SymLift: Neural Semantic Lifting for Compile-Free Vulnerability Detection in Context-Incomplete Code Fragments

Missing project context can prevent build-dependent analyzers from constructing program relations required for vulnerability detection, while neural predictions alone do not establish auditable derivations. We present SymLift, a compile-free framework centered on Vulnerability-Oriented Neural...

Amazon Linux 2023 : nginx-mod-njs (ALAS2023-2026-3300)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3300 advisory. DescriptionNGINX JavaScript njs has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and...

PT-2026-123048

Name of the Vulnerable Software and Affected Versions YesWiki versions 4.6.0 through 4.6.x YesWiki versions 5.0.0-alpha1 through 5.0.0-alpha3 Description An unauthenticated SQL injection exists in the SearchManager::prepareSearchRequest function. The issue occurs because field names from the quer...

vLLM server request forgery vulnerability

Versions prior to vLLM 0.24.0, specifically version 0.9.2, contain a server-side request forgery vulnerability. This vulnerability arises from embedding a decoding address within the X-Request-Id header, enabling server-side request forgery. Attackers can pre-populate the P2pNcclConnector with...

SPIP 4.4.16 SQL Injection / SSRF

SPIP version 4.4.16 and earlier contain an unauthenticated blind SQL injection in the sitemap endpoint and an authenticated SSRF issue caused by unvalidated HTTP redirect targets. Proof of concept material is included for both vulnerabilities. https://packetstorm.news/download/237466...

Grokability Snipe-IT encryption issue vulnerability

Versions of Grokability Snipe-IT prior to 8.7.0 contain an encryption-related vulnerability. This flaw stems from a lack of encryption in Api\AssetsController::store. When callers lack the “assets.view.encryptedcustomfields” permission, they write plaintext data into the column marked as encrypte...

Parse Platform Parse Server authorization issue vulnerability

Versions prior to Parse Platform Parse Server 8.6.101 and versions from 9.0.0 up to 9.10.4-alpha.4 contain an authorization issue vulnerability. This vulnerability stems from missing authorization checks in MongoDB deployments. Unauthenticated attackers can send delete requests to the internal...

YesWiki SQL injection vulnerability

Versions prior to YesWiki 4.7.0, specifically 4.6.0 and versions prior to 5.0.0-alpha1 in 5.0.0-alpha4, contain an SQL injection vulnerability. This vulnerability stems from unauthenticated SQL injection within SearchManager::prepareSearchRequest. In the query and searchfields parameters of the...

PT-2026-123006

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.101 Parse Server versions 9.0.0 through 9.10.4-alpha.3 Description On MongoDB deployments, a missing authorization issue allows clients without the master key to delete the stored schema of any class...

Amazon Linux 2023 : nginx, nginx-all-modules, nginx-core (ALAS2023-2026-3263)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3263 advisory. A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the...

MiracleLinux 9 : cockpit-machines-348.1-1.el9_8 (AXSA:2026-2146:02)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-2146:02 advisory. cockpit-machines: cockpit-machines: Sensitive data exposure via command-line arguments CVE-2026-92768 cockpit-machines: cockpit-machines: Sensitive...

Amazon Linux 2023 : heif-pixbuf-loader, libheif, libheif-devel (ALAS2023-2026-3314)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3314 advisory. Fix GHSA-w7mc-p8jc-p853: heap OOB read / info disclosure OpYCbCr420toRRGGBBaa Fix GHSA-9rj8-5mp5-26c9: Out-of-bounds read in RGBYCbCr identity-matrix colour conversion with mismatched...

vLLM resource management error vulnerability

Versions vLLM 0.19.0 through 0.24.0 contain a resource management error vulnerability. This vulnerability arises because the AudioMediaIO multimodal path fails to set a maxdurations limit for decoding duration when calling loadaudio. Authenticated attackers can exploit this by submitting small...

ALPINE-CVE-2026-114820

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, 27.0.1.0.2; Oracle Graal...

CVE-2026-114820

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, 27.0.1.0.2; Oracle Graal...

DEBIAN-CVE-2026-114820

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, 27.0.1.0.2; Oracle Graal...

EUVD-2026-109314

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, 27.0.1.0.2; Oracle Graal...

CVE-2026-114820

Technical details for CVE-2026-114820 are not publicly available in the provided documents. Monitor for further updates.

php2shell-scan-revamp

php2shell-scan A clean, modular, and extensively documented r...

SPECTER Attack Uses USB Power Signals to Leak Data From Air-Gapped PCs

Researchers demonstrated SPECTER, a technique that leaks data from compromised air-gapped PCs through USB power controls, phone charging changes and peripherals...