NewStart CGSL MAIN 6.06 (SP) : qemu Multiple Vulnerabilities (NS-SA-2026-0014)

The remote NewStart CGSL host, running version MAIN 6.06 SP, has qemu packages installed that are affected by multiple vulnerabilities: - A flaw was found in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2. It occurs when dropping packets during a bulk transfer from a...

Gokapi 访问控制错误漏洞

Gokapi is a lightweight, self-hosted alternative to Firefox sending by Marc Bulling. Versions of Gokapi prior to 2.2.3 contained an access control vulnerability. This vulnerability stemmed from the SSE implementation for upload status on /uploadStatus, which exposed the global upload status to an...

CVE-2026-29081

creationtimestamp| type| source ---|---|--- 2026-03-05 22:19:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgdtdzn4kv2k...

CVE-2026-0848

creationtimestamp| type| source ---|---|--- 2026-03-05 22:06:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgdsn3da7y2o 2026-03-06 22:56:29+00:00| seen| https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mggfvehltd2x 2026-03-07 15:00:45+00:00| seen|...

CVE-2026-28277 LangGraph: Unsafe msgpack deserialization in LangGraph checkpoint loading

LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB both sync and async, via aiosqlite. In version 1.0.9 and prior, LangGraph checkpointers can load msgpack-encoded checkpoints that reconstruct Python objects during deserialization. If an attacker can...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the upload status SSE implementation on /uploadStatus, which publishes global upload state to any authenticated listener and includes fileid values not scoped to the requesting user. A...

GHSA-C36C-7PC2-F2PH Gokapi has Data Leak in Upload Status Stream

Description The upload status SSE implementation on /uploadStatus publishes global upload state to any authenticated listener and includes fileid values that are not scoped to the requesting user. Impact Any authenticated user can observe other users' file identifiers and retrieve unauthorized...

Gokapi has Data Leak in Upload Status Stream

Description The upload status SSE implementation on /uploadStatus publishes global upload state to any authenticated listener and includes fileid values that are not scoped to the requesting user. Impact Any authenticated user can observe other users' file identifiers and retrieve unauthorized...

MINI-8P9C-8VJQ-7GHX

Bulletin has no description...

GHSA-5WP8-Q9MX-8JX8

creationtimestamp| type| source ---|---|--- 2026-03-05 06:40:05+00:00| seen| https://gist.github.com/alon710/facbfe8e82c0d1644078a81732ccf4e7...

GHSA-XHW7-JHMP-J62J

creationtimestamp| type| source ---|---|--- 2026-03-05 05:40:05+00:00| seen| https://gist.github.com/alon710/4c0607fcf43c2d97141d407ceb05ca52...

CVE-2026-25048

creationtimestamp| type| source ---|---|--- 2026-03-05 03:07:49+00:00| published-proof-of-concept| https://github.com/mlc-ai/xgrammar/security/advisories/GHSA-7rgv-gqhr-fxg3 2026-03-05 17:57:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgdepo6hei27...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-005643)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005643 advisory. In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Return the firmware result upon destroying QP/RQ Previously when destroying a QP/RQ, t...

SUSE SLES12 Security Update : postgresql18 (SUSE-SU-2026:0785-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:0785-1 advisory. This update for postgresql18 fixes the following issue: Update to version 18.3 bsc1258754. Regression fixes: - the substring function raises an error...

PT-2026-23602

Name of the Vulnerable Software and Affected Versions Gokapi versions prior to 2.2.3 Description Gokapi is a self-hosted file sharing server that supports automatic expiration and encryption. The upload status Server-Sent Events SSE implementation on the /uploadStatus API endpoint publishes globa...

GHSA-5HWF-RC88-82XM

creationtimestamp| type| source ---|---|--- 2026-03-04 22:10:05+00:00| seen| https://gist.github.com/alon710/740d2628b364f80d93a95763c507d3f8 2026-03-13 21:10:06+00:00| seen| https://gist.github.com/alon710/25afc6b7c80d9d4a2082df7705bf284f...

CVE-2026-3539

creationtimestamp| type| source ---|---|--- 2026-03-04 19:50:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgb2kudapa24 2026-03-04 20:18:08+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mgb44e74cf2n 2026-03-05 14:15:27+00:00| seen|...

CVE-2026-28696

creationtimestamp| type| source ---|---|--- 2026-03-04 18:08:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgauuz2k3r2u...

CVE-2025-70237

creationtimestamp| type| source ---|---|--- 2026-03-04 17:13:56+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mgarsx3mlr2n 2026-03-04 17:14:20+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mgartowgvs2s...

CVE-2026-23234

creationtimestamp| type| source ---|---|--- 2026-03-04 15:10:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116171539246167027 2026-03-04 16:12:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgaof534oe2n 2026-03-13 00:00:00+00:00| seen|...