PT-2026-144522

In bytes are equal of lib.rs, there is a possible way to recover authentication keys due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-65138

NVIDIA Slurm contains an attacker-controlled arbitrary-memory read in the slurmstepd socket API that could be used to ex-filtrate authentication keys...

EUVD-2026-116011

NVIDIA Slurm contains an attacker-controlled arbitrary-memory read in the slurmstepd socket API that could be used to ex-filtrate authentication keys...

CVE-2026-65138

NVIDIA Slurm (Slurm Workload Manager) is vulnerable to an arbitrary-memory read (specifically a heap over-read ) within the slurmstepd socket API and the slurmd daemon. The flaw occurs when unpacking a malformed forward data RPC or handling a forward data RPC with a missing socket address , which...

CVE-2026-65138

NVIDIA Slurm contains an attacker-controlled arbitrary-memory read in the slurmstepd socket API that could be used to ex-filtrate authentication keys...

CVE-2026-65138: NVIDIA Slurm: NVIDIA Slurm contains an attacker-controlled arbitrary-memory read in the slurmstepd socket API that could be used to…

NVIDIA Slurm contains an attacker-controlled arbitrary-memory read in the slurmstepd socket API that could be used to ex-filtrate authentication keys...

CVE-2026-114444

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not restrict its File System Watcher file viewer to Super Admins or to the files it legitimately tracks, allowing a non-super-admin administrator, including a subsite administrator on WordPress...

CVE-2026-114444 Security by CleanTalk < 2.191 - Admin+ Sensitive Data Disclosure via FSWatcher File Viewer

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not restrict its File System Watcher file viewer to Super Admins or to the files it legitimately tracks, allowing a non-super-admin administrator, including a subsite administrator on WordPress...

EUVD-2026-113724

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not restrict its File System Watcher file viewer to Super Admins or to the files it legitimately tracks, allowing a non-super-admin administrator, including a subsite administrator on WordPress...

CVE-2026-114444 Security by CleanTalk < 2.191 - Admin+ Sensitive Data Disclosure via FSWatcher File Viewer

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not restrict its File System Watcher file viewer to Super Admins or to the files it legitimately tracks, allowing a non-super-admin administrator, including a subsite administrator on WordPress...

CVE-2026-115223

The Smart Popup by Supsystic WordPress plugin before 2.0.2 does not prevent template-injection payloads from being stored in a popup text block and later evaluated by its template engine, because the filter meant to strip template delimiters runs before a decoding step that reconstructs them,...

PT-2026-128092

The Smart Popup by Supsystic WordPress plugin before 2.0.2 does not prevent template-injection payloads from being stored in a popup text block and later evaluated by its template engine, because the filter meant to strip template delimiters runs before a decoding step that reconstructs them,...

CVE-2026-87940

Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key auth allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Key auth versions: from 0.0.0 to 2.2.4...

EleutherAI Language Model Evaluation Harness server-side request forgery vulnerability

The EleutherAI Language Model Evaluation Harness contains a server-side request forgery vulnerability. This vulnerability arises because the lm-evaluation-harness component fails to validate model URLs specified in JobSpecs. Authenticated users can submit malicious model URLs, resulting in the...

DRUPAL-CONTRIB-2026-138

This module enables you to add key-based authentication on a per-user basis. The module doesn't cache per user, potentially allowing an attacker to view another user's authentication keys, if the attacker has the same permissions. This vulnerability is mitigated by the fact that the site must hav...

PT-2026-89240

Name of the Vulnerable Software and Affected Versions Drupal Key auth versions 0.0.0 through 2.2.4 Description Incorrectly configured access control security levels allow the use of web browser cache containing sensitive information. The module fails to cache data on a per-user basis, which may...

Fedora 43 : bird (2026-3521e54a27)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-3521e54a27 advisory. BIRD 3.3.2 2026-07-30 - BGP: Fix stack buffer overflow in Flowspec NLRI decoder - BGP: Minor improvements in Flowspec parsing - BGP: Fix minor issues with se...

CVE-2026-15978

The SGLang framework, an open-source tool for serving large language models, contains a model weight exfiltration vulnerability (CVE-2026-15978 ). When no API keys are configured, the framework exposes two endpoints that allow a remote attacker to trigger distributed weight broadcasting via NCCL ...

PT-2026-59253

Impact Two endpoints used to preview an MCP server before saving it — POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list — accepted a full server configuration in the request body, including the command, args, and env fields used by the stdio transport. When called with a stdio...

Linux SCTP Kernel Data Compromise

The vulnerabilities of the functions sctpauthsetkey and sctpauthsetactivekey in the net/sctp/auth.c module of the Linux operating system’s SCTP protocol implementation are related to the reutilization of previously freed memory. Exploiting these vulnerabilities can allow a remote attacker to...