CVE-2026-63116 deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writes

deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. From 10.1.0 until 10.1.1, src/services/permission/valve/rules-map.ts omits RECORDACTION.PATCHMULTI from RULESMAP. When an authenticated user sends a PATCHMULTI record operation whil...

CVE-2026-63116 deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writes

deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. From 10.1.0 until 10.1.1, src/services/permission/valve/rules-map.ts omits RECORDACTION.PATCHMULTI from RULESMAP. When an authenticated user sends a PATCHMULTI record operation whil...

CVE-2026-63116 deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writes

deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. From 10.1.0 until 10.1.1, src/services/permission/valve/rules-map.ts omits RECORDACTION.PATCHMULTI from RULESMAP. When an authenticated user sends a PATCHMULTI record operation whil...

SUSE CVE-2026-56743

Cilium is a networking, observability, and security solution. From 1.19.0 to 1.19.4, standard Kubernetes NetworkPolicy specifications using CIDR-based ipBlock rules without pod or namespace selectors erroneously generate a wildcard namespace allow rule when Cilium is configured with a custom...

100DaysofYARA

100 Days of YARA 2026 100 Days of YARAへようこそ！このリポジトリは、この期間に作成されたすべてのYARAアイデアを保存する場所として機能します。作成した楽しいスクリプト、ツール、ルールはすべてこのGitHubリポジトリにコミットできます！当面は、関連するブログ記事、ウォークスルー、その他の考察は別の場所で公開してください : これっていったい何なの？ 簡単に言うと、100DaysofYARA...

OPENSUSE-SU-2026:11831-1 bazel-rules-python-source-2.3.3-1.1 on GA media

These are all security issues fixed in the bazel-rules-python-source-2.3.3-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-96247

Name of the Vulnerable Software and Affected Versions Joplin versions 1.4.0 through 3.7.1 Description In the packages/renderer/MdToHtml/rules/katex.ts file, the application enables the trust option for KaTeX note content. This allows an author to insert a href URL into the rendered output that...

PT-2026-96169

Name of the Vulnerable Software and Affected Versions deepstream version 10.1.0 Description An issue exists where the src/services/permission/valve/rules-map.ts file omits RECORD ACTION.PATCH MULTI from the RULES MAP. When an authenticated user performs a PATCH MULTI record operation while the...

CVE-2026-55105: Improper Neutralization of Input During Web Page Generation

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.6.15 and 3.7.2, packages/renderer/MdToHtml/rules/fountain.ts passes HTML generated by the vendored fountain.js renderer into note output without sanitizing it. A malicious Fountain...

PT-2026-96276

Name of the Vulnerable Software and Affected Versions Joplin versions prior to 3.6.15 Joplin versions prior to 3.7.2 Description In the packages/renderer/MdToHtml/rules/fountain.ts file, HTML generated by the vendored fountain.js renderer is passed into the note output without sanitization. This...

CVE-2026-63116: Missing Authorization

deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. From 10.1.0 until 10.1.1, src/services/permission/valve/rules-map.ts omits RECORDACTION.PATCHMULTI from RULESMAP. When an authenticated user sends a PATCHMULTI record operation whil...

CVE-2026-63451 Suricata detect: frame rules without content and with transform can cause heap buffer overflow during rule load

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, a locally supplied detection rule that combines frame inspection without content and a transformed match without content can make...

CVE-2026-63451

The network security engine Suricata versions 8.0.0 through 8.0.6 is vulnerable to a heap buffer overflow . A local user can trigger this flaw by loading a specially crafted detection rule that combines frame inspection without content and a transformed match without content. This interaction cau...

EUVD-2026-82928

A file type attribution issue in Zscaler Internet Access File Type Control evaluation rules may allow improper evaluation of File Type Control policies in rare circumstances...

certgraveyard_yara v2026.09.16

CertGraveyard YARA Rules Generator Automated YARA rule generation from the CertGraveyard compromised certificate database. Features 🔄 Daily Updates : Automatically checks CertGraveyard for new compromised certificates 📝 YARA Rule Generation : Creates individual YARA rules for each certificate ✅...

CVE-2026-92776

Wiki.js through 2.5.314 fails to require path separators when matching START and END page rules, allowing attackers to access pages sharing a prefix with authorized folders. Users granted access to a folder can read and modify unrelated pages with matching prefixes, bypassing intended access...

EUVD-2026-81040

Wiki.js through 2.5.314 fails to require path separators when matching START and END page rules, allowing attackers to access pages sharing a prefix with authorized folders. Users granted access to a folder can read and modify unrelated pages with matching prefixes, bypassing intended access...

CVE-2026-92776 Wiki.js through 2.5.314 Path Prefix Matching Authorization Bypass

Wiki.js through 2.5.314 fails to require path separators when matching START and END page rules, allowing attackers to access pages sharing a prefix with authorized folders. Users granted access to a folder can read and modify unrelated pages with matching prefixes, bypassing intended access...

CVE-2026-92776

Wiki.js through 2.5.314 suffers from a path prefix matching authorization bypass in its page permission rule engine. The vulnerability resides in the START and END page rule matching logic (server/core/auth.js), which fails to enforce path segment boundary checks. As a result, users granted acces...

CVE-2026-76556 WP Import Export Lite < 3.9.33 - Authenticated SQLi via Export Filter Rules

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some export filter values before using them in SQL statements, allowing users holding its export permission, which administrators have by default and may also grant to lower roles, to perform SQL...