3251 matches found
Astra Linux β Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: ACPICA: Refuses to evaluate a method if arguments are missing As reported in 1, a platform firmware update increased the number of method parameters and forgot to update at least one of its callers. This caused ACPICA to crash du...
Astra Linux β Vulnerability found in Linux 6.1, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: ACPI: x86: s2idle: Handling multiple ACPITYPEPACKAGE objects If a poorly constructed firmware includes multiple ACPITYPEPACKAGE objects during the evaluation of the AMD LPS0DSM, a memory leak may occur. This issue is explicitly...
Astra Linux β Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1
A flaw was discovered in the Netfilter subsystem of the Linux kernel. The issue lies with the nftbyteordereval function, where the code iterates through an loop and writes to the dst array. In each iteration, 8 bytes are written, but dst is an array of u32 values; therefore, each element in the...
Astra Linux β Vulnerability in PostgresSQL 11
Row security policies ignore changes to user IDs after inline operations. PostgreSQL may allow incorrect policies to be applied in certain cases where role-specific policies are used, and where a given query is planned to be executed under one role and then executed under another role. This...
CVE-2026-20773
A role-based access control issue was identified in the administrative expression evaluation functionality. This could allow users with certain administrative roles to access expression testing capabilities beyond their intended permissions...
CVE-2026-20773
CVE-2026-20773 is an improper authorization flaw in PingFederate (Ping Identity), specifically in the administrative expression evaluation endpoint . A role-based access control (RBAC) deficiency allows users holding certain administrative roles to access expression testing capabilities beyond th...
CVE-2026-20773 Improper Authorization in PingFederate Administrative Expression Evaluation Endpoint
A role-based access control issue was identified in the administrative expression evaluation functionality. This could allow users with certain administrative roles to access expression testing capabilities beyond their intended permissions...
EUVD-2026-77373
A role-based access control issue was identified in the administrative expression evaluation functionality. This could allow users with certain administrative roles to access expression testing capabilities beyond their intended permissions...
CVE-2026-20773 Improper Authorization in PingFederate Administrative Expression Evaluation Endpoint
A role-based access control issue was identified in the administrative expression evaluation functionality. This could allow users with certain administrative roles to access expression testing capabilities beyond their intended permissions...
CVE-2026-82789
An Eval Injection vulnerability (improper neutralization of directives in dynamically evaluated code) exists in CONPROSYS HMI System (CHS) by CONTEC. A low-privilege attacker who can log in to the product may achieve arbitrary code execution , leading to high impact on confidentiality, integrity,...
CVE-2026-82789
An improper neutralization of directives in dynamically evaluated code 'Eval Injection' issue exists in CONPROSYS HMI SystemCHS. If exploited, arbitrary code may be executed by an attacker who can log in to the product...
PT-2026-91147
A role-based access control issue was identified in the administrative expression evaluation functionality. This could allow users with certain administrative roles to access expression testing capabilities beyond their intended permissions...
PT-2026-91093
An improper neutralization of directives in dynamically evaluated code 'Eval Injection' issue exists in CONPROSYS HMI SystemCHS. If exploited, arbitrary code may be executed by an attacker who can log in to the product...
CVE-2026-20773: Incorrect Authorization
A role-based access control issue was identified in the administrative expression evaluation functionality. This could allow users with certain administrative roles to access expression testing capabilities beyond their intended permissions...
Flowise-RCE-CVE-2025-59528
CVE-2025-59528 β Flowise AI Authenticated Remote Code Execution RCE Overview CVE ID: CVE-2025-59528 Affected Software: Flowise AI Vulnerable Versions: = 3.0.4 Fixed Version: 3.0.5 and later Severity: Critical Author: r3nsi15 Date: 2025 Description Flowise AI versions up to and including 3.0.4 all...
AI-Infra-Guard v4.6.1
π Documentation | π π¨π³ δΈζ Β· π―π΅ ζ₯ζ¬θͺ Β· πͺπΈ EspaΓ±ol Β· π©πͺ Deutsch Β· π«π· FranΓ§ais Β· π°π· νκ΅μ΄ Β· π§π· PortuguΓͺs Β· π·πΊ Π ΡΡΡΠΊΠΈΠΉ π AI Red Teaming Platform by Tencent Zhuque Lab A.I.G AI-Infra-Guard integrates capabilities such as ClawScanOpenClaw Security Scan, Agent ScanοΌAI infra vulnerability scan...
promptfoo v0.123.0
Promptfoo: LLM evals & red teaming promptfoo is a CLI and library for evaluating and red-teaming LLM-based apps. Stop using trial-and-error... start shipping secure, reliable agents Website Β· Getting Started Β· Red Teaming Β· Documentation Β· Discord Promptfoo is now part of OpenAI. Promptfoo remain...
Safety Guard Bypass
Spring Framework is vulnerable to a safety guard bypass. The vulnerability is due to improper enforcement of security restrictions during compiled SpEL expression evaluation, which allows an attacker to bypass the intended safety protections and execute expressions with capabilities that should...
Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Data
ImpactA Server-Side Template Injection SSTI vulnerability exists in multiple locations of trestle's Jinja2 rendering pipeline due to a systemic pattern: untrusted data is re-parsed as Jinja2 template source code without sandboxing. This advisory tracks the root cause across all affected code...
Anthropic Discloses Fourth AI Hacking Incident Involving Claude Opus 4.6
Anthropic on Wednesday disclosed a fourth incident in which its artificial intelligence AI model broke into real third-party systems, marking the latest in a growing list of cases that have raised concerns about the security risks posed by autonomous AI agents. The AI company said the incident...