DEBIAN-CVE-2026-107822

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. ...

CVE-2026-107822

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. ...

UBUNTU-CVE-2026-107822

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. ...

EUVD-2026-95922

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. ...

CVE-2026-107822: Use of Incorrectly-Resolved Name or Reference

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. ...

EUVD-2026-43175

PraisonAI: PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL...

Security Bulletin: IBM® Db2® is vulnerable to arbitrary library loading via the CREATE WRAPPER command, allowing a privileged database user to read sensitive files from the host filesystem (CVE-2026-18166)

Summary IBM® Db2® is vulnerable to arbitrary library loading via the CREATE WRAPPER command, allowing a privileged database user to read sensitive files from the host filesystem. Vulnerability Details CVEID:CVE-2026-18166 DESCRIPTION: DB2 for Linux, UNIX and Windows includes DB2 Connect Server...

@payloadcms/plugin-multi-tenant has a cross-tenant create issue

Impact An authenticated user limited to one tenant could create a record in another tenant. This requires the multi-tenant plugin with at least one tenant-enabled collection. Reads and direct edits to an existing target-tenant document were not bypassed. You are affected if: - You are using...

GHSA-XHM9-GWGW-3Q2Q @payloadcms/plugin-multi-tenant has a cross-tenant create issue

Impact An authenticated user limited to one tenant could create a record in another tenant. This requires the multi-tenant plugin with at least one tenant-enabled collection. Reads and direct edits to an existing target-tenant document were not bypassed. You are affected if: - You are using...

CVE-2026-80821

A flaw was found in the Linux kernel's nvmet PCI Express Endpoint Function PCI-EPF component. A remote attacker can exploit this vulnerability by sending specially crafted Create IO Completion Queue CQ commands. This leads to a resource leak, as the system fails to properly release references to...

CVE-2026-89182 Gitea push-to-create bypass of FORCE_PRIVATE policy

With repository FORCEPRIVATE = true, Gitea creates new repositories as private, but the post-receive hook still applied the repo.private=false push option to an empty repository created by push. Any user who can create repositories could make their new repository public in violation of the instan...

CVE-2026-89182 Gitea push-to-create bypass of FORCE_PRIVATE policy

With repository FORCEPRIVATE = true, Gitea creates new repositories as private, but the post-receive hook still applied the repo.private=false push option to an empty repository created by push. Any user who can create repositories could make their new repository public in violation of the instan...

CVE-2026-89182

A flaw in Gitea allows authenticated users with repository creation privileges to bypass instance privacy policies. When [repository] FORCE_PRIVATE = true is enabled, the post-receive hook incorrectly applies the repo.private=false push option to empty repositories created via push. This allows u...

CVE-2026-89182 Gitea push-to-create bypass of FORCE_PRIVATE policy

With repository FORCEPRIVATE = true, Gitea creates new repositories as private, but the post-receive hook still applied the repo.private=false push option to an empty repository created by push. Any user who can create repositories could make their new repository public in violation of the instan...

CVE-2026-105864 Payload: Cross-tenant create in @payloadcms/plugin-multi-tenant

Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user limited to one tenant can create a record in another tenant when at least one tenant-enabled collection...

CVE-2026-105864 Payload: Cross-tenant create in @payloadcms/plugin-multi-tenant

Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user limited to one tenant can create a record in another tenant when at least one tenant-enabled collection...

create-graphene (>=0.0.24, <=0.0.30) potentially affected by CVE-2026-86597 via snowflake-sdk (3.1.0)

snowflake-sdk NPM version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-sdk and may be impacted: - create-graphene =0.0.24, =0.0.30 Source cves: CVE-2026-86597 Source advisory: OSV:GHSA-QQJ6-54Q6-CXV6...

create-momentum-app (>=0.1.2, <=0.5.11), foliokit (0.0.0) +1 more potentially affected by CVE-2026-104871 via @angular/ssr (>=21.1.2, <=21.2.7)

@angular/ssr NPM version =21.1.2, =0.1.2, =0.0.2, =0.0.3 Source cves: CVE-2026-104871 Source advisory: OSV:GHSA-7G7C-H8RR-7P6Q...

CVE-2026-77226

Camunda 7.24.0 before 7.24.15 contains an incorrect authorization vulnerability in the Admin web application's first-run setup endpoint, where SetupResource incorrectly determines setup availability by counting only direct members of the camunda-admin group rather than recognizing all configured...

EUVD-2026-92791

Camunda 7.24.0 before 7.24.15 contains an incorrect authorization vulnerability in the Admin web application's first-run setup endpoint, where SetupResource incorrectly determines setup availability by counting only direct members of the camunda-admin group rather than recognizing all configured...