CVE-2026-79858 Unauthenticated SQL Injection Vulnerability in the PAPI Protocol of AOS-8

An unauthenticated SQL injection vulnerability exists in the PAPI protocol in AOS-8. Successful exploitation could allow an unauthenticated remote attacker to obtain and modify sensitive information in the underlying database and to interrupt the normal operation of the affected service...

CVE-2026-79858

CVE-2026-79858 involves an unauthenticated SQL Injection vulnerability in the PAPI Protocol of AOS-8 . While the documents do not provide specific technical details regarding the root cause or impact, the associated metrics indicate a CRITICAL severity score of 9.8. Specific exploit details and r...

Deserialization of Untrusted Data

Overview pylint is a Python static code analysis tool which looks for programming errors, helps enforcing a coding standard, sniffs for code smells and offers simple refactoring suggestions. Affected versions of this package are vulnerable to Deserialization of Untrusted Data via loadresults in...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

Patched PHP 7.4 for Synology DSM 6.2 PHP2Shell Unofficial d...

CVE-2026-113873

The SmileCDR HAPI FHIR software is vulnerable to a denial-of-service attack because it does not properly handle highly compressed data (CWE-409 ). An unauthenticated attacker can send compressed payloads that, upon decompression, exhaust the server heap or crash specific services. To mitigate thi...

CVE-2026-113873 SmileCDR HAPI FHIR improper data decompression

SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to send compressed payloads that exhaust server heap or crash certain services when decompressed...

azure-devops-artifacts-helpers (>=1.0.8, <=1.0.9), hip-data-ml-utils (>=0.3.7, <=1.0.0) +2 more potentially affected by CVE-2026-113721 via virtualenv (20.4.2)

virtualenv PYPI version 20.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - azure-devops-artifacts-helpers =1.0.8, =0.3.7, =8.2.1, =0.9.2, =1.1.0 Source cves: CVE-2026-113721 Source advisory: OSV:GHSA-558C-9HV2-4PRJ...

hip-data-ml-utils (>=1.0.1, <=1.0.2), pytoil (0.35.0) potentially affected by CVE-2026-113721 via virtualenv (20.16.3)

virtualenv PYPI version 20.16.3 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - hip-data-ml-utils =1.0.1, =1.0.2 - pytoil 0.35.0 Source cves: CVE-2026-113721 Source advisory: OSV:GHSA-558C-9HV2-4PRJ...

bitdust-p2p (>=0.0.2, <=0.0.3), dweather-client (>=1.1.0, <=1.3.0) +1 more potentially affected by CVE-2026-113721 via virtualenv (20.0.21)

virtualenv PYPI version 20.0.21 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - bitdust-p2p =0.0.2, =1.1.0, =0.2.3, =0.2.5 Source cves: CVE-2026-113721 Source advisory: OSV:GHSA-558C-9HV2-4PRJ...

aptos-verify (1.0.4), halludetector (0.0.2) +3 more potentially affected by CVE-2026-113721 via virtualenv (20.24.6)

virtualenv PYPI version 20.24.6 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - aptos-verify 1.0.4 - halludetector 0.0.2 - kit-big-data-to-do-list =1.1.0, =1.2.3, =2.2.1 - pytoil 0.40.0 Source cves: CVE-2026-113721...

Facebook’s misleading privacy claims land Meta a $25 billion penalty

Facebook’s Cambridge Analytica scandal may feel like very old news. But the consequences are still arriving, and the latest comes with a $25 billion price tag. Reuters reports that a New Mexico judge has ordered Meta to pay $25 billion in civil penalties after a jury found that Facebook misled...

CLSA-2026-1792688250 pcs: Fix of 4 CVEs

Fix CVE-2025-46727: limit number and bytesize of query parameters in bundled rubygem rack - Fix CVE-2025-61919: bound the read of urlencoded request bodies in bundled rubygem rack - Fix CVE-2025-61771: limit multipart data retained in memory in bundled rubygem rack - Fix CVE-2025-61772: limit the...

EUVD-2026-107414

Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass appMiddleware on dynamic and catch-all routes...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to input validation bypass and data integrity issues in UltraJSON (CVE-2026-54911)

Summary IBM Watson Speech Services Cartridge is vulnerable to input validation bypass and data integrity issues in UltraJSON, due to a flaw that allows the encoder/decoder to accept malformed or truncated UTF-8 byte sequences, silently rewriting them into different Unicode characters instead of...

SUSE CVE-2026-98802

In the Linux kernel, the following vulnerability has been resolved: seg6: ensure packet data is writable before modifying SRH and IPv6 DA advancenextseg modifies the SRH Segments Left field and the IPv6 destination address without ensuring the packet data is writable. seg6nextcsidadvancearg has t...

SUSE CVE-2026-114724

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcubesession::unserialize. A session key prefixed with "!" was treated as having no value, and the reconstructed serialized string was emitted with a key but no corresponding value, desynchronizing th...

Security Bulletin: IBM CloudPak for Data Scheduling Service is vulnerable to CVE-2026-56851, CVE-2026-56852.

Summary golang.org/x/text is used by the CPD Scheduling Service. CVE-2026-56851, CVE-2026-56852. Vulnerability Details CVEID:CVE-2026-56851 DESCRIPTION: The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer. CWE:CWE-787:...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

PHP2Shell CVE-2026-109618 / CVE-2026-109619 Two critica...

EUVD-2026-107544

Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorization...

CVE-2026-114510

Flexible GraphRAG is a Python framework for building graph and retrieval-augmented generation applications across multiple graph, vector, and search backends. From 0.6.0 until 0.8.2, the escape helper in flexible-graphrag/langchain/graph/pgstoreadapters/falkordbadapter.py escapes quotes before...