Top Google Security Staff Warn Search Data Could Be Hacked if EU Rules Change

Europe’s pro-competition proposals could see Google Search and Android systems opened up. The company claims there are serious privacy flaws...

PT-2026-53674

Name of the Vulnerable Software and Affected Versions SigNoz versions prior to 0.130.2 Description Broken access control allows authenticated users to access alert rules of other organizations. This occurs because the alert rule store predicates fail to filter by organization ID, resulting in a...

CVE-2026-57956: Authorization Bypass Through User-Controlled Key

SigNoz through 0.130.1 contains a broken access control vulnerability that allows authenticated users to access other organizations' alert rules by supplying a target rule UUID, as the alert rule store predicates fail to filter by organization ID. Attackers can read, edit, and delete alert rules...

PT-2026-53672

Name of the Vulnerable Software and Affected Versions Elide versions prior to 7.1.18 Description Insufficient enforcement of @ReadPermission within the getValidSortingRules function of SortingImpl allows attackers to use forbidden fields in client-supplied sort expressions. By analyzing the...

PT-2026-53549

Summary PraisonAI's MCP Model Context Protocol server praisonai mcp serve registers four file-handling tools by default — praisonai.rules.create, praisonai.rules.show, praisonai.rules.delete, and praisonai.workflow.show. Each accepts a path or filename string from MCP tools/call arguments and joi...

Exploitarium-Detections

Exploitarium-Detections Exploitarium KQL Detection Coverage...

SUSE CVE-2026-52975

In the Linux kernel, the following vulnerability has been resolved: bonding: 3ad: implement proper RCU rules for port-aggregator syzbot found a data-race in bond3adgetactiveagginfo / bond3adstatemachinehandler 1 which hints at lack of proper RCU implementation. Add rcu qualifier to port-aggregato...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the access control process when domains are not properly canonicalized in highly specific edge cases. An attacker can gain unauthorized access to resources by crafting requests with domain names containing...

EUVD-2026-38083

Authelia has an Edge Case Access Control Rule Mismatch...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the access control process when domains are not properly canonicalized in highly specific edge cases. An attacker can gain unauthorized access to resources by crafting requests with domain names containing...

8 Top SAST Tools for Polyglot Monorepos and Platform Engineering in 2026

Compare 8 top SAST tools for polyglot monorepos, covering incremental scans, ownership, custom rules and platform engineering at scale 2026...

CVE-2026-53269

A flaw was found in the Linux kernel's netfilter synproxy component. This vulnerability is caused by a race condition during the on-demand registration of netfilter hooks. A local user with privileges to modify netfilter rules could exploit this flaw by concurrently adding iptables targets or...

Debian dsa-6367 : dnsdist - security update

The remote Debian 13 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-6367 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6367-1 [email protected] https://www.debian.org/securit...

CVE-2026-40983

A flaw was found in Micrometer. A remote attacker can provide specially crafted gRPC gRPC Remote Procedure Call requests, which may lead to a denial-of-service DoS condition. This vulnerability allows an attacker to disrupt the availability of the affected system. Mitigation To mitigate this issu...

[SECURITY] [DSA 6367-1] dnsdist security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6367-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff June 25, 2026 https://www.debian.org/security/faq -...

CVE-2026-54091

CVE-2026-54091 : File Browser public shares allow information disclosure due to incorrect access control when rebasing the owner’s filesystem root for public share paths. Before 2.63.6, the public share handler sets d.user.Fs to a BasePathFs rooted at the shared directory and then checks access w...

CVE-2026-54091 File Browser: Incorrect access control in public directory shares via rule path rebasing

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6, File Browser's public share handlers rebase the share owner's filesystem root to the shared directory and then evaluate descendant paths agains...

Unsoundness in `Error::downcast_mut()`

Affected versions of this crate violate borrow rules, resulting in undefined behavior, when the user adds context to an error via Error::context and then later calls Error::downcastmut on the returned Error. The flaw was corrected in commit 6e8c000 by revising how the mutable reference is...

ALPINE-CVE-2026-12490

When a provide-xfr is given with a tls-auth-name, a secondary requesting a transfer should provide a client certificate with that name. However, no client certificate is needed when the request comes in over TLS over the regular tls-port and not the tls-auth-port or over over TCP over the regular...

PT-2026-52212

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An issue exists where a secondary requesting a transfer does not need to provide a client certificate when the request is made over TLS via the regular tls-port...