EUVD-2026-56856

CVAT is an open source interactive video and image annotation tool for computer vision. From 2.17.0 until 2.72.0, a user with the Worker role can use predictable task-based request IDs with the lambda request retrieve and destroy endpoints to view automatic annotation requests for tasks or jobs t...

CVE-2026-73221 CVAT: Flawed authorization logic in endpoints related to lambda requests

CVAT is an open source interactive video and image annotation tool for computer vision. From 2.17.0 until 2.72.0, a user with the Worker role can use predictable task-based request IDs with the lambda request retrieve and destroy endpoints to view automatic annotation requests for tasks or jobs t...

EUVD-2026-56843

CVAT is an open source interactive video and image annotation tool for computer vision. From 2.17.0 until 2.72.0, a user with write access to a CVAT job can submit a batch automatic annotation request to RequestViewSet.create with inconsistent task and job IDs, and because the task ID determines...

CVE-2026-73219 CVAT: Denial of service with regards to automatic annotation

CVAT is an open source interactive video and image annotation tool for computer vision. From 2.17.0 until 2.72.0, a user with write access to a CVAT job can submit a batch automatic annotation request to RequestViewSet.create with inconsistent task and job IDs, and because the task ID determines...

CVE-2026-68154

In the Linux kernel, the following vulnerability has been resolved: libceph: reject zero bucket types in crushdecode CRUSH bucket type 0 is reserved for devices. The mapper relies on that invariant and uses type 0 to identify leaf devices. If crushdecode accepts a bucket with type 0, a malformed...

EUVD-2026-55540

In the Linux kernel, the following vulnerability has been resolved: libceph: reject zero bucket types in crushdecode CRUSH bucket type 0 is reserved for devices. The mapper relies on that invariant and uses type 0 to identify leaf devices. If crushdecode accepts a bucket with type 0, a malformed...

CVE-2026-19354

A vulnerability was found in lock-upme OPMS up to 831440f37a92c1568f2e071d5233bc873a9d8b09. The impacted element is an unknown function of the file controllers/messages/message.go of the component IN Clause Handler. Performing a manipulation of the argument ids results in sql injection. The attac...

EUVD-2026-54922

A vulnerability was found in lock-upme OPMS up to 831440f37a92c1568f2e071d5233bc873a9d8b09. The impacted element is an unknown function of the file controllers/messages/message.go of the component IN Clause Handler. Performing a manipulation of the argument ids results in sql injection. The attac...

EUVD-2026-54877

The WPC Order Tip for WooCommerce WordPress plugin before 3.3.1 does not perform authorisation or nonce checks in one of its reporting features, allowing unauthenticated attackers to retrieve sensitive order data belonging to any customer of the store, such as billing names, order IDs and statuse...

CVE-2026-18357

The WPC Order Tip for WooCommerce WordPress plugin before 3.3.1 does not perform authorisation or nonce checks in one of its reporting features, allowing unauthenticated attackers to retrieve sensitive order data belonging to any customer of the store, such as billing names, order IDs and statuse...

PT-2026-69295

Name of the Vulnerable Software and Affected Versions lock-upme OPMS versions up to 831440f37a92c1568f2e071d5233bc873a9d8b09 Description A remote SQL injection is possible within the IN Clause Handler component. The issue exists in an unknown function located in the controllers/messages/message.g...

Defending Retrieval-Augmented Intrusion Detection against Knowledge Poisoning and Prompt Injection

Retrieval-Augmented Generation RAG enables large language models to classify network flows and generate human-readable incident reports by retrieving semantically similar historical traffic from a vector knowledge base. However, the retrieval layer introduces vulnerabilities to knowledge poisonin...

CVE-2026-44965

In versions of the Datadog Android application prior to v545-5.9.2, six App Widget configuration activities IncidentWidgetActivity, MonitorSavedViewWidgetActivity, OnCallShiftsWidgetActivity, OnCallPagesWidgetActivity, SloWidgetActivity, DashboardWidgetActivity are exported with no permission...

CVE-2026-44965

In versions of the Datadog Android application prior to v545-5.9.2, six App Widget configuration activities IncidentWidgetActivity, MonitorSavedViewWidgetActivity, OnCallShiftsWidgetActivity, OnCallPagesWidgetActivity, SloWidgetActivity, DashboardWidgetActivity are exported with no permission...

Security Bulletin:Vulnerability in Kernel affects IBM Netezza Appliance

Summary The Kernel package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVECVE-2023-52933 Vulnerability Details CVEID:CVE-2023-52933 DESCRIPTION: In the Linux kernel, the following vulnerability has been resolved: Squashfs: fix handling and sanity checking ...

SUSE-SU-2026:23167-1 Security update for python-pyasn1

This update for python-pyasn1 fixes the following issues: - CVE-2026-59884: BER/CER/DER decoder denial of service via unbounded long-form tag IDs bsc1271464. - CVE-2026-59885: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service bsc1271465. -...

CVE-2026-70618

Spacebar Server before commit 51da17c contains a missing authorization vulnerability that allows any authenticated user to enumerate complete guild membership by querying the GET /guilds/guildid/roles/roleid/member-ids endpoint without guild membership verification. Attackers can exploit the...

CVE-2026-70618 Spacebar Server Missing Authorization via member-ids Endpoint

Spacebar Server before commit 51da17c contains a missing authorization vulnerability that allows any authenticated user to enumerate complete guild membership by querying the GET /guilds/guildid/roles/roleid/member-ids endpoint without guild membership verification. Attackers can exploit the...

CVE-2026-70618

Spacebar Server (before commit 51da17c) contains a missing authorization vulnerability in the GET /guilds/{guild_id}/roles/{role_id}/member-ids endpoint. The unprotected route handler lacks permission checks present in sibling endpoints, allowing any authenticated user with a valid bearer token a...

CVE-2026-70618

Spacebar Server before commit 51da17c contains a missing authorization vulnerability that allows any authenticated user to enumerate complete guild membership by querying the GET /guilds/guildid/roles/roleid/member-ids endpoint without guild membership verification. Attackers can exploit the...