CVE-2026-67986: Improper Control of Generation of Code

amazing-print/amazingprint at commit dc890dfafdf07088ea901df53c19c2710e5c5234 contains a Ruby code injection condition in AwesomeMethodArraygrep. A specially named method containing Ruby interpolation syntax can be interpolated into a dynamically constructed eval string when grep is called with a...

CVE-2026-56755: Improper Access Control

Denial of Service CPU & Memory Exhaustion via ON^2 String Concatenation in Debian Package Upload...

CVE-2026-49473: Interpretation Conflict

@cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Cedar authorization into Express applications by mapping HTTP requests to Cedar actions and evaluating authorization policies before allowing requests to proceed. Versions prior to 0.3.0 have an issu...

PT-2026-71912

Budibase before 3.40.0 fails to redact datasource credentials stored in STRING typed fields, allowing authenticated users to read MongoDB connection strings and Firebase private keys in plaintext. Attackers with table read permissions can retrieve datasource configurations through the read API to...

PT-2026-80532

There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. It occurs in String-to-Float conversion, including KernelFloat and Stringto f...

PT-2026-80542

Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted XLS file to the get string function in xlstool.c:411...

CVE-2026-52052

mgtlsparsecertder pubkey BIT STRING length underflow -- OOB read...

net/mlx5 DoS

The vulnerability of the net/mlx5 component in the Linux operating system is related to insufficient handling of format strings. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-80529

Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS regular expression Denial of Service via a long string. The fixed versions are 3.2.1, 3.1.2, 3.0.2, and 2.0.1...

PT-2026-71595

amazing-print/amazing print at commit dc890dfafdf07088ea901df53c19c2710e5c5234 contains a Ruby code injection condition in AwesomeMethodArraygrep. A specially named method containing Ruby interpolation syntax can be interpolated into a dynamically constructed eval string when grep is called with ...

EUVD-2026-57699

@cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Cedar authorization into Express applications by mapping HTTP requests to Cedar actions and evaluating authorization policies before allowing requests to proceed. Versions prior to 0.3.0 have an issu...

CVE-2026-49473

@cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Cedar authorization into Express applications by mapping HTTP requests to Cedar actions and evaluating authorization policies before allowing requests to proceed. Versions prior to 0.3.0 have an issu...

CVE-2026-49473 @cedar-policy/authorization-for-expressjs has an authorization bypass via query string manipulation

@cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Cedar authorization into Express applications by mapping HTTP requests to Cedar actions and evaluating authorization policies before allowing requests to proceed. Versions prior to 0.3.0 have an issu...

CVE-2026-49473 @cedar-policy/authorization-for-expressjs has an authorization bypass via query string manipulation

@cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Cedar authorization into Express applications by mapping HTTP requests to Cedar actions and evaluating authorization policies before allowing requests to proceed. Versions prior to 0.3.0 have an issu...

CVE-2026-49473

The CVE concerns @cedar-policy/authorization-for-expressjs, an Express middleware that applies Cedar authorization by mapping HTTP requests to Cedar actions. A concrete flaw in versions up to 0.2.x is that the middleware uses req.originalUrl (which includes the query string) to identify Cedar act...

CVE-2026-49473 @cedar-policy/authorization-for-expressjs has an authorization bypass via query string manipulation

@cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Cedar authorization into Express applications by mapping HTTP requests to Cedar actions and evaluating authorization policies before allowing requests to proceed. Versions prior to 0.3.0 have an issu...

GHSA-2JMX-Q9JF-WP3W Duplicate Advisory: Second-order SSTI to arbitrary SQL via attribute-view template column (queryBlocks): malicious imported package executes SQL on victim kernel

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-x67c-8pwr-m8g3. This link is maintained to preserve external references. Original Description SiYuan versions before v3.7.4 contain a second-order SQL injection vulnerability in attribute-view template columns...

Duplicate Advisory: Second-order SSTI to arbitrary SQL via attribute-view template column (queryBlocks): malicious imported package executes SQL on victim kernel

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-x67c-8pwr-m8g3. This link is maintained to preserve external references. Original Description SiYuan versions before v3.7.4 contain a second-order SQL injection vulnerability in attribute-view template columns...

DEBIAN-CVE-2026-73433

A flaw was found in GStreamer gst-plugins-good avidemux. When parsing FUJIFILM metadata in an AVI strd chunk, gstavidemuxparsestrd decrements a remaining-length counter by fixed offsets 98 and 10 bytes without verifying sufficient data remains. For crafted strd payloads of exactly 106 or 107 byte...

CVE-2026-12004

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 contains a format string injection vulnerability in the management interface that allows attackers to cause denial of service and...