CVE-2026-12547

CVE-2026-12547 concerns Libsoup's SoupAuthManager, which caches proxy authentication credentials without scoping them to the proxy authority (host:port). When proxy settings change (e.g., system settings or WPAD), cached Proxy-Authorization headers from the previous proxy may be sent to the new p...

CVE-2026-12547 Libsoup: information disclosure in libsoup via soupauthmanager proxy credential leak on proxy switch

SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority host:port. When the proxy configuration changes e.g., via system settings or WPAD, cached Proxy-Authorization headers from the previous proxy are sent to the new proxy, leaking credentials...

A Sneaky Hacking Tool Targeting AI Infrastructure Is Lurking in Victims’ Blind Spots

A new type of malware can worm deep into AI coding systems to steal data and logins—and can flip a “death switch” to destroy files and keep out real users...

EUVD-2026-46269

Ninja Forms plugin version 3.14.8 and prior for WordPress Multisite contains an incorrect authorization vulnerability that allows a subsite Administrator to trigger network-wide deletion of all Ninja Forms data by exploiting a site-scoped capability check combined with unsafe multisite migration...

MSNSwitch Firmware MNT.2408 - Authentication Bypass

MSNSwitch Firmware MNT.2408 is susceptible to authentication bypass in the component http://MYDEVICEIP/cgi-bin-sdb/ExportSettings.sh. An attacker can arbitrarily configure settings, leading to possible remote code execution and subsequent unauthorized operations. id: CVE-2022-32429 info: name:...

Intelbras Switch - Information Disclosure

An authentication bypass in Intelbras Switch SG 2404 MR in firmware 1.00.54 allows an unauthenticated attacker to download the backup file of the device, exposing critical information about the device configuration. id: CVE-2023-36144 info: name: Intelbras Switch - Information Disclosure author:...

SUSE-SU-2026:3130-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2023-20585: iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19 bsc1243603. - CVE-2025-71302: drm/panthor: fix for dma-fence safe acce...

CVE-2026-64004 net/iucv: fix locking in .getsockopt

In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix locking in .getsockopt Mirror iucvsocksetsockopt and wrap the whole switch in locksock/releasesock. The pre-existing SOMSGLIMIT-only lock becomes redundant and is removed. Any AFIUCV HIPER user can potentially crash...

CVE-2024-58363

SurrealDB before 1.5.4 fails to properly validate authentication when a scope user switches databases using the USE clause or use method. Attackers with an authenticated session can impersonate an unrelated user in a different database if a user record with an identical identifier exists, allowin...

CVE-2024-58363 SurrealDB before 1.5.4 Authentication Bypass via Database Switch

SurrealDB before 1.5.4 fails to properly validate authentication when a scope user switches databases using the USE clause or use method. Attackers with an authenticated session can impersonate an unrelated user in a different database if a user record with an identical identifier exists, allowin...

EUVD-2024-55679

SurrealDB before 1.5.4 fails to properly validate authentication when a scope user switches databases using the USE clause or use method. Attackers with an authenticated session can impersonate an unrelated user in a different database if a user record with an identical identifier exists, allowin...

CVE-2024-58363 SurrealDB before 1.5.4 Authentication Bypass via Database Switch

SurrealDB before 1.5.4 fails to properly validate authentication when a scope user switches databases using the USE clause or use method. Attackers with an authenticated session can impersonate an unrelated user in a different database if a user record with an identical identifier exists, allowin...

CVE-2024-58363

SurrealDB prior to 1.5.4 contains an authentication validation flaw when a scope user switches databases with USE or the use method. If an authenticated session encounters a user identifier that exists in a different database, an attacker can impersonate an unrelated user in that database, enabli...

Malicious code in nordpass (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9df6f21fababcd99ba522d380a0729d35aa4ff44ee2f6612fe75b906da844aee Package name impersonates the NordPass password-manager product while presenting itself as 'A simple authentication module.' The package.json...

cockpit-image-builder security update

94.3-1.0.1 - Switch to old frotend Orabug: 38011073 Orabug: 37856296 Orabug: 37856375 - Replaced additional upstream url Orabug: 37856187 - Replaced upstream urls in documentation with oracle links Orabug: 37856187 94.3-1 - New upstream release 94.2-1 - New upstream release 94.1-1 - Resolve...

CVE-2026-57092 Microsoft Windows VMSwitch Elevation of Privilege Vulnerability

...

Security update for the Linux Kernel (Live Patch 44 for SUSE Linux Enterprise 15 SP4)

This update for the SUSE Linux Enterprise Kernel 5.14.21-150400.24.176 fixes various security issues The following security issues were fixed: CVE-2025-71089: iommu: disable SVA when CONFIGX86 is set bsc1256615. CVE-2026-23393: bridge: cfm: Fix race condition in peermep deletion bsc1260524...

SUSE-SU-2026:2889-1 Security update for the Linux Kernel (Live Patch 44 for SUSE Linux Enterprise 15 SP4)

This update for the SUSE Linux Enterprise Kernel 5.14.21-150400.24.176 fixes various security issues The following security issues were fixed: - CVE-2025-71089: iommu: disable SVA when CONFIGX86 is set bsc1256615. - CVE-2026-23393: bridge: cfm: Fix race condition in peermep deletion bsc1260524. -...

EUVD-2026-43216

A flaw has been found in AMTT Hotel Broadband Operation System 1.0. Impacted is an unknown function of the file manager/network/switchstatus.php. Executing a manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and...

CVE-2026-15494 AMTT Hotel Broadband Operation System switch_status.php sql injection

A flaw has been found in AMTT Hotel Broadband Operation System 1.0. Impacted is an unknown function of the file manager/network/switchstatus.php. Executing a manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and...