CVE-2026-77846

Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ashsqlite allows an attacker who controls a getpath/2 segment to traverse into nested JSON the application never exposed, disclosing private or sensitive? embedded fields. AshSqlite.SqlImplementation buil...

CVE-2026-77846

ash-project ash_sqlite versions from 0.1.2-rc.0 before 0.2.18 contain a JSON-path injection in AshSqlite.SqlImplementation. The json_extract path is built by concatenating "$." with Enum.join(right, "."), so a single get_path/2 segment containing ., [, ], or $ re-interprets the JSON path (e.g., "...

EEF-CVE-2026-77846 JSON path injection via unescaped get_path segments in AshSqlite

Summary Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash\sqlite allows an attacker who controls a get\path/2 segment to traverse into nested JSON the application never exposed, disclosing private or sensitive? embedded fields...

EUVD-2026-68147

Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ashsqlite allows an attacker who controls a getpath/2 segment to traverse into nested JSON the application never exposed, disclosing private or sensitive? embedded fields. AshSqlite.SqlImplementation buil...

CVE-2026-77846 JSON path injection via unescaped get_path segments in AshSqlite

Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ashsqlite allows an attacker who controls a getpath/2 segment to traverse into nested JSON the application never exposed, disclosing private or sensitive? embedded fields. AshSqlite.SqlImplementation buil...

CVE-2026-77846 JSON path injection via unescaped get_path segments in AshSqlite

Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ashsqlite allows an attacker who controls a getpath/2 segment to traverse into nested JSON the application never exposed, disclosing private or sensitive? embedded fields. AshSqlite.SqlImplementation buil...

CVE-2026-77846 JSON path injection via unescaped get_path segments in AshSqlite

Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ashsqlite allows an attacker who controls a getpath/2 segment to traverse into nested JSON the application never exposed, disclosing private or sensitive? embedded fields. AshSqlite.SqlImplementation buil...

CVE-2026-82562

Summary When qs.parse is called with comma: true and throwOnLimitExceeded: true, a comma-separated value under a bracket-push key a=1,2,3,4 is split into an array without being compared against arrayLimit, while the same value under a flat key a=1,2,3,4, an indexed key a0=, a nested key ab=, or a...

DEBIAN-CVE-2026-82562

Summary When qs.parse is called with comma: true and throwOnLimitExceeded: true, a comma-separated value under a bracket-push key a=1,2,3,4 is split into an array without being compared against arrayLimit, while the same value under a flat key a=1,2,3,4, an indexed key a0=, a nested key ab=, or a...

PowerShell-Pro-Obfuscator-Python

PowerShell Pro Obfuscator — Offusca e Virtualizza Codice PowerShell PowerShell Pro Obfuscator protegge script .ps1 proprietari con rinomina, crittografia polimorfa di stringhe e interi, appiattimento del flusso di controllo, automi a stati finiti FSA, un motore VM, controlli di integrità...

PT-2026-83581

Admidio before 5.0.12 contains a blind SQL injection vulnerability in the relation type list parameter of lists show.php that allows unauthenticated attackers to execute arbitrary SQL queries. Attackers can bypass authentication by providing a dummy UUID in role list and inject SQL through relati...

PT-2026-83571

AVideo current commit e01e41ecc and earlier exposes stream credentials through the plugin/Live/view/Live restreams/getLiveKey.json.php endpoint. Supplying a 'token' request parameter waives both the Live::canRestream access gate and the restream ownership check, causing the endpoint to return any...

openSUSE 16 Security Update : broot (openSUSE-SU-2026:21675-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21675-1 advisory. Changes in broot: - v1.59.0 CVE-2026-72847 boo1275994 new shellcommand verb attribute: run a command through a shell sh -c / cmd /C so &&, ; and pipes...

Security update for mozjs102 (moderate)

openSUSE Security Update: Security update for mozjs102 Announcement ID: openSUSE-SU-2026:0315-1 Rating: moderate References: 1259713 1259728 1259731 Cross-References: CVE-2026-32776 CVE-2026-32777 CVE-2026-32778 CVSS scores: CVE-2026-32776 SUSE: 8.7...

Linux Distros Unpatched Vulnerability : CVE-2026-82562

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Summary When qs.parse is called with comma: true and throwOnLimitExceeded: true, a comma- separated value under a bracket-push key a=1,2,3,4 is split into an...

Foundation and Multimodal Large Language Models for Face Presentation and Morph Attack Detection

Face recognition systems are increasingly deployed in security-critical applications, yet they remain vulnerable to presentation and morph attacks. Presentation attack detection PAD and morphing attack detection MAD are therefore essential components of trustworthy face biometrics. Despite...

CVE-2026-82562 qs.parse does not enforce arrayLimit on comma groups under bracket-push keys when throwOnLimitExceeded is set (incomplete fix for CVE-2026-2391)

Summary When qs.parse is called with comma: true and throwOnLimitExceeded: true, a comma-separated value under a bracket-push key a=1,2,3,4 is split into an array without being compared against arrayLimit, while the same value under a flat key a=1,2,3,4, an indexed key a0=, a nested key ab=, or a...

CVE-2026-82562 qs.parse does not enforce arrayLimit on comma groups under bracket-push keys when throwOnLimitExceeded is set (incomplete fix for CVE-2026-2391)

Summary When qs.parse is called with comma: true and throwOnLimitExceeded: true, a comma-separated value under a bracket-push key a=1,2,3,4 is split into an array without being compared against arrayLimit, while the same value under a flat key a=1,2,3,4, an indexed key a0=, a nested key ab=, or a...

CVE-2026-82562

CVE-2026-82562 affects the qs Node.js querystring parser (v6.14.2 through v6.15.3). When qs.parse is called with both comma: true and throwOnLimitExceeded: true, a comma-separated value under a bracket-push key (a[]=1,2,3,4) is wrapped as a single nested element before the arrayLimit check runs, ...

CVE-2026-82562

Summary When qs.parse is called with comma: true and throwOnLimitExceeded: true, a comma-separated value under a bracket-push key a=1,2,3,4 is split into an array without being compared against arrayLimit, while the same value under a flat key a=1,2,3,4, an indexed key a0=, a nested key ab=, or a...