PT-2026-117412

sglang-router sgl-model-gateway through 0.3.2 contains an authorization bypass vulnerability that allows holders of the data-plane API key to access mesh HA management routes because /ha/ endpoints skip control-plane Admin role checks. Attackers can read cluster topology, write gossiped...

PT-2026-117302

Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7...

CVE-2026-112274: Out-of-bounds Read

libtins through 4.6 contains an out-of-bounds read vulnerability in DNS::soarecord::init that allows remote attackers to read past buffer bounds by supplying SOA data lacking NUL terminators. Attackers can feed raw SOA RDATA without a zero byte to applications using the buffer constructor, causin...

Adversarial Benchmarks and BenchDoor Attacks: Exploiting Benchmark Incentives for Backdoor Attacks

Machine learning benchmarks act as guideposts for model development and spur the creation of training datasets intended to improve benchmark scores. We introduce BenchDoor, a family of data poisoning attacks that exploits this incentive. Beyond preserving benign performance, BenchDoor requires...

Red Hat: CVE-2026-112404: pillow: Pillow: Denial of Service via out-of-bounds read in TIFF decoding

Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow's TIFF tile and RGBA decode paths can read beyond row data produced by libtiff. In decodeTile and the RGBA unpacker path, when Pillow and libtiff interpret duplicated PhotometricInterpretation or BitsPerSample tags differently,...

CVE-2026-112180: Incomplete Cleanup

MISP contains a data integrity flaw in its event deletion logic. When a user deletes an event, several associated records are not removed from the database, leaving them as orphaned entries. The affected record types include event report tags, event graph entries, proposal shadow attribute...

PT-2026-117274

MISP contains a data integrity flaw in its event deletion logic. When a user deletes an event, several associated records are not removed from the database, leaving them as orphaned entries. The affected record types include event report tags, event graph entries, proposal shadow attribute...

PT-2026-117356

Exposure of Data Element to Wrong Session vulnerability in Apache Camel AS2 component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Signing material belonging to an individual request was stored in state that is shared across requests rather than confined ...

CVE-2026-13695: Improper Neutralization of Special Elements used in an SQL Command

SQL injection SQLi vulnerability—specifically a UNION-based vulnerability—in the Integratec application that affects the sInfo parameter sent via POST to the endpoint /login/apLogin.aspx/start. Successful exploitation of this vulnerability could allow an attacker to steal data from the database,...

CVE-2026-16460: Insufficient Verification of Data Authenticity

A flaw was found in bootc and ostree. Already-staged deployments are finalized without revalidating the deployment's container image against the current containers signature policy. Unsigned OS content staged under a prior permissive policy can remain bootable after policy is hardened to reject...

CVE-2026-107084

Slims Senayan Library Management Systems 9 Bulian 9.8.0 allows cross-site request forgery CSRF against admin/modules/circulation/loanhistorymaintenance.php because the action=run GET parameter performs privileged, destructive operations with no CSRF token or POST confirmation, leading to data los...

PT-2026-117474

Name of the Vulnerable Software and Affected Versions Netskope Client versions prior to R142 Description A gap in the NSClient agent occurs when a system connects to an access point with a Captive Portal and then switches to a network that already has internet connectivity, causing the Captive...

CVE-2026-112284: Out-of-bounds Read

libaribcaption 1.1.0 through 1.1.2 contains a global out-of-bounds read in DecoderImpl::HandleGLGR that reads past the 78-entry kLatinSpecialTable without an upper bound check. Attackers can supply crafted captions designating the Latin special set with ESC 28 4C followed by bytes 0x6F-0x7E to le...

PT-2026-117468

crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool that allows attackers to fetch internal resources because it never applies the validate url private-address check. Attackers influencing agent tool input through prompt injection can direct...

PT-2026-117428

libaribcaption 1.1.0 through 1.1.2 contains a global out-of-bounds read in DecoderImpl::HandleGLGR that reads past the 78-entry kLatinSpecialTable without an upper bound check. Attackers can supply crafted captions designating the Latin special set with ESC 28 4C followed by bytes 0x6F-0x7E to le...

EUVD-2026-104552

Slims Senayan Library Management Systems 9 Bulian 9.8.0 allows cross-site request forgery CSRF against admin/modules/circulation/loanhistorymaintenance.php because the action=run GET parameter performs privileged, destructive operations with no CSRF token or POST confirmation, leading to data los...

ROS-20261019-73-0016

The vulnerability of the Vim text editor is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a remote attacker to gain access to confidential data, compromise its integrity, and even cause service interruptions...

PT-2026-117446

Dell Application Installer, versions prior to 26.09.0.1, contain a Missing Encryption of Sensitive Data vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access...

CVE-2026-112308: Server-Side Request Forgery (SSRF)

crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool that allows attackers to fetch internal resources because it never applies the validateurl private-address check. Attackers influencing agent tool input through prompt injection can direct...

Navigation section of Microsoft Data Compromise

The vulnerability in the Navigation section of Microsoft Edge and Google Chrome browsers is related to insufficient input validation. Exploitation of this vulnerability enables a remote attacker to compromise the integrity of protected information by using a specially crafted HTML page...