EUVD-2026-54738

The WP Directory Kit WordPress plugin before 1.5.5 does not sanitize and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks authorization and nonce checks, allowing any authenticated user such as a Subscriber to perform SQL injection...

CVE-2026-18568

XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic check. verify in lib/XML/Sig.pm counts the //dsig:Signature elements into $numsigs and iterates over them, but two paths reach...

CVE-2026-0392 eParakstītājs 3.0 for Windows – remote code execution via unauthenticated auto-update

eParakstītājs 3.0 for Windows before version 1.10.0 retrieves and executes its automatic updates over a channel that is not authenticated or integrity-protected. On each launch the application fetches an update descriptor XML over TLS but accepts any TLS certificate a permissive TrustManager and ...

RUSTSEC-2026-0219 Remote Denial of Service via malformed NIP-04 IV

The nostr crate did not validate the length of the initialization vector decoded from the ?iv= portion of a NIP-04 encrypted message. The decoded IV was converted from a byte slice to the 16-byte AES-CBC IV type using a conversion that asserts the slice length. As a result, an IV whose decoded...

EUVD-2026-48898

In the Linux kernel, the following vulnerability has been resolved: bpf: Validate BTF repeated field counts before expansion btfparsestructmetas walks user-supplied BTF during BPFBTFLOAD, and btfrepeatfields expands repeatable fields from array elements into the fixed BTFFIELDSMAX scratch array...

CVE-2026-64354 bpf: Validate BTF repeated field counts before expansion

In the Linux kernel, the following vulnerability has been resolved: bpf: Validate BTF repeated field counts before expansion btfparsestructmetas walks user-supplied BTF during BPFBTFLOAD, and btfrepeatfields expands repeatable fields from array elements into the fixed BTFFIELDSMAX scratch array...

CVE-2026-64354 bpf: Validate BTF repeated field counts before expansion

In the Linux kernel, the following vulnerability has been resolved: bpf: Validate BTF repeated field counts before expansion btfparsestructmetas walks user-supplied BTF during BPFBTFLOAD, and btfrepeatfields expands repeatable fields from array elements into the fixed BTFFIELDSMAX scratch array...

PYSEC-2026-2909 PraisonAI's symlink-extraction bypass of `_safe_extractall` writes outside `dest_dir`

Summary The safeextractall helper that all recipe pull, recipe publish, and recipe unpack flows route through validates each archive member's name for absolute paths, .. segments, and resolved-path escape — but does not validate member.linkname, does not reject symlink/hardlink members, and calls...

GHSA-529H-VH3J-85HQ Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template`

Description The per-template filter, tag and function allow-list check is compiled into the checkSecurity method of each Template subclass and was invoked once from the constructor, gated by SandboxExtension::isSandboxed$source. Template instances are then cached on the Environment in...

CVE-2026-14324

CVE-2026-14324 — Pipewire RAOP module vulnerability. The RAOP module accepts unbounded Content-Length values and does not validate the return of pw_array_add(), which can lead to a null dereference. This is a technical detail documented in the CVE record and CVE-list entry. The CVSSv3.1 metrics i...

PT-2026-55213

Name of the Vulnerable Software and Affected Versions Twig versions prior to 3.27.0 Description In the template language for PHP, the allow-list verdict for filters, tags, and functions is computed during the construction of a Template instance and cached. This allows a sandboxed render to reuse ...

Unsafe Dependency Resolution

Overview org.jenkins-ci.plugins:script-security is a package that allows Jenkins administrators to control what in-process scripts can be run by less-privileged users. Affected versions of this package are vulnerable to Unsafe Dependency Resolution via Groovy AST transformation annotations during...

PT-2026-50478

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.9.6 Description An authorization bypass exists in the calendar event update process. The endpoint '/api/v1/calendars/events/event id/update' validates that the user has write access to the calendar where the even...

Out-of-bounds read in `nth` / `nth_back` for `PyList` and `PyTuple` iterators

PyO3 0.24.0 added optimized implementations of Iterator::nth and DoubleEndedIterator::nthback for the BoundListIterator and BoundTupleIterator types. These implementations computed the target index using unchecked usize addition index + n before bounds-checking against the sequence length, then...

EUVD-2026-32645

Function calls to WOSCommonUtil.dll!WOSSysInfoGetDeviceInterface in various DLLs i.e., WOSProfileMgrModule.dll, WOSWebDavModule.dll can return a NULL pointer i.e., when no user is logged into the Triofox Server Agent Management Console. The returned NULL pointer is not checked before being...

GHSA-HVV7-HFRH-7GXJ Nezha Monitoring: Nezha WebSocket server stream discloses cross-tenant server telemetry to authenticated members

Summary Any authenticated non-admin member can connect to the server-status WebSocket and receive telemetry for all servers, including servers owned by other users. The normal server list API filters objects by HasPermission, but the WebSocket stream treats the presence of any authenticated user ...

RUSTSEC-2026-0146 `InterfaceAccount` allows account substitution between unexpected types

Affected versions of anchor-lang allowed InterfaceAccount to accept accounts with an unexpected Anchor discriminator. A change to InterfaceAccount caused checked deserialization to be bypassed for this account wrapper, so validation proved only that the account owner matched one of the accepted...

Ech0's OAuth redirect URI validation ignores path component, enables exchange-code theft

Summary parseAndValidateClientRedirect at internal/service/auth/auth.go:448 validates OAuth client-redirect URIs by comparing only scheme and host against the admin-configured allowlist. Path, query, and fragment are ignored. The initiator at /oauth/:provider/login embeds the caller-supplied...

Machine-Checked Cardinality Bounds for Masked Barrett Reduction: A 1-Bit Side-Channel Leakage Barrier in Post-Quantum Cryptographic Hardware

Barrett reduction is the nonlinear core of every practical NTT-based post-quantum cryptography implementation. Existing composition frameworks ISW, t-SNI, PINI, DOM address Boolean masking over GF2; none provides a machine-checked characterization of Barrett's leakage under first-order arithmetic...

ClearanceKit 安全漏洞

ClearanceKit is a macOS file system access control tool developed by Craig J. Bass. Versions of ClearanceKit prior to 5.0.4-beta-1f46165 contained security vulnerabilities. These vulnerabilities stemmed from the endpoint security event handler only checking the source path for double-path...