CVE-2026-64306

A flaw was found in the Linux kernel's Cryptographic API, specifically within the Counter Mode Deterministic Random Bit Generator CTRDRBG. The drbgctrgenerate function can incorrectly indicate a successful operation even when it has failed. This issue results in the output buffer remaining...

SUSE CVE-2026-64306

In the Linux kernel, the following vulnerability has been resolved: crypto: drbg - Fix returning success on failure in CTRDRBG drbgctrgenerate sometimes returns success when it fails, leaving the output buffer uninitialized. Fix it...

CVE-2026-64316

In the Linux kernel, the following vulnerability has been resolved: crypto: caam - use printhexdumpdevel to guard key hex dumps Use printhexdumpdevel for dumping sensitive key material in setkey and gensplitkey to avoid leaking secrets at runtime when CONFIGDYNAMICDEBUG is enabled...

CVE-2026-64306

In the Linux kernel, the following vulnerability has been resolved: crypto: drbg - Fix returning success on failure in CTRDRBG drbgctrgenerate sometimes returns success when it fails, leaving the output buffer uninitialized. Fix it...

EUVD-2026-49018

In the Linux kernel, the following vulnerability has been resolved: crypto: drbg - Fix returning success on failure in CTRDRBG drbgctrgenerate sometimes returns success when it fails, leaving the output buffer uninitialized. Fix it...

PT-2026-64527

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the CTR DRBG component where the drbg ctr generate function may incorrectly return a success status despite failing, which results in the output buffer remaining...

Open WebUI: Arena task endpoints can bypass underlying model access controls

Summary An authenticated non-admin user with read access to an arena wrapper model can reach a restricted underlying model through task endpoints such as /api/v1/tasks/moa/completions. The normal chat route resolves arena models before the final chat dispatch and therefore re-checks the selected...

Missing Authorization

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Missing Authorization in the generatechatcompletion process. An attacker can gain unauthorized access to restricted underlying models by submitting crafted requests to task endpoints that leverage readable...

GHSA-4RJ6-VRWV-WR8M Microsoft Kiota Workspace-config poisoning: out-of-repo file write + generation-time SSRF

Summary Microsoft Kiota honors a poisoned .kiota/workspace.json — the workspace configuration that Kiota's documented team workflow has developers commit to their repository — unvalidated on kiota client generate / kiota plugin generate. A repository or pull request containing a malicious...

PT-2026-64200

Name of the Vulnerable Software and Affected Versions Heimdall Data Database Proxy affected versions not specified Description Remote authenticated attackers can execute arbitrary code with root privileges on affected installations. The issue stems from the lack of proper neutralization of CRLF...

GHSA-2RP8-MM9Q-FP49 TypeORM: migration:generate template-literal code injection

Summary typeorm migration:generate embeds database schema metadata into JS/TS template literals, escaping backticks but not $.... An attacker who can write schema metadata column comments, defaults, view definitions achieves arbitrary code execution on the host that loads the generated migration...

TypeORM: migration:generate template-literal code injection

Summary typeorm migration:generate embeds database schema metadata into JS/TS template literals, escaping backticks but not $.... An attacker who can write schema metadata column comments, defaults, view definitions achieves arbitrary code execution on the host that loads the generated migration...

PT-2026-71735

Name of the Vulnerable Software and Affected Versions TypeORM versions prior to 0.3.31 TypeORM versions prior to 1.1.0 Description TypeORM embeds database schema metadata into JavaScript or TypeScript template literals within the MigrationGenerateCommand.ts file. While backticks are escaped, the...

CVE-2026-62233 grav-plugin-api < 1.0.6 Privilege Escalation via createApiKey

grav-plugin-api before 1.0.6 fails to validate super-admin status in createApiKey, generate2fa, and disable2fa endpoints, allowing non-super api.users.write managers to escalate to super-admin. Attackers can mint API keys bound to super-admin accounts or strip 2FA from super-admin users to achiev...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal through the OpenApiDocumentDownloadService and KiotaBuilder document-loading path. An attacker can trigger SSRF, remote file inclusion, and local file inclusion by supplying a spec whose $ref points to an...

CVE-2026-59864: Improper Limitation of a Pathname to a Restricted Directory

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, kiota plugin add and kiota plugin generate with -t APIPlugin emitted attacker-controlled statictemplate.file values from x-ai-adaptive-card and x-ai-capabilities into generated Microsoft 365 Copilot and Teams plugin...

CVE-2026-59866: Improper Limitation of a Pathname to a Restricted Directory

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota emitted x-ms-kiota-info clientClassName and clientNamespaceName values without identifier or path sanitization as both generated client class or namespace names and generated output path components when kiota...

CVE-2026-59863: Improper Limitation of a Pathname to a Restricted Directory

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota honored a poisoned .kiota/workspace.json workspace configuration without validating per-client or per-plugin outputPath values during kiota client generate and kiota plugin generate, allowing a malicious...

CVE-2026-59867: Improper Limitation of a Pathname to a Restricted Directory

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota resolved OpenAPI $ref values by fetching remote https URLs and reading local absolute or out-of-tree file paths, allowing kiota generate on an attacker-controlled or attacker-influenced description to perform...

CVE-2026-55576

MaaAssistantArknights is a one-click tool for daily Arknights tasks. In the current dev-v2 workflow, .github/workflows/release-preparation.yml inlined attacker-controlled github.event.pullrequest.title into a run: shell command during the pullrequest opened, reopened, and readyforreview events, s...