firefox: thunderbird: Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component...

CVE-2026-94368

A flaw was found in the signature verification logic of noobaa-core, the core component of the NooBaa Multicloud Object Gateway. The issue occurs when the service processes S3 presigned URLs using Signature Version 4 SigV4. Due to improper validation, the service fails to reject requests containi...

CVE-2026-94368 Noobaa-core: noobaa-core: presigned put url escalation to copyobject via unsigned x-amz-copy-source header

A flaw was found in the signature verification logic of noobaa-core, the core component of the NooBaa Multicloud Object Gateway. The issue occurs when the service processes S3 presigned URLs using Signature Version 4 SigV4. Due to improper validation, the service fails to reject requests containi...

CVE-2026-94368 Noobaa-core: noobaa-core: presigned put url escalation to copyobject via unsigned x-amz-copy-source header

A flaw was found in the signature verification logic of noobaa-core, the core component of the NooBaa Multicloud Object Gateway. The issue occurs when the service processes S3 presigned URLs using Signature Version 4 SigV4. Due to improper validation, the service fails to reject requests containi...

CVE-2026-94368

NooBaa-core , the core component of the NooBaa Multicloud Object Gateway , contains a flaw in its SigV4 signature verification logic. When processing S3 presigned URLs, the service drops unsigned x-amz- headers from the signature calculation instead of rejecting them. An attacker holding a valid ...

EUVD-2026-83898

A flaw was found in the signature verification logic of noobaa-core, the core component of the NooBaa Multicloud Object Gateway. The issue occurs when the service processes S3 presigned URLs using Signature Version 4 SigV4. Due to improper validation, the service fails to reject requests containi...

CVE-2026-94368

A flaw was found in the signature verification logic of noobaa-core, the core component of the NooBaa Multicloud Object Gateway. The issue occurs when the service processes S3 presigned URLs using Signature Version 4 SigV4. Due to improper validation, the service fails to reject requests containi...

CVE-2026-94368: Improper Verification of Cryptographic Signature

A flaw was found in the signature verification logic of noobaa-core, the core component of the NooBaa Multicloud Object Gateway. The issue occurs when the service processes S3 presigned URLs using Signature Version 4 SigV4. Due to improper validation, the service fails to reject requests containi...

Important: postgresql security update

PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions CVE-2026-14662 postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in...

PT-2026-96086

Name of the Vulnerable Software and Affected Versions noobaa-core affected versions not specified Description A flaw exists in the signature verification logic of the noobaa-core component within the NooBaa Multicloud Object Gateway. When processing S3 presigned URLs using Signature Version 4...

Updated ntpsec packages fix a security vulnerability

Buffer Copy without Checking Size of Input 'Classic Buffer Overflow' in ntpsec. CVE-2026-18321...

CVE-2026-81653: Authorization Bypass Through User-Controlled Key

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user acting on an image owns the gallery it belongs to, allowing users granted its gallery-management capability by an administrator to delete, copy and re-tag any image on the site, including images i...

PT-2026-95918

Name of the Vulnerable Software and Affected Versions The Photo Gallery, Sliders, Proofing and WordPress plugin versions prior to 4.5.0 Description The plugin fails to verify if the user performing an action on an image is the owner of the gallery to which the image belongs. This allows users who...

EUVD-2026-83200

LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, an authenticated user could submit caller-controlled recordIds to the DuplicateRecordsToOtherVehicles endpoint while naming destination vehicleIds the user could edit. The endpoint...

WordPress Secure Copy Content Protection and Content Locking plugin < 5.1.5 - Admin+ Stored XSS via ays_sccp_sub_icon_image Parameter vulnerability

Admin+ Stored XSS via ayssccpsubiconimage Parameter vulnerability discovered by Luca Jungnickel in WordPress Plugin Secure Copy Content Protection and Content Locking versions 5.1.5...

WordPress Live Copy Paste for Elementor plugin <= 1.5.6 - Cross-Site Scripting vulnerability

Cross-Site Scripting vulnerability discovered by ? in WordPress Plugin Live Copy Paste for Elementor versions = 1.5.6...

ROS-20260918-73-0061

The vulnerability of the Linux operating system’s kernel is related to the copying of buffers without checking the input data. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260918-73-0047

The vulnerability of the digitalinrecvsddres function in the net/nfc/digitaltechnology.c module of the NFC subsystem of the Linux operating system is related to the copying of buffers without checking the input data. Exploiting this vulnerability could allow an attacker to influence the...

Linux Distros Unpatched Vulnerability : CVE-2026-90086

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xsk: honor XDPTXMETADATA in zero-copy path The zero-copy path reads TX metadata whenever the UMEM has metadata space, even if the descriptor does not set...

CVE-2026-53557

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated user can supply a crafted sheet"tableName" value in the Excel datasource configuration submitted through POST /api/v1/datasource/, and SQLBot stores that value without safe...