CVE-2026-105298

Summary Before version 0.9.0, Pingora accepted HTTP/2 requests whose Host header differed from the :authority pseudo-header. Request filters, cache keys, and logs that read the request URI session.reqheader.uri saw the :authority value, but the upstream received the client-supplied Host value...

CVE-2026-105298 Pingora HTTP/2 :authority and Host header mismatch enables cache poisoning and host-based access control bypass

Summary Before version 0.9.0, Pingora accepted HTTP/2 requests whose Host header differed from the :authority pseudo-header. Request filters, cache keys, and logs that read the request URI session.reqheader.uri saw the :authority value, but the upstream received the client-supplied Host value...

CLEANSTART-2026-NF66444 HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a r...

CVE-2026-78663 affects multiple packages. The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. See references f...

databricks-session (>=0.0.1, <=0.1.8), geochemistrypi (>=0.7.0, <=0.8.2) +1 more potentially affected by CVE-2026-53995 via mlflow (2.4.1)

mlflow PYPI version 2.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-session =0.0.1, =0.7.0, =0.3.0, =0.3.3 Source cves: CVE-2026-53995 Source advisory: OSV:GHSA-WQMH-QCCW-PQWF...

Security vulnerabilities in Oracle Management Pack for Oracle GoldenGate

A security vulnerability exists in Oracle Management Pack for Oracle GoldenGate versions 13.4.1.0.1 through 13.5.2.0.6. This vulnerability stems from an issue within the EM Plugin component and may allow unauthenticated attackers to gain access via physical communication channels, thereby taking...

Siemens SIMATIC S7-1500 TM MFP Improper Control of a Resource Through its Lifetime (CVE-2026-43503)

"In the Linux kernel, the following vulnerability has been resolved: net: skbuff: propagate shared-frag marker through frag-transfer helpers Two frag-transfer helpers pskbcopyfclone and skbshift fail to propagate the SKBFLSHAREDFRAG bit in skbshinfo-flags when moving frags from source to...

Contextual Candour: Role-Aware Graduated Disclosure for LLMs over Mixed-Sensitivity Contexts

LLMs increasingly operate over mixed-sensitivity contexts, where they must reason over information ranging from public to confidential while disclosing only what the user is authorised to receive. Existing approaches enforce access control as a binary decision: either fully answering or refusing,...

MAS-Guard: Unified Guardrails from Individual Agents to Multi-Agent LLM Systems

Agentic AI extends large language models LLMs from generating responses to planning and executing complex workflows, substantially expanding their utility while exposing applications to unsafe actions, information leakage, and adversarial manipulation. Multi-agent systems further expand these...

SPECTER: Covert Data Exfiltration from Air-Gapped Systems Via USB Power Modulation

We present SPECTER, a post-compromise covert channel that uses host-side USB power control to exfiltrate information from air-gapped and network-segregated systems. A transmitter with administrative privileges encodes bits through USB power-management or device-state operations without placing th...

PT-2026-125048

Pingora versions prior to 0.9.0 accepted HTTP/2 requests whose Host header differed from the :authority pseudo-header. Request filters, cache keys, and logs that read the request URI session.req header.uri saw the :authority value, but the upstream received the client-supplied Host value. Pingora...

PT-2026-117933

Summary Before version 0.9.0, Pingora accepted HTTP/2 requests whose Host header differed from the :authority pseudo-header. Request filters, cache keys, and logs that read the request URI session.req header.uri saw the :authority value, but the upstream received the client-supplied Host value...

PT-2026-118305

The backend module does not check whether a backend user has access to the requested site. Users with access to the module can therefore open the analytics dashboard of any site...

PT-2026-119992

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware Control versions 12.2.1.4.0 Oracle Fusion Middleware Control versions 14.1.2.0.0 Description An issue in the Framework component of Oracle Fusion Middleware Control allows an attacker with physical access to compromise...

PT-2026-119408

Name of the Vulnerable Software and Affected Versions Oracle Primavera Unifier versions 23.12.0 through 23.12.16 Description A flaw in the Project Control component allows a low privileged attacker with network access via HTTP to compromise the system. This can lead to unauthorized read access to...

PT-2026-118359

In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, POST, PUT, and PATCH bodies on routes that enable template substitution are rendered by an uncapped Liquid engine before authentication and RBAC. The bearer check does not reject a missing or invalid token, and the auth rate limit applies...

PT-2026-118424

Name of the Vulnerable Software and Affected Versions Booktics versions prior to 1.0.31 Description An issue exists where missing authorization allows for the exploitation of incorrectly configured access control security levels. Recommendations Update to version 1.0.31 or later...

PT-2026-118439

A ThreadX module allocates the control blocks of its kernel objects from the Module Manager's object pool, and can ask for that memory back by address with txm module object deallocate. The manager released it whatever was in it, including a control block the kernel was still using. Deallocation ...

Google Chrome Vulnerability: CVE-2026-113159

Improper access control in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially leak sensitive information via a crafted HTML page. Chromium security severity: Medium...

Google Chrome Vulnerability: CVE-2026-113129

Improper access control in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially leak sensitive information via a crafted HTML page. Chromium security severity: Medium...

Google Chrome Vulnerability: CVE-2026-113297

Improper access control in Ozone in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak sensitive information via a crafted HTML page. Chromium security severity: Medium...