CVE-2026-82068: Reachable Assertion

A security issue in MongoDB Server allows an authenticated user with write privileges to trigger a persistent fatal assertion crash by sending specially crafted retryable write commands. The crash state is durably persisted, causing the server process to repeatedly crash on restart and potentiall...

PT-2026-88441

Name of the Vulnerable Software and Affected Versions Okta Hyperdrive Agent affected versions not specified Description The Okta Hyperdrive Agent writes the decoded SAML bearer assertion to a local application log file at the default log level following every successful MFA completion. This...

PT-2026-87152

Name of the Vulnerable Software and Affected Versions MongoDB Server affected versions not specified Description An internal aggregation expression was incorrectly registered as accessible to any authenticated user instead of being restricted to internal cluster operations. An authenticated user...

CVE-2026-78631: Insertion of Sensitive Information into Log File

The Okta Hyperdrive Agent writes the decoded SAML bearer assertion to a local application log file at the default log level on every successful MFA completion. This insertion of sensitive information into the log file makes a live authentication credential readable by any local user with access t...

CVE-2026-73313: Incorrect Authorization

XenForo before 2.3.13 contains a multi-factor authentication bypass vulnerability in the passkey TFA provider that allows an authenticated attacker to complete login as another user by submitting their own registered passkey credential during the WebAuthn assertion step. The passkey verification...

PT-2026-88160

When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo field on all SAML responses, including SP-initiated logins. This removes anti-replay protection, allowing an attacker who obtains a valid signed SAML assertion to replay it and ga...

CVE-2026-82059: Reachable Assertion

An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any authenticated user rather than being restricted to internal cluster operations. By crafting a malformed index specification within this expression, an authenticated user with read-only privileges...

Linux Distros Unpatched Vulnerability : CVE-2026-86317

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was detected in ggml-org llama.cpp up to 0.4.0. This impacts the function rpcserver::deserializetensor of the file ggml/src/ggml-rpc/ggml-rpc.cp...

PT-2026-87161

Name of the Vulnerable Software and Affected Versions MongoDB Server affected versions not specified Description An authenticated user with write privileges can trigger a persistent fatal assertion crash by sending specially crafted retryable write commands. The crash state is durably persisted,...

PT-2026-88439

Name of the Vulnerable Software and Affected Versions Okta Hyperdrive agent plugin affected versions not specified Description The Okta Hyperdrive agent plugin returns a success response without a signed SAML assertion when the organization's policy requires no MFA for a given user. The response...

PT-2026-87058

Name of the Vulnerable Software and Affected Versions XenForo versions prior to 2.3.13 Description A multi-factor authentication bypass exists in the passkey TFA provider. An authenticated attacker who possesses a target account's password can bypass multi-factor authentication on both the public...

CVE-2026-82052: Reachable Assertion

The $regexFindAll expression can be used by an authenticated user who can run aggregation pipeline stages to crash a MongoDB server mongod. Under certain specific conditions the regex match can start in the middle of a multi-code-unit character, triggering an assertion during query execution...

EulerOS 2.0 SP12 : bind (EulerOS-SA-2026-3249)

According to the versions of the bind packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption when receiving a...

EulerOS 2.0 SP12 : bind (EulerOS-SA-2026-3324)

According to the versions of the bind packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption when receiving a...

PT-2026-87157

Name of the Vulnerable Software and Affected Versions MongoDB Server affected versions not specified Description An unauthenticated network user can cause a denial of service on specific replica set members. The issue stems from an assertion in the read concern processing logic that can be...

CVE-2026-86317

A vulnerability was detected in ggml-org llama.cpp up to 0.4.0. This impacts the function rpcserver::deserializetensor of the file ggml/src/ggml-rpc/ggml-rpc.cpp of the component RPC Server. Performing a manipulation of the argument ne results in reachable assertion. The attack is possible to be...

DEBIAN-CVE-2026-86317

A vulnerability was detected in ggml-org llama.cpp up to 0.4.0. This impacts the function rpcserver::deserializetensor of the file ggml/src/ggml-rpc/ggml-rpc.cpp of the component RPC Server. Performing a manipulation of the argument ne results in reachable assertion. The attack is possible to be...

CVE-2026-86317 ggml-org llama.cpp RPC Server ggml-rpc.cpp deserialize_tensor assertion

A vulnerability was detected in ggml-org llama.cpp up to 0.4.0. This impacts the function rpcserver::deserializetensor of the file ggml/src/ggml-rpc/ggml-rpc.cpp of the component RPC Server. Performing a manipulation of the argument ne results in reachable assertion. The attack is possible to be...

CVE-2026-86317 ggml-org llama.cpp RPC Server ggml-rpc.cpp deserialize_tensor assertion

A vulnerability was detected in ggml-org llama.cpp up to 0.4.0. This impacts the function rpcserver::deserializetensor of the file ggml/src/ggml-rpc/ggml-rpc.cpp of the component RPC Server. Performing a manipulation of the argument ne results in reachable assertion. The attack is possible to be...

CVE-2026-86317

ggml-org llama.cpp versions up to 0.4.0 contain a vulnerability in the RPC Server component, specifically the rpc_server::deserialize_tensor function in ggml/src/ggml-rpc/ggml-rpc.cpp. Manipulation of the ne argument triggers a reachable assertion , leading to a denial-of-service condition. The a...