MariaDB's connector leaks the cleartext password to an MitM despite `ssl: true`

Summary When SSL/TLS is enabled but no CA / server certificate is provided, the connector verifies the server's identity using fingerprint validation. The check is effective, the connection is ultimately rejected when it fails, but it happens after the authentication exchange. As a result, the...

CVE-2026-54746

Hatchet (a platform for orchestrating background tasks, AI agents, and durable workflows) is affected by a cross-tenant write/DoS vulnerability in the Dispatcher gRPC service . From version 0.40.0 to 0.91.1 , the UpsertWorkerLabels and Unsubscribe RPCs do not verify that the worker_id in the requ...

GHSA-8JQH-95G6-7JPJ Phalcon: Non-constant-time HMAC verification in `Encryption\Crypt::decrypt` (timing side-channel)

Summary Phalcon\Encryption\Crypt provides authenticated encryption: when useSigning is enabled the default, encrypt appends an HMAC tag and decrypt verifies it before returning the plaintext. The verification compares the attacker-supplied tag against the freshly computed HMAC using PHP/Zephir...

Phalcon: Non-constant-time HMAC verification in `Encryption\Crypt::decrypt` (timing side-channel)

Summary Phalcon\Encryption\Crypt provides authenticated encryption: when useSigning is enabled the default, encrypt appends an HMAC tag and decrypt verifies it before returning the plaintext. The verification compares the attacker-supplied tag against the freshly computed HMAC using PHP/Zephir...

Protect your WhatsApp account with new passkey and 2FA upgrades

WhatsApp announced on August 25 that more than one billion people now use passkeys to log back into the app. The announcement included two other security upgrades: a stronger two-step verification method and more context for incoming calls from unknown numbers. It marks one of the largest...

CVE-2026-80709 s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs There is a wrong upper limit check for the domain value when an EP11 CPRB is processed for sending to a crypto card. This check is only active on custom device node...

EUVD-2026-67444

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs There is a wrong upper limit check for the domain value when an EP11 CPRB is processed for sending to a crypto card. This check is only active on custom device node...

CVE-2026-80709

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs There is a wrong upper limit check for the domain value when an EP11 CPRB is processed for sending to a crypto card. This check is only active on custom device node...

Security Bulletin: Security Vulnerabilities have been found in IBM Sovereign Core

Summary Security Vulnerabilities have been addressed in IBM Sovereign Core Vulnerability Details CVEID:CVE-2026-45022 DESCRIPTION: go-git is an extensible git implementation library written in pure Go. Prior to 5.19.0 and 6.0.0-alpha.3, go-git may parse malformed Git objects in a way that differs...

SUSE CVE-2026-75803

Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVPCipher function. Impact summary: Applications calling EVPCipher on an empty ciphertext and...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: grilo (UTSA-2026-031631)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-031631 advisory. In GNOME grilo though 0.3.13, grl-net-wc.c does not enable TLS certificate verification on the SoupSessionAsync objects it creates, leaving users vulnerable to netwo...

DNS LDNS Data Compromise Verification

The vulnerability of the DNS LDNS library is related to a lack of mechanisms for verifying the source of data. Exploiting this vulnerability could allow a malicious actor to compromise the integrity of the data...

Lasso Library DoS

The vulnerability of the lassoproviderverifysamlsignature function in the Lasso library is related to pointer dereferencing errors. Exploiting this vulnerability could allow an attacker to cause service failures...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mc (UTSA-2026-093026)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093026 advisory. An issue was discovered in Midnight Commander through 4.8.26. When establishing an SFTP connection, the fingerprint of the server is neither checked nor displayed. A...

Firefox Thunderbird Confidential Data Compromise

The vulnerability of the Networking component in Firefox and Firefox ESR web browsers, as well as the Thunderbird email client, is related to a lack of mechanisms for verifying the source of data. Exploiting this vulnerability can allow an attacker to gain access to confidential data and compromi...

GraftyVul: Synthesising Insecure Programs through Real-World Vulnerability Grafting

Vulnerability datasets underpin a wide range of security research, including vulnerability detection, automated remediation, and secure code generation. However, existing datasets sacrifice at least one of three desirable properties: diversity of language or vulnerability type,...

CVE-2026-54330: Improper Verification of Cryptographic Signature

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway RGW SigV4 handler does not reject requests that carry x-amz- headers absent from the signed header set, allowing anyone holding a presigne...

PT-2026-83366

Name of the Vulnerable Software and Affected Versions IGEL OS 12 versions prior to 12.9.0 IGEL OS 12 version 12.8.3 LTS IGEL OS 11 versions prior to 11.11.150 Description A secure boot bypass exists in the GRUB boot stage. A physically present attacker can gain unauthorized root access by placing...

CVE-2026-6286: Improper Neutralization of Input During Web Page Generation

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via customer name fields in versions up to and including 2.2. This is due to an authentication bypass where the AddBookingCommand explicitly skips nonce verification...

PT-2026-86967

Summary Several of AIIR's verification and policy paths could return a success/"verified" result without actually enforcing the control they represent — they could fail open rather than fail closed. For a tool whose purpose is trustworthy verification, a consumer relying on these gates may have...