...