SUSE CVE-2026-81882

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's binary property-list Unicode parser was vulnerable because the binary-property-list Unicode parser underallocated an uninitialized UTF-8 destination and did not guarantee NUL termination. The...

CVE-2026-75935

A flaw was found in Amazon ion-java. This uncontrolled memory allocation vulnerability in the binary Ion stream cursor allows remote attackers to cause a denial of service DoS by sending a specially crafted Ion binary document. The crafted document contains a declared-length field that triggers...

CGA-85CX-JM8C-3R7M

Bulletin has no description...

CGA-638Q-Q88G-5M74

Bulletin has no description...

CGA-85PR-5C7H-64C3

Bulletin has no description...

CGA-C6WH-854J-48HG

Bulletin has no description...

CGA-MP6X-256G-7QCW

Bulletin has no description...

CGA-PVR8-J5M4-CR7H

Bulletin has no description...

CGA-4GCH-F9JP-RC33

Bulletin has no description...

CGA-FQ87-4FH9-2PQR

Bulletin has no description...

CGA-2C9G-PRM4-6M8P

Bulletin has no description...

CGA-WW4P-6MQF-59M4

Bulletin has no description...

CGA-59PR-99R7-4WX7

Bulletin has no description...

CGA-J956-84WP-GF29

Bulletin has no description...

GHSA-5MMC-8PC9-WGGG WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost

Summary WPGraphQL 2.19.0 contains an authorization bypass in the updatePost mutation. An authenticated WordPress Contributor can change one of their own draft posts to PUBLISH despite lacking the publishposts capability. The same mutation also permits the Contributor to modify their own previousl...

WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost

Summary WPGraphQL 2.19.0 contains an authorization bypass in the updatePost mutation. An authenticated WordPress Contributor can change one of their own draft posts to PUBLISH despite lacking the publishposts capability. The same mutation also permits the Contributor to modify their own previousl...

Compromised MemTensor Packages Deliver sckit Credential Stealer via npm and PyPI

Unknown threat actors have managed to compromise two legitimate MemTensor packages across the npm and Python Package Index PyPI repositories to push a platform-specific Go-based implant dubbed sckit designed for Windows, Linux, and macOS. According to reports from Aikido, SafeDep, Socket, and...

learn-s90f

Samsung S90F STS timezone root-command execution This reposit...

CVE-2026-53940

A flaw was found in Conda, a system-level binary package and environment manager. An unvalidated entry-point command in a noarch:python package's metadata allows a malicious package to use path traversal. This enables writing files outside the intended installation directory or overwriting existi...

CVE-2026-81882

A flaw was found in radare2. The binary property-list Unicode parser did not properly terminate strings, leading to an underallocation of memory. A local attacker could exploit this by providing specially crafted binary property-list data and executing specific commands pFB or pFBj. This could...