joi: Prototype pollution via a `__proto__` language key in custom messages

Impact An application that passes attacker-controlled data into joi's custom message configuration messages, message, prefs messages , Joi.extend messages or rule message lets the attacker write properties onto Object.prototype, where every object in the process then inherits them. A key named...

EUVD-2026-72924

AshAi exposes Ash read actions to language-model tool calls. The read tool accepts an aggregate result type min, max, sum, avg that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value. Ash field policies redact forbidden fields on returned records replacing them with...

EEF-CVE-2026-78230 AshAi aggregate tool can read field-policy-protected fields

Summary AshAi exposes Ash read actions to language-model tool calls. The read tool accepts an aggregate result type min, max, sum, avg that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value. Ash field policies redact forbidden fields on returned records replacing...

EUVD-2026-52226

NLTK: Missing Post-Download Integrity Verification Allows Malicious Package Injection...

Azure AI Language Elevation of Privilege Vulnerability

Missing authentication for critical function in Azure AI Language allows an unauthorized attacker to elevate privileges over a network...

[SECURITY] Fedora 43 Update: perl-XML-Bare-0.53-44.fc43

This module is a 'Bare' XML parser. It is implemented in C. The parser itself is a simple state engine that is less than 500 lines of C. The parser builds a C struct tree from input text. That C struct tree is converted to a Perl hash by a Perl function that makes basic calls back to the C to go...

RHEL 10 : buildah (RHSA-2026:64777)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:64777 advisory. The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a...

CVE-2026-86540 knowns before 0.30.0 Arbitrary Code Execution via LSP Binary

knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. When a repository with a crafted configuration is opened, the unvalidated binar...

Malicious Package

Overview dbt-language-server is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

xalgorix v4.6.72

Xalgorix — Open-source AI pentester that proves vulnerabilities Most scanners detect. Xalgorix proves. An autonomous LLM agent works a full pentest methodology, then an independent verifier re-exploits every finding before it's reported — so you get proof, not a pile of maybes to triage...

Merging Cyber Threat Intelligence through Retrieval-Augmented Generation and Small Language Models for Rich Threat Representation

Modern cybersecurity operations rely on CTI collected from heterogeneous sources, including semi-structured threat representations, IoCs, and narrative technical reports. However, these artifacts are often insufficient in isolation to reconstruct how an attack unfolds, under which conditions each...

ROS-20260907-73-0065

The vulnerability of the NewKeyring function in the Go programming language is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

Construction and Natural Language Querying of a Cybersecurity Knowledge Graph

Cybersecurity vulnerability information is distributed across numerous platforms and databases, making it difficult for researchers and practitioners to obtain a unified and structured understanding of existing threats. This is a critical issue in cybersecurity, where timely access to accurate...

FoxStryker_Scanner

🦊 FoxStryker — Advanced Web Vulnerability Scanner v3.0 FoxStr...

A Queryable Graph-Based Security Analysis Framework for O-RAN

The Open Radio Access Network O-RAN replaces vendor-locked RANs with a modular and interoperable architecture that fosters competition and accelerates innovation. With this openness comes increased complexity and a larger attack surface, making security a critical concern. Today, assessing O-RAN...

BUUCTF-Web-Writeups

BUUCTF-Web-Writeups A collection of CTF Web challenges writ...

opa v1.20.2

Open Policy Agent Open Policy Agent OPA is an open source, general-purpose policy engine that enables unified, context-aware policy enforcement across the entire stack. OPA is proud to be a graduated project in the Cloud Native Computing Foundation CNCF landscape. For details read the CNCF...

CVE-2026-46636

Twig , a PHP template language, is affected in versions 1.0.0 through 3.27.0 . The vulnerability stems from SecurityPolicy::checkMethodAllowed() unconditionally whitelisting all method calls on Twig\Markup instances. Because Twig\Markup is not final, subclasses inherit this bypass, exposing every...

CVE-2026-75170

Cross-site scripting XSS vulnerability in the /loginController/doLogin endpoint of the HubCore platform version 14.1.1 allows a remote unauthenticated attacker to inject arbitrary JavaScript into the application's response via the language POST parameter...

CVE-2026-73635

A flaw was found in Apache Struts. An unauthenticated remote client can exploit a vulnerability where the framework's localized-text caches grow without bound. This occurs when no fixed locale is configured, and the locale for text lookups is derived from the incoming request. This can lead to th...