Mind the Gap: Robustness Risks in PII Detection Systems

Personally Identifiable Information PII detection is a foundational component of data protection infrastructure where missed entities constitute direct privacy and security risks. Although modern PII systems report strong performance on standard benchmarks, we show that these evaluations mask...

CVE-2026-76175: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the delcheck parameter of the /ocsreports/?function=savequerylist endpoint. Input provided by an authenticated user with operator privileges is incorporated into an SQL query without proper parameterisation or validation, allowing the query to be manipulated and...

RHEL 10 : python3.12 (RHSA-2026:63024)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:63024 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic...

Linux Distros Unpatched Vulnerability : CVE-2026-84311

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/page.py PageObject.extracttext and...

RHEL 9 : python3.12 (RHSA-2026:62809)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:62809 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...

Oracle Linux 10 : ELSA-2026-61586-0: / tar (ELSA-2026-615860)

The remote Oracle Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-615860 advisory. - Backport upstream patches for CVE-2026-18477, fixes a bug where incremental restore with cyclic renames between backups may create a temporary...

YellowKey-Bitlocker-CVE-2026-45585 — Updated!

🛡️ YellowKey-Bitlocker-CVE-2026-45585 - Recover Your BitLocker Keys Safely 📋 What This Software Does YellowKey is a free open-source utility for Windows 10 and Windows 11. It helps you extract, backup, and view your BitLocker recovery keys. This is useful if you lost access to your encrypted drive...

kcmd — Updated!

kcmd - Kankun Sniffer and Hijacker Send encrypted ON/OFF commands to kankun smart sockets Sniff the commands on the network to extract password Copyright 2015 © Payatu Author: Aseem Jakhar aseematpayatudotcom Websites: www.payatu.com www.nullcon.net www.hardwear.io www.null.co.in This program is...

EUVD-2026-62534

Grav: Decompression Bomb via ZipArchiver - Missing Extraction Limits...

Grav: Decompression Bomb via ZipArchiver - Missing Extraction Limits

Summary ZipArchiver::extract lacks limits on uncompressed size, file count, and nesting depth, creating a distinct, unpatched variant of the GHSA-2vcx-h8p2-9pg9 zip bomb vulnerability. While the parallel method Installer::unZip received comprehensive limits, ZipArchiver::extract remains...

GHSA-928X-9MPW-8H56 Grav: Decompression Bomb via ZipArchiver - Missing Extraction Limits

Summary ZipArchiver::extract lacks limits on uncompressed size, file count, and nesting depth, creating a distinct, unpatched variant of the GHSA-2vcx-h8p2-9pg9 zip bomb vulnerability. While the parallel method Installer::unZip received comprehensive limits, ZipArchiver::extract remains...

Important: Red Hat Security Advisory: python3.12 security update

An update for python3.12 is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory

A flaw was found in the tarfile.extractall function within Python. A remote attacker could exploit this vulnerability by providing a specially crafted archive. This archive could bypass security filters by using a hardlink that references a symlink, allowing the symlink to be recreated outside th...

GO-2026-6314 Aqua's archive extraction follows attacker-planted symlinks, allowing writes outside the install directory in github.com/aquaproj/aqua

Aqua's archive extraction follows attacker-planted symlinks, allowing writes outside the install directory in github.com/aquaproj/aqua...

CVE-2026-53600

A flaw was found in async-tar, a library for reading and writing tar archives in Rust. The library incorrectly applies a buffered PAX size extension to an intermediary extension header instead of the intended next file entry. This allows an attacker to craft a malicious tar archive that manipulat...

EUVD-2026-68800

elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload RCE...

elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)

Summary elFinder provides uploadDeny and uploadAllow options in its connector configuration to restrict which MIME types may be uploaded. When uploadDeny includes text/x-php, direct upload of .php, .phtml, and .phar files is correctly blocked. However, the extract command ZIP decompression...

GHSA-GXMJ-R5RF-GGWQ elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)

Summary elFinder provides uploadDeny and uploadAllow options in its connector configuration to restrict which MIME types may be uploaded. When uploadDeny includes text/x-php, direct upload of .php, .phtml, and .phar files is correctly blocked. However, the extract command ZIP decompression...

NLTK: Downloader.download follows hardlinks and overwrites outside-root files

Summary NLTK's downloader now blocks symlink escapes during ZIP extraction, but it still treats pre-existing hardlinks inside the install tree as ordinary in-root files. A normal package install can therefore overwrite an outside-root inode through that hardlink. Details - Vulnerability type:...

GHSA-F794-5JV7-7672 NLTK: Downloader.download follows hardlinks and overwrites outside-root files

Summary NLTK's downloader now blocks symlink escapes during ZIP extraction, but it still treats pre-existing hardlinks inside the install tree as ordinary in-root files. A normal package install can therefore overwrite an outside-root inode through that hardlink. Details - Vulnerability type:...