LZ4 Java: Native XXHash implementations can crash the JVM when passed invalid byte array ranges

Insufficient validation of byte array arguments in JNI-based XXHash implementations in lz4-java 1.11.0 and earlier allows callers to crash the JVM by passing an invalid array reference or invalid range to native XXHash methods. This affects applications where an attacker can influence the byte...

CVE-2026-43499: A Critical Analysis of the "Zero-Self" Fallacy

This document presents a comprehensive technical analysis refuting the claim that CVE-2026-43499 GhostLock constitutes "no real vulnerability" due to its requirement for local access and user interaction. Through rigorous examination of the attack surface, exploitation vectors, and real-world...

ROS-20260724-73-0033

The vulnerability in ImageMagick 7 relates to a target surface whose quantitative dimensions exceed the desired maximum. Exploiting this vulnerability can allow an attacker to compromise the confidentiality of the protected information...

ROS-20260724-73-0034

The vulnerability in ImageMagick relates to the target surface whose quantitative dimensions exceed the desired maximum. Exploiting this vulnerability can allow an attacker to compromise the confidentiality of the protected information...

CVE-2026-54120 Microsoft Surface Remote Code Execution Vulnerability

...

CVE-2026-54120 Microsoft Surface Remote Code Execution Vulnerability

...

CVE-2026-54120

Technical details for CVE-2026-54120 are not publicly available in the provided documents. The materials only reiterate the description of improper input validation in Microsoft Surface. Monitor for updates from vendors for affected products and patches.

CVE-2026-54120

Improper input validation in Microsoft Surface allows an authorized attacker to execute code over a network...

CVE-2024-58354 cal.com Repository Takeover via pull_request_target Workflow

cal.com calcom repository, later renamed cal.diy is affected by a repository takeover vulnerability in its GitHub Actions workflows. The workflow pr.yml uses the pullrequesttarget trigger with the repository's default write permissions and passes them down to check-types.yml. check-types.yml then...

Microsoft Surface Remote Code Execution Vulnerability

Improper input validation in Microsoft Surface allows an authorized attacker to execute code over a network...

PYSEC-2026-3542 vLLM has Remote DoS via Invalid Recovered Token Reinjection

Summary A frontend-legal multi-request speculative workload can make vLLM produce an out-of-vocabulary recovered token equal to vocabsize, convert that value to -1 when choosing the next live token for a request, and then feed that -1 back into the next drafter input ids. On Qwen3 GPTQ this reach...

Astra Linux – Vulnerability in Chromium

A out-of-bounds memory read in SurfaceCapture using Google Chrome before version 150.0.7871.47 allowed a remote attacker to perform an out-of-bounds memory read through a crafted HTML page. Chromium security severity: Medium...

CVE-2026-54120: Improper Input Validation

Improper input validation in Microsoft Surface allows an authorized attacker to execute code over a network...

PT-2026-64204

Name of the Vulnerable Software and Affected Versions Microsoft Surface affected versions not specified Description Improper input validation allows an authorized attacker to execute code over a network. Recommendations At the moment, there is no information about a newer version that contains a...

KLA91176 Multiple vulnerabilities in Microsoft Browser

Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code. Below is a complete list of vulnerabilities: 1. Denial of service vulnerability in ANGLE can be exploited...

Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface

Summary I'm reporting two related TOTP one-time-use defects in Gitea that survive the CVE-2021-45331 fix. The 2018 fix PR 3878 introduced the TwoFactor.LastUsedPasscode field and added an in-memory inequality check on the web 2FA login path. That check works correctly in the single-request case,...

CVE-2026-47390

PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praisonaiagents, spidertools URL validation can be bypassed using alternate loopback host encodings. The tool contains a URL validation function intended to block local or unsafe...

CVE-2026-56452 Apache MINA SSHD: Path traversal in SCP file reception

Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. The implementation of receiving files or directories via SCP did not validate filenames in SCP "C" or "D" commands. A malicious sender could send filenames...

CVE-2026-14971 This PowerVM Novalink update is being released to address

IBM PowerVM Novalink 2.2.02.2.12.2.1.1, and 2.3.02.3.0.12.3.12.3.2 IBM NovaLink APIs misconfiguration may increase attack surface and enable unintended or unauthorized operations under non-default conditions...

EUVD-2026-45302

IBM PowerVM Novalink 2.2.02.2.12.2.1.1, and 2.3.02.3.0.12.3.12.3.2 IBM NovaLink APIs misconfiguration may increase attack surface and enable unintended or unauthorized operations under non-default conditions...