PT-2026-121735

This update fixes security issues: - Only accept a CONFLUX LINK cell on a plain OR circuit, and refuse to turn a pending conflux leg into an introduction or rendezvous point. Previously a client could link a rendezvous-point circuit into a conflux set and then, with a forged sequence number in th...

EulerOS 2.0 SP11 : mariadb-connector-c (EulerOS-SA-2026-4344)

According to the versions of the mariadb-connector-c package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validat...

AlmaLinux 9.6 [TuxCare] Security Update: mariadb-connector-c / mariadb-connector-c-config / etc (ALMALINUX9.6:CLSA-2026:1791796759)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791796759 advisory. - MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated us...

EulerOS 2.0 SP11 : mariadb-connector-c (EulerOS-SA-2026-4254)

According to the versions of the mariadb-connector-c package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validat...

Rocky Linux 9.6 [TuxCare] Security Update: mariadb-connector-c / mariadb-connector-c-config / etc (ALMALINUX9.6:CLSA-2026:1791796759)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791796759 advisory. - MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated...

EulerOS 2.0 SP13 : mariadb-connector-c (EulerOS-SA-2026-4071)

According to the versions of the mariadb-connector-c package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validat...

EulerOS 2.0 SP13 : mariadb-connector-c (EulerOS-SA-2026-4162)

According to the versions of the mariadb-connector-c package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validat...

EUVD-2026-97101

omarchy-theme-set in Omarchy 4 before 4.0.1 allows code execution via a third-party theme because the files placed into /.local/state/omarchy/current/theme may include executable content from an untrusted Git repository...

CVE-2026-108913

omarchy-theme-set in Omarchy 4 before 4.0.1 allows code execution via a third-party theme because the files placed into /.local/state/omarchy/current/theme may include executable content from an untrusted Git repository...

coraza

Coraza - Cortafuegos de Aplicaciones Web Coraza es un cortafuegos de aplicaciones web WAF de código abierto, de grado empresarial y alto rendimiento, listo para proteger tus queridas aplicaciones. Está escrito en Go, es compatible con los conjuntos de reglas SecLang de ModSecurity y es 100%...

CLEANSTART-2026-WF83239 undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header

Security vulnerability affects the n8n package. undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header...

PT-2026-117893

Security vulnerability affects the n8n package. undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header...

NPM: MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)

NPM: MariaDB Connector/Node.js: SQL injection through object keys in SET expansion permitSetMultiParamEntries vulnerability discovered by ? in WordPress Npm mariadb versions = 3.2.0, 3.2.5...

MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)

Description With the non-default permitSetMultiParamEntries option enabled, an object passed as a query parameter is expanded into a SET clause, each key becoming a column name. The three code paths implementing that expansion built the backtick-quoted identifier by hand and wrote the key out...

GHSA-V6PJ-GXXW-PHFW MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)

Description With the non-default permitSetMultiParamEntries option enabled, an object passed as a query parameter is expanded into a SET clause, each key becoming a column name. The three code paths implementing that expansion built the backtick-quoted identifier by hand and wrote the key out...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via object key interpolation in SET clause expansion in text-encoder.js, query.js, and utils.js. When an object is passed as a query parameter with the permitSetMultiParamEntries option enabled, each key is expanded into a...

CVE-2026-107701

dot-access through 1.0.0 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying a crafted dotted path to set. Attackers controlling the path, such as through user-supplied field names, can use proto segments to inject properties into all objects...

CVE-2026-107701

dot-access through 1.0.0 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying a crafted dotted path to set. Attackers controlling the path, such as through user-supplied field names, can use proto segments to inject properties into all objects...

CVE-2026-107701 dot-access through 1.0.0 Prototype Pollution via set() path argument

dot-access through 1.0.0 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying a crafted dotted path to set. Attackers controlling the path, such as through user-supplied field names, can use proto segments to inject properties into all objects...

CVE-2026-107701 dot-access through 1.0.0 Prototype Pollution via set() path argument

dot-access through 1.0.0 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying a crafted dotted path to set. Attackers controlling the path, such as through user-supplied field names, can use proto segments to inject properties into all objects...