CVE-2026-125323 pgEdge Control Plane generates pg_hba.conf with trust authentication for local and loopback connections

pgEdge Control Plane is a distributed application for managing and orchestrating Postgres databases across multiple hosts. From 0.1.0 to 0.10.1, generated pghba.conf files began with hard-coded trust entries for Unix-socket and loopback connections. Because PostgreSQL evaluates the file from top ...

CVE-2026-125323 pgEdge Control Plane generates pg_hba.conf with trust authentication for local and loopback connections

pgEdge Control Plane is a distributed application for managing and orchestrating Postgres databases across multiple hosts. From 0.1.0 to 0.10.1, generated pghba.conf files began with hard-coded trust entries for Unix-socket and loopback connections. Because PostgreSQL evaluates the file from top ...

CVE-2026-63018

Integer underflow wrap or wraparound for some IntelR Metrics Discovery Application Programming Interface software before version 1.16.189 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attac...

CVE-2026-63018

Integer underflow wrap or wraparound for some IntelR Metrics Discovery Application Programming Interface software before version 1.16.189 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attac...

CVE-2026-60141

Improper null termination for some IntelR Metrics Discovery Application Programming Interface before version 1.16.189 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial ...

CVE-2026-60141

Improper null termination for some IntelR Metrics Discovery Application Programming Interface before version 1.16.189 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial ...

Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem

Three distinct threat activity clusters with shared infrastructure and malware code similarities have been observed targeting telecommunications providers, government organizations, military entities, research institutions, and critical infrastructure across Latin America, Asia, and Europe over t...

CVE-2026-120212 Web::Simple versions before 0.037 for Perl do not escape single quotes in HTML::Tags output

Web::Simple versions before 0.037 for Perl do not escape single quotes in HTML::Tags output. HTML::Tags and XML::Tags escape a plain string value by replacing only &, ", with entities. A value interpolated into a single-quoted attribute, as in , can therefore close the attribute and add new ones,...

CVE-2026-120212 Web::Simple versions before 0.037 for Perl do not escape single quotes in HTML::Tags output

Web::Simple versions before 0.037 for Perl do not escape single quotes in HTML::Tags output. HTML::Tags and XML::Tags escape a plain string value by replacing only &, ", with entities. A value interpolated into a single-quoted attribute, as in , can therefore close the attribute and add new ones,...

EUVD-2026-121397

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftbyteorder: remove multi-register support 64bit byteorder conversion is broken when several registers need to be converted because the source register array advances in steps for 4 bytes instead of 8: for i = ... src...

CVE-2026-99285 netfilter: nft_byteorder: remove multi-register support

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftbyteorder: remove multi-register support 64bit byteorder conversion is broken when several registers need to be converted because the source register array advances in steps for 4 bytes instead of 8: for i = ... src...

CVE-2026-99285 netfilter: nft_byteorder: remove multi-register support

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftbyteorder: remove multi-register support 64bit byteorder conversion is broken when several registers need to be converted because the source register array advances in steps for 4 bytes instead of 8: for i = ... src...

EUVD-2026-121395

Plack::Middleware::CSP versions before 0.03 for Perl send the Content Security Policy under the wrong header name, so browsers never enforce it. The call method sets the policy in a response header named "content-security-protocol" instead of "Content-Security-Policy". Browsers ignore that header...

CVE-2026-125729 Plack::Middleware::CSP versions before 0.03 for Perl send the Content Security Policy under the wrong header name, so browsers never enforce it

Plack::Middleware::CSP versions before 0.03 for Perl send the Content Security Policy under the wrong header name, so browsers never enforce it. The call method sets the policy in a response header named "content-security-protocol" instead of "Content-Security-Policy". Browsers ignore that header...

CVE-2026-125729 Plack::Middleware::CSP versions before 0.03 for Perl send the Content Security Policy under the wrong header name, so browsers never enforce it

Plack::Middleware::CSP versions before 0.03 for Perl send the Content Security Policy under the wrong header name, so browsers never enforce it. The call method sets the policy in a response header named "content-security-protocol" instead of "Content-Security-Policy". Browsers ignore that header...

CVE-2026-61547

rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to version 0.17.0, a heap buffer overflow exists in rabbitmq-c when the public amqpsendframe API is used to serialize an oversized AMQPFRAMEBODY. The issue occurs because amqpframetobytes copies frame.payload.bodyfragment.len byte...

CVE-2026-46632

Uncontrolled search path for some IntelR Application Optimization User Interface within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result...

CVE-2026-126048

Gwenhywfar 4.99.8beta before 5.14.2 contains a stack-based buffer overflow in GWENTLVBufferToDB in src/parser/tlv.c when decoding BER-TLV tags into a fixed 128-byte buffer. Attackers can supply a record with about 127 or more tag continuation bytes or a truncated multi-byte tag, such as via a...

Vulners Software Audit

Query the Vulners Software Audit API for known vulnerabilities matching one or more software products/versions CPE string or vendor:product:version. Bring-your-own-key BYOK: set apikey, plugin config, or VULNERSAPIKEY. Prefer plugin run vulners … as the hub; this scanner is a thin wrapper...

EUVD-2026-121406

Gwenhywfar 4.99.8beta before 5.14.2 contains a stack-based buffer overflow in GWENTLVBufferToDB in src/parser/tlv.c when decoding BER-TLV tags into a fixed 128-byte buffer. Attackers can supply a record with about 127 or more tag continuation bytes or a truncated multi-byte tag, such as via a...