Vulnerabilities of the kerberos_AcceptSecurityContext() and kerberos_InitializeSecurityContextA() functions in the FreeRDP client, allowing attackers to compromise the accessibility of protected information

The vulnerabilities of the kerberosAcceptSecurityContext and kerberosInitializeSecurityContextA functions in the FreeRDP client are related to a memory reclamation error. Exploiting these vulnerabilities could allow an attacker to compromise the accessibility of protected information...

Evaluating Future Air Traffic Management Security

The L-Band Digital Aviation Communication System LDACS aims to modernize communications between the aircraft and the tower. Besides digitizing this type of communication, the contributors also focus on protecting them against cyberattacks. There are several proposals regarding LDACS security, and...

PT-2026-30332

Name of the Vulnerable Software and Affected Versions Directus affected versions not specified Description Aggregate functions min, max applied to fields with the conceal special type incorrectly return raw database values instead of the masked placeholder. When combined with groupBy, any...

JLSEC-2026-41

Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security...

PraisonAI 安全漏洞

PraisonAI is a low-code multi-intelligence body collaboration framework by the individual developer Mervin Praison. PraisonAI suffers from a security vulnerability that stems from the OAuthManager.validatetoken function returning True for any token not found in its internal storage, which can be...

The vulnerability of the sk_msg_recvmsg() function in the net/core/skmsg.c module allows a hacker to cause a service failure in the Linux kernel’s networking functions.

The vulnerability of the skmsgrecvmsg function in the net/core/skmsg.c module related to Linux kernel’s network function support involves pointer manipulation. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

PT-2026-32476

Time-of-check Time-of-use TOCTOU race condition in pg dump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running pg dump, which is often a superuser. The attack involves replacing another relation type with a view or foreign table. The attack requires waiti...

The vulnerability of the Nginx UI server’s user interface allows a perpetrator to gain unauthorized access to the system.

The vulnerability of the Nginx UI server’s user interface lies in the lack of authentication for critical functions. Exploiting this vulnerability allows a remote attacker to gain unauthorized access to the system by sending a specially crafted POST request...

PT-2026-32462

A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged user is maintaining another user's objects. The Autovacuum, REINDEX, CREATE INDEX, REFRESH MATERIALIZED VIEW, CLUSTER, and pg amcheck commands activated relevant protections too late or n...

CVE-2026-35000

ChangeDetection.io versions prior to 0.54.7 contain a protection bypass vulnerability in the SafeXPath3Parser implementation that allows attackers to read arbitrary local files by using unblocked XPath 3.0/3.1 functions such as json-doc and similar file-access primitives. Attackers can exploit th...

USN-8148-3: Linux kernel (Real-time) vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Cryptographic API; - Netfilter; - Network traffic control; CVE-2026-23060, CVE-2026-23074, CVE-2026-23111...

CVE-2026-35000

ChangeDetection.io versions prior to 0.54.7 contain a protection bypass vulnerability in the SafeXPath3Parser implementation that allows attackers to read arbitrary local files by using unblocked XPath 3.0/3.1 functions such as json-doc and similar file-access primitives. Attackers can exploit th...

PYSEC-2026-2131

ChangeDetection.io versions prior to 0.54.7 contain a protection bypass vulnerability in the SafeXPath3Parser implementation that allows attackers to read arbitrary local files by using unblocked XPath 3.0/3.1 functions such as json-doc and similar file-access primitives. Attackers can exploit th...

CVE-2026-35000

ChangeDetection.io versions prior to 0.54.7 contain a protection bypass vulnerability in the SafeXPath3Parser implementation that allows attackers to read arbitrary local files by using unblocked XPath 3.0/3.1 functions such as json-doc and similar file-access primitives. Attackers can exploit th...

CVE-2026-35000 ChangeDetection.io < 0.54.7 SafeXPath3Parser Bypass Arbitrary File Read

ChangeDetection.io versions prior to 0.54.7 contain a protection bypass vulnerability in the SafeXPath3Parser implementation that allows attackers to read arbitrary local files by using unblocked XPath 3.0/3.1 functions such as json-doc and similar file-access primitives. Attackers can exploit th...

PT-2026-29614

A weakness has been identified in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Affected by this vulnerability is the...

The vulnerabilities of the functions ath11k_dp_rx_mon_dest_process() and ath11k_dp_full_mon_process_rx() in the driver module drivers/net/wireless/ath/ath11k/dp_rx.c of the Atheros/Qualcomm wireless adapter support driver for the Linux operating system allow a hacker to cause a service failure.

The vulnerability of the functions ath11kdprxmondestprocess and ath11kdpfullmonprocessrx in the drivers/net/wireless/ath/ath11k/dprx.c module of the Atheros/Qualcomm wireless adapter support driver for the Linux operating system is related to incorrect initialization. Exploiting this vulnerabilit...

PT-2026-29588

ChangeDetection.io versions prior to 0.54.7 contain a protection bypass vulnerability in the SafeXPath3Parser implementation that allows attackers to read arbitrary local files by using unblocked XPath 3.0/3.1 functions such as json-doc and similar file-access primitives. Attackers can exploit th...

The vulnerability of the BPF_CALL_3() function in the net/core/filter.c module allows a hacker to trigger a service failure. This vulnerability is related to the support for kernel network functions in the Linux operating system.

The vulnerability of the BPFCALL3 function in the net/core/filter.c module related to Linux kernel network functions is associated with errors during the update of the reference counter. Exploiting this vulnerability could allow an attacker to cause a service failure...

parse-server has cloud function validator bypass via prototype chain traversal

Impact An attacker can bypass Cloud Function validator access controls by appending .prototype.constructor to the function name in the URL. When a Cloud Function handler is declared using the function keyword and its validator is a plain object or arrow function, the trigger store traversal...