CVE-2026-46600

Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer...

CVE-2026-46600 Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage

Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer...

CVE-2026-46600

The golang package (specifically golang.org/x/net/dns/dnsmessage) is vulnerable to a panic when parsing an invalid SVCB or HTTPS RR . This occurs because the size of a parameter value can overflow the message buffer, leading to an out-of-bounds read (CWE-125). The vulnerability affects golang ver...

CVE-2026-46600

Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer...

CVE-2026-46600 Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage

Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer...

EUVD-2026-41903

PostgreSQL JDBC Driver: Silent channel-binding authentication downgrade via unsupported certificate algorithms...

PostgreSQL JDBC Driver: Silent channel-binding authentication downgrade via unsupported certificate algorithms

Impact channelBinding=require connections can be silently downgraded from SCRAM-SHA-256-PLUS with channel binding to plain SCRAM-SHA-256 without it, losing the man-in-the-middle protection the setting is meant to guarantee. An attacker who can intercept the TLS connection triggers the downgrade...

GHSA-J92G-9F8W-J867 PostgreSQL JDBC Driver: Silent channel-binding authentication downgrade via unsupported certificate algorithms

Impact channelBinding=require connections can be silently downgraded from SCRAM-SHA-256-PLUS with channel binding to plain SCRAM-SHA-256 without it, losing the man-in-the-middle protection the setting is meant to guarantee. An attacker who can intercept the TLS connection triggers the downgrade...

CVE-2026-47418 praisonai-platform: Project endpoints accept any project_id without workspace ownership check, cross-workspace read/update/delete IDOR

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The project CRUD endpoints GET / PATCH / DELETE /workspaces/workspaceid/projects/projectid and GET .../projectid/stats gate access on...

EUVD-2026-46297

PraisonAI is a multi-agent teams system. CVE-2026-44338 GHSA-6rmh-7xcm-cpxj documents that PraisonAI ships a code-generator praisonai.deploy.api.generateapiservercode that emits a Flask API server with authentication disabled by default. Users who follow the documented quickstart praisonai deploy...

Trezor Safe improper security check in on-device display

RISK EVALUATION Trezor Safe 3, Safe 5, and Safe 7 firmware contains a confirmation-binding flaw in the Ethereum signtx / signtxeip1559 flow. For contract interactions, the device confirms only the initial calldata chunk while the signature commits to the full streamed calldata. An attacker could...

CVE-2026-54291

A flaw was found in pgjdbc, an open-source PostgreSQL JDBC Driver. A remote attacker who can intercept a TLS Transport Layer Security connection can silently downgrade connections configured to require channel binding from SCRAM-SHA-256-PLUS to plain SCRAM-SHA-256. This downgrade bypasses the...

Exploit for Generation of Error Message Containing Sensitive Information in Apache Camel

camel-netty-http / camel-undertow muteException Stack-Trace Di...

Security Bulletin: IBM Sterling Connect:Direct Web Services is Affected by Multiple Vulnerabilities.

Summary postgresql-42.7.11.jar is used by IBM Sterling Connect:Direct Web Services CVE-2026-54291. Vulnerability Details CVEID:CVE-2026-54291 DESCRIPTION: pgjdbc is an open source postgresql JDBC Driver. In releases 42.7.4 through 42.7.11, channelBinding=require connections can be silently...

PT-2026-62125

The MCTP-over-I2C+GPIO target binding in Zephyr subsys/pmci/mctp/mctp i2c gpio target.c processes pseudo-register writes from an I2C bus master byte-by-byte in mctp i2c gpio target write received without validating the order or the receive buffer. In the affected versions the MCTP I2C GPIO RX MSG...

CVE-2026-65058: Improperly Implemented Security Check for Standard

Trezor Safe 3, Safe 5, and Safe 7 firmware contains a confirmation-binding flaw in the Ethereum signtx / signtxeip1559 flow. For contract interactions, the device confirms only the initial calldata chunk while the signature commits to the full streamed calldata. An attacker could present calldata...

EUVD-2026-46112

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to version 5.0.10, each table in the on-disk SQLite policy store /Library/Application Support/clearancekit/store.db is verified using an ECDSA signature stored in the datasignatures table. T...

CVE-2026-58482

In Network-AI, the ApprovalInbox HTTP surface (lib/approval-inbox.ts) exposes state-changing endpoints POST /approvals/:id/approve and /deny without authentication and with Access-Control-Allow-Origin: * across all routes. This allows any reachable actor to enumerate and approve high-risk actions...

CVE-2026-63970

CVE-2026-63970 — Linux kernel vulnerability in vsock/virtio where zerocopy skb handling could fail due to allocation order: uarg must be bound before filling the skb to ensure correct lifetime handling. The fix ensures the zerocopy uarg is passed into virtio_transport_alloc_skb() and bound prior ...

Cross-site Request Forgery (CSRF)

Kimai is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is due to state-changing team creation and object-binding operations being exposed through GET routes without CSRF protection, which allows an attacker to trick an authenticated user into making unauthorized changes to team...