GHSA-5CWR-5JXG-PCF6 Winter: Stored XSS through cached Brand Settings and Editor Settings custom styles

Impact Users with the backend.managebranding "Customize the back-end" or backend.manageeditor "Manage global code editor preferences" permission can provide custom CSS through Settings → Customize Backend → Styles or Settings → Editor Settings → Markup Styles that is compiled through the LESS CSS...

CVE-2026-74791

Scriban before 7.0.0 fails to clear the CachedTemplates dictionary when TemplateContext.Reset is called, allowing cached templates to persist across reused contexts. Attackers can exploit request-dependent ITemplateLoader implementations to access previously authorized template content from earli...

CVE-2026-74791 Scriban before 7.0.0 Authorization Bypass via Stale Include Cache

Scriban before 7.0.0 fails to clear the CachedTemplates dictionary when TemplateContext.Reset is called, allowing cached templates to persist across reused contexts. Attackers can exploit request-dependent ITemplateLoader implementations to access previously authorized template content from earli...

CVE-2026-74791

Scriban before 7.0.0 fails to clear the CachedTemplates dictionary when TemplateContext.Reset is called, allowing cached templates to persist across reused contexts. Attackers can exploit request-dependent ITemplateLoader implementations to access previously authorized template content from earli...

CVE-2026-74791 Scriban before 7.0.0 Authorization Bypass via Stale Include Cache

Scriban before 7.0.0 fails to clear the CachedTemplates dictionary when TemplateContext.Reset is called, allowing cached templates to persist across reused contexts. Attackers can exploit request-dependent ITemplateLoader implementations to access previously authorized template content from earli...

CVE-2026-14666 PostgreSQL row security caching disregards role modifications

Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy, via plan reuse. Stale policies continue until some other event invalidates t...

EUVD-2026-57834

Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy, via plan reuse. Stale policies continue until some other event invalidates t...

Vulnerability in core server (CVE-2026-14666)

PostgreSQL row security caching disregards role modifications Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy, via plan reuse...

PT-2026-71465

Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to 18.5 PostgreSQL versions prior to 17.11 PostgreSQL versions prior to 16.15 PostgreSQL versions prior to 15.19 PostgreSQL versions prior to 14.24 Description Incomplete tracking of changes to role membership, role...

CVE-2026-68149

In the Linux kernel, the following vulnerability has been resolved: fs: preserve ACLDONTCACHE state in forgetcachedacl The ACLDONTCACHE state is meant to be a constant state for the inode for filesystems that want to opt out of posix acl caching. Commit facd61053cff1 "fuse: fixes after adapting t...

CVE-2026-68427

CVE-2026-68427 affects the Linux kernel’s gpu: host1x component. The vulnerability arises in __host1x_bo_unpin(), which dereferences a memory mapping after it has been freed, causing a use-after-free. The cache outlives the mapping, so the correct approach is to reference the cache object instead...

EUVD-2026-55534

In the Linux kernel, the following vulnerability has been resolved: fs: preserve ACLDONTCACHE state in forgetcachedacl The ACLDONTCACHE state is meant to be a constant state for the inode for filesystems that want to opt out of posix acl caching. Commit facd61053cff1 "fuse: fixes after adapting t...

CVE-2026-68149

The CVE-2026-68149 entry pertains to a Linux kernel bug in ACL_DONT_CACHE handling within forget_cached_acl(). The issue arises when ACL_DONT_CACHE state is unintentionally invalidated, affecting inodes for filesystems opting out of POSIX ACL caching. Specifically, in fuse-related paths, forget_a...

CVE-2026-68149 fs: preserve ACL_DONT_CACHE state in forget_cached_acl()

In the Linux kernel, the following vulnerability has been resolved: fs: preserve ACLDONTCACHE state in forgetcachedacl The ACLDONTCACHE state is meant to be a constant state for the inode for filesystems that want to opt out of posix acl caching. Commit facd61053cff1 "fuse: fixes after adapting t...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: smb: client: The split caching of bitfields in cachedfid was introduced to avoid race conditions involving shared-byte registers. The functions isopen, haslease, and onlist are stored in the same bitfield byte within the struc...

ClickFix Attacks Deliver macOS Stealer That Can Drain Crypto Wallets

ClickFix-style attacks are being used to deliver a Go-based malware capable of stealing cryptocurrency assets, as well as browser-stored passwords, Apple iCloud Keychain data, and cached credentials. The macOS-focused infection chain is designed to deliver a shell script that profiles the host an...

CVE-2026-17600

Nexus Repository 3 is affected by CVE-2026-17600 where a user’s active session is not immediately terminated or cached permissions revoked after account deletion, deactivation, or password change. The flaw allows a user with an active session to continue interacting with the repository as if the ...

CVE-2026-17600 Nexus Repository 3 - Session Not Invalidated on User Account Deletion or Deactivation

Sonatype Nexus Repository 3 did not immediately terminate a user's active login session or revoke their cached permissions when that user's account was deleted, deactivated, or had its password changed. A user whose account was already logged in at the time of one of these actions could continue...

SUSE CVE-2026-68744

A flaw was found in SSSD. The sssnssprotocolfillinitgr function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to...

CVE-2026-68746

Not Failing Securely 'Failing Open' vulnerability in livebook-dev livebook allows an unauthenticated network client to obtain full access to a Livebook server that enforces identity through Livebook Teams. A Livebook Agent or App Server connected to Livebook Teams caches the identifier of the...