CVE-2026-2590

Improper enforcement of the Disable password saving in vaults setting in the connection entry component in Devolutions Remote Desktop Manager 2025.3.30 and earlier allows an authenticated user to persist credentials in vault entries, potentially exposing sensitive information to other users, by...

Craft CMS: Entries Authorship Spoofing via Mass Assignment

Description The entry creation process allows for Mass Assignment of the authorId attribute. A user with "Create Entries" permission can inject the authorIds or authorId parameter into the POST request, which the backend processes without verifying if the current user is authorized to assign...

GHSA-2XFC-G69J-X2MP Craft CMS: Entries Authorship Spoofing via Mass Assignment

Description The entry creation process allows for Mass Assignment of the authorId attribute. A user with "Create Entries" permission can inject the authorIds or authorId parameter into the POST request, which the backend processes without verifying if the current user is authorized to assign...

Craft CMS has IDOR via GraphQL @parseRefs

The GraphQL directive @parseRefs, intended to parse internal reference tags e.g., user:1:email, can be abused by both authenticated users and unauthenticated guests if a Public Schema is enabled to access sensitive attributes of any element in the CMS. The implementation in Elements::parseRefs...

SUSE-SU-2026:0759-1 Security update for busybox

This update for busybox fixes the following issues: - CVE-2026-26157: Arbitrary file overwrite and potential code execution via incomplete path sanitization bsc1258163. - CVE-2026-26158: Arbitrary file modification and privilege escalation via unvalidated tar archive entries bsc1258167...

SUSE-SU-2026:0758-1 Security update for busybox

This update for busybox fixes the following issues: - CVE-2026-26157: Arbitrary file overwrite and potential code execution via incomplete path sanitization bsc1258163. - CVE-2026-26158: Arbitrary file modification and privilege escalation via unvalidated tar archive entries bsc1258167...

PT-2026-22827

Name of the Vulnerable Software and Affected Versions Devolutions Remote Desktop Manager versions 2025.3.30 and earlier Description An issue exists in the connection entry component of the software where the 'Disable password saving in vaults' setting is not properly enforced. This allows an...

PT-2026-26399

Impact Concurrent updateRegistry/removeRegistryEntry operations for sandbox containers and browsers could lose updates or resurrect removed entries under race conditions. The registry writes were read-modify-write in a window with no locking and permissive fallback parsing, so concurrent registry...

CLSA-2026-1772120702 Update of linux-firmware

Addition AMD CPU microcode for processor family 0x1a: cpuid:0x00B00F81ver:0x0B008121, cpuid:0x00B20F40ver:0x0B204037, cpuid:0x00B40F40ver:0x0B404035, cpuid:0x00B40F41ver:0x0B404108, cpuid:0x00B60F00ver:0x0B600037, cpuid:0x00B60F80ver:0x0B608038, cpuid:0x00B70F00ver:0x0B700037; - Update AMD CPU...

BIT-AIRFLOW-2025-27555 Apache Airflow: Connection Secrets not masked in UI when Connection are added via Airflow cli

Airflow versions before 2.11.1 have a vulnerability that allows authenticated users with audit log access to see sensitive values in audit logs which they should not see. When sensitive connection parameters were set via airflow CLI, values of those variables appeared in the audit log and were...

Discourse 安全漏洞

Discourse is an open-source community discussion platform developed by Discourse. This platform includes features such as communities, email communication, and chat rooms. Versions of Discourse before 2025.12.2, 2026.1.1, and 2026.2.0 contain security vulnerabilities. These vulnerabilities stem...

Docker Desktop < 4.62.0 Out of Bounds Read

The version of Docker Desktop is prior to 4.62.0. It is therefore affected by an out of bounds read vulnerability. - An out of bounds read vulnerability in the grpcfuse kernel module present in the Linux VM in Docker Desktop for Windows, Linux and macOS up to version 4.61.0 could allow a local...

pypdf has a possible infinite loop when loading circular /Prev entries in cross-reference streams

Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires reading the file. Patches This has been fixed in pypdf==6.7.2. Workarounds If users cannot upgrade yet, consider applying the changes from PR 3655...

GHSA-2RW7-X74F-JG35 pypdf has a possible infinite loop when loading circular /Prev entries in cross-reference streams

Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires reading the file. Patches This has been fixed in pypdf==6.7.2. Workarounds If users cannot upgrade yet, consider applying the changes from PR 3655...

CVE-2026-28193

creationtimestamp| type| source ---|---|--- 2026-02-25 14:19:59+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mfouthkpeo26 2026-02-25 15:12:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mfoxrojavt2v 2026-02-26 17:20:09+00:00| seen|...

CVE-2026-2664

An out of bounds read vulnerability in the grpcfuse kernel module present in the Linux VM in Docker Desktop for Windows, Linux and macOS up to version 4.61.0 could allow a local attacker to cause an unspecified impact by writing to /proc/docker entries. The issue has been fixed in Docker Desktop...

Infinite loop

Overview pypdf is an A pure-python PDF library capable of splitting, merging, cropping, and transforming PDF files Affected versions of this package are vulnerable to Infinite loop in reader.py, when loading circular /Prev entries in cross-reference streams. An attacker can cause the application ...

CVE-2026-27628 pypdf has a possible infinite loop when loading circular /Prev entries in cross-reference streams

pypdf is a free and open-source pure-python PDF library. Prior to 6.7.2, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires reading the file. This has been fixed in pypdf 6.7.2. As a workaround, one may apply the patch manually...

CVE-2026-27628 pypdf has a possible infinite loop when loading circular /Prev entries in cross-reference streams

pypdf is a free and open-source pure-python PDF library. Prior to 6.7.2, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires reading the file. This has been fixed in pypdf 6.7.2. As a workaround, one may apply the patch manually...

CVE-2026-25131

creationtimestamp| type| source ---|---|--- 2026-02-25 02:18:52+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mfnmjzxfzu2s 2026-02-25 02:57:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mfnophssvg2u 2026-02-25 18:40:10+00:00| seen|...