PT-2026-98474

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the f2fs filesystem within the free segment range function. The system temporarily reduces MAIN SECSsbi by secs to limit block allocation to a safe area while Garbage...

The vulnerability of the journal message formation mechanism during the check of the MongoDB database system’s collection schema allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the journal message formation mechanism, when checking the schema of the MongoDB database management system’s collection, is related to the disclosure of information through registration files. Exploiting this vulnerability can allow an attacker, operating remotely, to gain...

CVE-2026-26012

CVE-2026-26012 - Prueba de Concepto Omisión de Permisos de Colección para Miembros Autenticados y Enumeración de Cifrados Vaultwarden Referencia NVD: CVE-2026-26012 CVSSv3| Vector de Ataque| Complejidad de Ataque| Privilegios Requeridos| Interacción del Usuario| Confidencialidad| Integridad|...

Google’s location data privacy failures draw a €403 million fine

The Irish Data Protection Commission DPC has fined Google €403 million $459 million for violating European privacy law. The penalty follows a six-year inquiry into Google’s management of user location data between May 2018 and February 2020. During that time, Google collected users’ location data...

CVE-2026-14443: Insertion of Sensitive Information into Log File

Incomplete log sanitization during bulk IPsec policy collection in Brocade SANnav versions before 3.0.1a permit extension switch pre-shared keys to be written to system logs. Individuals with read access to container logs or support archives can obtain these keys, leading to the potential...

CVE-2026-77766

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not scope one of its REST collection endpoints to the requesting user, allowing users with a subscriber-level account to read every customer's order and payment records. Versions 8.8.1 to...

EUVD-2026-85026

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not scope one of its REST collection endpoints to the requesting user, allowing users with a subscriber-level account to read every customer's order and payment records. Versions 8.8.1 to...

Security Bulletin: IBM Sterling Secure Proxy is affected by multiple vulnerabilities in Bouncy Castle for Java FIPS

Summary IBM Sterling Secure Proxy is affected by multiple vulnerabilities CVE-2026-13505, CVE-2026-9563 in Bouncy Castle for Java FIPS and are addressed in version 6.2.1.3. Vulnerability Details CVEID:CVE-2026-13505 DESCRIPTION: In Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X...

PT-2026-97162

Name of the Vulnerable Software and Affected Versions The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin versions prior to 8.9.5 Description A REST collection endpoint is not scoped to the requesting user, which allows users with subscriber-level accounts t...

CVE-2026-77766: Authorization Bypass Through User-Controlled Key

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not scope one of its REST collection endpoints to the requesting user, allowing users with a subscriber-level account to read every customer's order and payment records. Versions 8.8.1 to...

Incomplete log sanitization during bulk IPsec policy collection in Brocade SANnav

Incomplete log sanitization during bulk IPsec policy collection in Brocade SANnav versions before 3.0.1a permit extension switch pre-shared keys to be written to system logs. Individuals with read access to container logs or support archives can obtain these keys, leading to the potential...

conpot v1.0.0

Conpot About Conpot is an ICS honeypot with the goal to collect intelligence about the motives and methods of adversaries targeting industrial control systems. Documentation The documentation can be found here. If you are just checking out conpot, we suggest that you go for quick install. If you...

CVE-2026-94109

openEQUELLA versions before 2026.1.0 are affected by a remote code execution vulnerability in FreeMarker template compilation, caused by an unsandboxed TemplateClassResolver configuration. Authenticated attackers can inject malicious template expressions via collection summaries , dashboard portl...

PT-2026-95928

Name of the Vulnerable Software and Affected Versions Meow Gallery versions prior to 5.5.5 Description Insufficient sanitization of user-supplied values allows unauthenticated users to execute arbitrary registered shortcodes. This occurs when input is concatenated into a shortcode string and pass...

maigret v0.6.6

Maigret English · 简体中文 · Français 📖 Documentation Maigret collects a dossier on a person by username only , checking for accounts on a huge number of sites and gathering all the available information from web pages. No API keys required. AI profiling demo. Sponsors Noimosiny is a comprehensive...

BIT-MONGODB-2026-82071 Insufficient Validation of Storage Engine Configuration Options in MongoDB Server Leads to Out-of-Bounds Write

Insufficient validation of storage engine configuration options in MongoDB Server allows an authenticated user with write privileges to supply crafted parameters during collection creation that override internal storage metadata. This results in an out-of-bounds memory write in the server process...

BIT-MONGODB-2026-82057 Type Confusion in MongoDB Server WiredTiger Storage Engine via Custom Collection Configuration Leads to Persistent Denial of Service

A security issue was discovered in MongoDB where an authenticated user with readWrite privileges could crash the mongod server process. By specifying a custom WiredTiger storage configuration option with an incompatible value during collection creation, a user could cause a type confusion in the...

CVE-2026-92782

Chroma through 1.5.9 fails to validate tenant and database segments when resolving collections, allowing authenticated attackers to access collections from other tenants by knowing the collection identifier. Attackers can read, modify, and update records in foreign collections by issuing requests...

Container_escape

Linux container escape PoCs Target-specific proof-of-concept...

CVE-2026-92782 Chroma through 1.5.9 Authorization Bypass via Collection Identifier

Chroma through 1.5.9 fails to validate tenant and database segments when resolving collections, allowing authenticated attackers to access collections from other tenants by knowing the collection identifier. Attackers can read, modify, and update records in foreign collections by issuing requests...