PT-2026-85440

Improper input validation of the auto-configuration account identifier in Snowflake JDBC Driver versions 4.2.0 through 4.3.3 allowed a credential-bearing login request to be redirected to an attacker-selected HTTPS endpoint. An attacker able to control the account value could cause the driver to...

CVE-2026-85624: Authorization Bypass Through User-Controlled Key

Blinko 1.8.7 contains a cross-user private note disclosure vulnerability in the noteReferenceList procedure that performs no ownership verification on supplied note identifiers. Authenticated attackers can enumerate sequential note IDs and retrieve complete content of other users' private notes...

MINI-6P5F-WVW6-WCFF

Bulletin has no description...

MINI-CWMM-46HX-GJ8F

Bulletin has no description...

MINI-MGVW-3PM5-6MMC

Bulletin has no description...

EUVD-2026-52279

SiYuan: Path Traversal via unvalidated avID in RenderAttributeView/AV read endpoints : reader-reachable cross-scope attribute-view disclosure...

MINI-9FWH-7MG7-5599

Bulletin has no description...

MINI-677G-H57W-QCCM

Bulletin has no description...

MINI-72XG-FXX7-XMXC

Bulletin has no description...

MINI-F637-487G-6FGG

Bulletin has no description...

MINI-25WG-4QW6-PGVH

Bulletin has no description...

MINI-PW95-9C6F-7CW9

Bulletin has no description...

MINI-VGJR-R4VX-GC3F

Bulletin has no description...

MINI-59WP-MQ5W-QPFR

Bulletin has no description...

MINI-PQ8P-6WRV-G8XV

Bulletin has no description...

MINI-V55G-2RF5-RJVV

Bulletin has no description...

MINI-5Q59-9V2C-J79H

Bulletin has no description...

EUVD-2026-70532

MISP contains a session fixation vulnerability in the CustomAuth authentication a custom configuration flow. When a user was successfully authenticated through CustomAuth, MISP stored the authenticated user identity in the existing session without first rotating the session identifier. As a resul...

CVE-2026-84962 Authenticated KMS request forgery via CRLF injection in GCP key identifier strings

An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption...

CVE-2026-84962 Authenticated KMS request forgery via CRLF injection in GCP key identifier strings

An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption...