PT-2026-67504

Shlink contains a blind SQL injection vulnerability that allows any authenticated API key holder to inject arbitrary SQL fragments by supplying an unvalidated direction value in the orderBy query parameter of the tag statistics endpoint. Attackers can craft a malicious direction string containing...

PT-2026-67503

Name of the Vulnerable Software and Affected Versions Shlink affected versions not specified Description Authenticated API key holders can trigger server-side request forgery SSRF, a flaw where the server is coerced into making unauthorized requests. By providing a crafted long URL during the sho...

CVE-2026-38447

The software osTicket (versions

PT-2026-67458

Name of the Vulnerable Software and Affected Versions TP-Link Omada affected versions not specified Description A cryptographic weakness exists in the Omada adoption protocol. The protocol uses hard-coded cryptographic keys to establish trust and protect authentication exchanges between controlle...

CVE-2026-38447

osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing. The use of MD5, combined with predictable inputs such as the current timestamp and client IP address, significantly reduces entropy. An attacker can approximate the key generation time and brute-force the ke...

CVE-2026-38447: Insufficient Entropy

osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing. The use of MD5, combined with predictable inputs such as the current timestamp and client IP address, significantly reduces entropy. An attacker can approximate the key generation time and brute-force the ke...

CVE-2026-38447

osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing. The use of MD5, combined with predictable inputs such as the current timestamp and client IP address, significantly reduces entropy. An attacker can approximate the key generation time and brute-force the ke...

PT-2026-67460

Name of the Vulnerable Software and Affected Versions TP-Link Omada affected versions not specified Description A cryptographic weakness exists in the Omada adoption protocol. Session encryption keys used to protect communications between controllers and managed devices may be predictable because...

kernel security update

4.18.0-553.150.1 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

CVE-2026-9856

A vulnerability in huggingface/transformers versions =5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the savepretrained methods of PreTrainedTokenizerBase and ProcessorMixin, where keys from the chattemplate dictionary are used directly as...

CVE-2026-10774

Zephyr's Bluetooth Mesh subnet key management leaks one PSA Crypto key slot on every subnet-key teardown. In subsys/bluetooth/mesh/subnet.c, netkeyscreate imports the Private Beacon Key into a PSA key slot under CONFIGBTMESHPRIVBEACONS enabled by default, but subnetkeysdestroy guarded the matchin...

CVE-2026-9856

The CVE-2026-9856 entry describes a path traversal flaw in huggingface/transformers

Malicious code in trongriden (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 dfb2a16e0023940b622e66acf21c1597d4127d94fb730610f509960e49754c3f Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...

PT-2026-67349

Name of the Vulnerable Software and Affected Versions huggingface/transformers versions prior to 5.8.0.dev0 Description An issue allows arbitrary file writes through path traversal, a technique used to access files and directories outside the intended folder. The flaw exists in the save pretraine...

CVE-2026-55734

Allocation of Resources Without Limits or Throttling vulnerability in ueberauth guardian Guardian.Permissions module allows a denial of service via BEAM atom-table exhaustion. This vulnerability is associated with program file lib/guardian/permissions.ex and program routines...

CVE-2026-55734 guardian atom exhaustion in Guardian.Permissions.encode_permissions!/1

Allocation of Resources Without Limits or Throttling vulnerability in ueberauth guardian Guardian.Permissions module allows a denial of service via BEAM atom-table exhaustion. This vulnerability is associated with program file lib/guardian/permissions.ex and program routines...

CVE-2026-55734 guardian atom exhaustion in Guardian.Permissions.encode_permissions!/1

Allocation of Resources Without Limits or Throttling vulnerability in ueberauth guardian Guardian.Permissions module allows a denial of service via BEAM atom-table exhaustion. This vulnerability is associated with program file lib/guardian/permissions.ex and program routines...

CVE-2026-55734

CVE-2026-55734 affects ueberauth Guardian before 2.4.1. The bug is in Guardian.Permissions.encode_permissions!/1 (and related encode_permissions_into_claims!/2/do_encode_permissions!/2) where each key in a supplied map is turned into an atom via String.to_atom(to_string(k)) before validation. If ...

EUVD-2026-51917

Allocation of Resources Without Limits or Throttling vulnerability in ueberauth guardian Guardian.Permissions module allows a denial of service via BEAM atom-table exhaustion. This vulnerability is associated with program file lib/guardian/permissions.ex and program routines...

EEF-CVE-2026-54894 Atom-table exhaustion denial of service in Guardian via unbounded atom creation from binary keys

Summary Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-influenced binary input. Guardian.Plug.Keys derives connection and session namespace keys by passing arbitrary binaries to String.to\atom/1...