CVE-2026-120805

In MongoDB Server, an authenticated user with insert privileges on a collection could craft a command with specially constructed encryption-related parameters to redirect internal Queryable Encryption metadata writes to metadata belonging to other encrypted collections within the same database. T...

CVE-2026-120805

In MongoDB Server , an authenticated user with insert privileges on a collection can exploit a Missing Authorization vulnerability (CWE-862) to perform unauthorized writes. By crafting commands with specially constructed encryption-related parameters , an attacker can redirect internal Queryable ...

EUVD-2026-122887

In MongoDB Server, an authenticated user with insert privileges on a collection could craft a command with specially constructed encryption-related parameters to redirect internal Queryable Encryption metadata writes to metadata belonging to other encrypted collections within the same database. T...

EUVD-2026-122634

In trustycontextswitch of services/spd/trusty/trusty.c, there is a possible Secure world register state leak due to a logic error in the code. This could lead to local information disclosure with execution privileges needed. User interaction is for exploitation...

CVE-2026-112979

Weak authentication in Windows State Repository Service allows an authorized attacker to perform tampering locally...

authproof-sdk

AuthProof SDK AuthProof is an audit and attribution layer for AI agents. It lets you prove what a user authorized before the agent acted, and it records what the agent actually did against that authorization. The mechanism is simple. The user signs a delegation receipt with their own private key...

obfuscation_detection

Obfuscation Detection v2.4 Author: Tim Blazytko Automatically detect obfuscated code and other interesting code constructs Description: Obfuscation Detection is a Binary Ninja plugin to detect obfuscated code and interesting code constructs e.g., state machines in binaries. Given a binary, the...

CVE-2026-112979

A weak authentication vulnerability exists in the Windows State Repository Service , allowing an authorized attacker to perform local tampering . While the specific root cause is not detailed in the provided documents, the impact is categorized as a high integrity risk with a CVSS 3.1 base score ...

EUVD-2026-121903

Weak authentication in Windows State Repository Service allows an authorized attacker to perform tampering locally...

CVE-2026-125754

Dolibarr 20.0.0 through 23.0.4 and 24.x before 24.0.2 contains an insecure direct object reference vulnerability in apiexpensereports.class.php payment endpoints that lets authenticated users access other users' expense report payments. Attackers with only expense report read and create rights ca...

CVE-2026-111242

When MicroProfile JWT authentication is used for servlets that declare a run-as identity, the security state established for a request is not always cleared from the processing thread when the request does not complete normally. A remote attacker holding a valid token can cause later, unrelated...

GHSA-GHWV-VRP2-2975 Cocos AI Intra-handshake attested TLS implementation is vulnerable to TOCTOU Attacks

Summary An attacker who can modify the attested workload’s code, memory-backed state, or configuration after the initial attestation — but without necessarily terminating the existing TLS connection — can cause the peer to continue trusting the connection as if the originally attested state were...

Cocos AI Intra-handshake attested TLS implementation is vulnerable to TOCTOU Attacks

Summary An attacker who can modify the attested workload’s code, memory-backed state, or configuration after the initial attestation — but without necessarily terminating the existing TLS connection — can cause the peer to continue trusting the connection as if the originally attested state were...

EUVD-2026-121250

When MicroProfile JWT authentication is used for servlets that declare a run-as identity, the security state established for a request is not always cleared from the processing thread when the request does not complete normally. A remote attacker holding a valid token can cause later, unrelated...

CVE-2026-125754 Dolibarr 20.0.0 through 23.0.4 and 24.x before 24.0.2 IDOR via ExpenseReport Payment API

Dolibarr 20.0.0 through 23.0.4 and 24.x before 24.0.2 contains an insecure direct object reference vulnerability in apiexpensereports.class.php payment endpoints that lets authenticated users access other users' expense report payments. Attackers with only expense report read and create rights ca...

CVE-2026-125754

The software Dolibarr versions 20.0.0 through 23.0.4 and 24.x before 24.0.2 is vulnerable to an Insecure Direct Object Reference (IDOR) in the api_expensereports.class.php payment endpoints. This flaw allows authenticated users with basic expense report read and create rights to access, create, o...

EUVD-2026-121215

Stateful session bean identifiers are not generated from a cryptographically secure random source. A remote attacker with access to the EJB remote endpoint who holds one valid identifier can derive those of other clients' sessions and invoke methods on their beans, exposing or modifying other...

EUVD-2026-121214

The stateful session bean passivation mechanism derives the on-disk file name from a client-supplied identifier without validating it. A remote attacker with access to the remote EJB service can cause session state to be read from or written to files outside the passivation directory. Users are...

espectre

ESPectre Turn an ESP32 into a private, local Wi-Fi motion sensor. When someone moves through a room, they change the way Wi-Fi signals travel through it. ESPectre reads those changes and reports motion in real time. No camera, no microphone, no wearable, and no dedicated radar hardware: just a...

Cairn

Cairn More Than Just AI Penetration Testing — Towards General State-Space Search Cairn is a general-purpose problem-solving engine. It defines no roles, no workflows. Given an origin and a goal, it searches for a path through an unknown state space. AI Penetration Testing is one such problem — an...