EUVD-2026-54238

Dinky's SysConfigController.getAll handler for GET /api/sysConfig/getAll carries a method-level @SaIgnore annotation that short-circuits the class-level @SaCheckLogin, so the Sa-Token interceptor lets the request through with no session or role check. Any remote unauthenticated caller who can rea...

EUVD-2026-54182

TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read in the Dictionary compression reverse row iterator tsl/src/compression/algorithms/dictionary.c. The forward path validates the decoded index; the reverse path uses an assertion compiled out of release builds,...

EUVD-2026-54179

TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read vulnerability in the Gorilla compression reverse row iterator that allows authenticated attackers to cause a denial of service by storing a crafted compressed datum with an internally inconsistent BitArray...

CVE-2026-68823

Exposed dangerous method or function in Azure Confidential Ledger allows an authorized attacker to execute code over a network...

PT-2026-69057

Name of the Vulnerable Software and Affected Versions Nexus Repository 3 affected versions not specified Description Insufficient sandboxing of JEXL Java Expression Language expressions used in Content Selectors allows an account with the nexus:selectors:create permission to construct expressions...

📄 DCMTK 3.7.0 DICOMDIR Icon Integer Overflow

DCMTK DICOM ToolKit version 3.7.0 has an integer overflow in the PGM image size calculation that results in an undersized heap allocation. The subsequently unchecked conversion of the image dimensions from unsigned int to Uint16 causes the image scaler to process a much larger image than was...

📄 Ghost CMS 6.19.0 Remote Code Execution

This Metasploit module exploits a remote code execution vulnerability in Ghost CMS. Specifically crafted malicious themes can execute arbitrary code on the server running Ghost. The affected versions include all releases from 0.7.2 up to and including 6.19.0. For versions 5.105.0-5.130.5 and...

Node.js Module axios < 0.33.0 / 1.x < 1.18.0 Prototype Pollution

The version of the axios Node.js module installed on the remote host is prior to 0.33.0 or 1.x prior to 1.18.0. It is, therefore, affected by multiple vulnerabilities: - axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has...

SolarWinds Web Help Desk < 2026.2.1 SAML Authentication Bypass (CVE-2026-28323)

The version of SolarWinds Web Help Desk installed on the remote host is prior to 2026.2.1. It is, therefore, affected by a SAML authentication bypass vulnerability: - SolarWinds Web Help Desk is found to be affected by a SAML authentication bypass vulnerability. This requires the SAML 2.0...

Linux Distros Unpatched Vulnerability : CVE-2026-62292

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.1, a crafted uncompressed HEIF image using generic zlib unci full-item...

📄 DCMTK 3.7.0 RLE Encoder Heap Out-of-Bounds Read

A proof of concept for a heap out-of-bounds read vulnerability in DCMTK version 3.7.0. The vulnerability is caused by an integer overflow in the RLE encoder's expected-size sanity check. By supplying crafted image dimensions that cause the 32-bit size calculation to wrap around, an attacker can...

MiracleLinux 9 : plexus-utils-3.3.0-14.el9_8 (AXSA:2026-1492:01)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1492:01 advisory. org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method CVE-2025-67030 Tenable has extracted the preceding description bloc...

📄 WordPress WP2Shell SQL Injection / Remote Code Execution

This Metasploit module chains two WordPress core vulnerabilities, together known as WP2Shell, to gain unauthenticated remote code execution against default installs of WordPress 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. The vulnerabilities are fixed in WordPress 6.9.5 and 7.0.2. CVE-2026-60137...

Understanding and Improving Model Editing for Secure Code Generation

Large language models LLMs are widely used for code generation, yet they can reproduce vulnerable implementations learned from insecure training patterns. Prior work has mainly explored inference-time hardening, which reduces insecure generations without modifying the target model but relies on...

Linux Distros Unpatched Vulnerability : CVE-2026-16441

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Eclipse OpenJ9 versions up to 0.60, when executing class files where a previously concrete superclass method has been recompiled as abstract, execution is...

Linux Distros Unpatched Vulnerability : CVE-2026-16439

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Eclipse OpenJ9 versions up to 0.60, using -Xtrace to trace method arguments can lead to buffer underflow. CVE-2026-16439 Note that Nessus relies on the...

MIFA: An MILP-Based Framework for Improving Differential Fault Attacks

At ASIACRYPT 2021, Baksi et al. introduced DEFAULT, a block cipher designed to algorithmically resist Differential Fault Attack DFA, claiming 64-bit DFA security regardless of the number of injected faults. At EUROCRYPT 2022, Nageler et al. demonstrated that DEFAULT's claimed DFA resistance can b...

Security update for perl-Mojolicious (moderate)

openSUSE Security Update: Security update for perl-Mojolicious Announcement ID: openSUSE-SU-2026:0278-1 Rating: moderate References: 1271431 Cross-References: CVE-2026-15747 CVSS scores: CVE-2026-15747 SUSE: 5.9 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N Affected Products:...

CVE-2026-68823

Exposed dangerous method or function in Azure Confidential Ledger allows an authorized attacker to execute code over a network...

CVE-2026-68823

Azure Confidential Ledger is affected by CVE-2026-68823, a remote code execution vulnerability caused by an exposed dangerous method/function. An authorized attacker could exploit this over the network to execute code. The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H with a bas...