CVE-2026-90401 md: remove REQ_NOWAIT support from raid1/10/456

In the Linux kernel, the following vulnerability has been resolved: md: remove REQNOWAIT support from raid1/10/456 REQNOWAIT support in md personalities that can block internally is fundamentally incomplete. While reads can avoid some blocking paths, write requests can still encounter cases where...

EEF-CVE-2026-80227 SQL string_trim removes only spaces, diverging from in-memory trimming in AshSql

Summary Incorrect Comparison vulnerability in ash-project ashsql allows a user to pad a string field with tab, newline, carriage-return, or form-feed characters and pass a trimmed uniqueness or equality check in the database that the same expression would fail in memory or the reverse. stringtrim...

PT-2026-83547

Name of the Vulnerable Software and Affected Versions ash sql versions 0.1.0 through 0.7.0 Description An incorrect comparison issue exists where a user can pad a string field with tab, newline, carriage-return, or form-feed characters to bypass trimmed uniqueness or equality checks. This occurs...

CVE-2026-52735 ZEBRA: Consensus divergence via P2SH sigop undercount in pure-Rust disabled-opcode parser

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, Zebra can accept a block that zcashd rejects because the P2SH signature-operation counter undercounts redeem scripts containing a disabled opcode followed by signature opcodes. In zebra-script/src/lib.rs, p2shinputsigopcount used the...

CVE-2026-52735

Zebra (a Rust-based Zcash node) used a pure-Rust P2SH sigop counter that short-circuited on disabled opcodes like OP_CODESEPARATOR, undercounting sigops compared to zcashd. An attacker without mining power could trigger a chain split by broadcasting P2SH spends with malicious redeem scripts. Fixe...

CVE-2026-52735 ZEBRA: Consensus divergence via P2SH sigop undercount in pure-Rust disabled-opcode parser

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, Zebra can accept a block that zcashd rejects because the P2SH signature-operation counter undercounts redeem scripts containing a disabled opcode followed by signature opcodes. In zebra-script/src/lib.rs, p2shinputsigopcount used the...

CVE-2026-49473

@cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Cedar authorization into Express applications by mapping HTTP requests to Cedar actions and evaluating authorization policies before allowing requests to proceed. Versions prior to 0.3.0 have an issu...

CVE-2026-49473 @cedar-policy/authorization-for-expressjs has an authorization bypass via query string manipulation

@cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Cedar authorization into Express applications by mapping HTTP requests to Cedar actions and evaluating authorization policies before allowing requests to proceed. Versions prior to 0.3.0 have an issu...

Telemetry and Concealment in Self-Adapting Generative AI: Logging Architecture, Adversarial Model Hiding, and the Limits of Detection

Model risk management MRM guidance assumes a static model lifecycle, in which models are developed, independently validated, and implemented without further autonomous modification. Continually self-adapting generative AI systems --- models that update their own weights during production deployme...

Canonicalization Failures As a Recurring Vulnerability Class: Representation Divergence in Cryptographic Systems and Its Avoidance

Cryptographic systems operate on bytes but mean semantic objects. The translation between the two is rarely unique. Where this uniqueness is not enforced, an attack surface opens up as soon as a hash, a signature, replay protection, or consensus identity depends on the representation. The same...

Malicious code in table-ui-new (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0b953969edf8d77d5a1be0aa33b4044b38e2352f81c54b0f343f21a1c52c13a [email protected] ships dist/config.js, exposed via the package.json ./config subpath export, which exports a module-level array named HASHES...

CVE-2026-69246

Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, Guzzle gives a transport the request URI as text and supplies the Host header separately. The cURL handlers set CURLOPTURL to the URI exactly as written and push that Host into CURLOPTHTTPHEADER; StreamHandler does the same throu...

Residual Observability and Attack Detectability in Encrypted OPC UA Traffic

OPC Unified Architecture OPC UA encryption conceals application-layer semantics and restricts intrusion detection to residual communication structure. Although machine learning-based intrusion detection systems IDSs can detect attacks in encrypted OPC UA traffic, the relationship between residual...

The Cathedral and the Bazaar of Software Vulnerabilities: From the NVD to the CNAs

For decades, the National Vulnerability Database NVD, the "Cathedral", has been the reference source for vulnerability information for downstream research and industry tasks, e.g., software update prioritization. An emerging "Bazaar" of diverse CVE Numbering Authorities CNAs has created many...

zebrad has consensus divergence via P2SH sigop undercount in pure-Rust disabled-opcode parser

Am I affected You are affected if: 1. You run any version of zebrad up to and including v4.4.1. 2. Your node validates blocks on mainnet, testnet, or any network where both Zebra and zcashd nodes participate. All default configurations are affected. No feature flags, non-default settings, or...

PT-2026-55471

Name of the Vulnerable Software and Affected Versions Zebra versions prior to 4.4.2 Description Zebra can accept blocks that the zcashd reference implementation rejects due to a discrepancy in how P2SH Pay-to-Script-Hash signature-operation counters handle disabled opcodes. In the...

Multi-Level Distributional Entropy for Explainable Network Intrusion Detection

Machine learning network intrusion detection systems IDS rely on aggregate flow statistics that discard distributional structure, while established entropy measures require raw packet sequences unavailable in pre-aggregated flow datasets. We propose Multi-Level Distributional Entropy MDE, an...

CVE-2026-48982 pam_usb: Missing O_EXCL on pad temp file creation allows concurrent update race

pamusb provides hardware authentication for Linux using ordinary removable media. In versions prior to 0.9.2, when updating a one-time pad file, a temporary file is created using open without the OEXCL flag. Without OEXCL, the create operation is not atomic: two concurrent processes racing to...

Patcher: Post-Hoc Patching of Backdoored Large Language Models

Large language models remain vulnerable to jailbreak backdoor attacks, where adversaries poison safety alignment data to embed hidden triggers that bypass safety mechanisms. Existing defenses often require comprehensive attack information or multiple triggered examples, making them impractical wh...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: bpf: Fixed an incorrect scalar handling in the maybeforkscalars function for BPFOR. The maybeforkscalars function is called for both BPFAND and BPFOR when the source operand is a constant. When dst has a signed range of -1, 0, it...