The vulnerability of the Python programming language’s HTTP client module allows attackers to inject arbitrary HTTP headers.

The vulnerability of the Python programming language’s HTTP client module is related to the failure to take measures to neutralize crlf sequences. Exploiting this vulnerability allows a remote attacker to inject arbitrary HTTP headers...

The vulnerability of adding additional tools and integration libraries for the Go language OpenTelemetry framework allows a perpetrator to execute arbitrary code.

The vulnerability of adding additional tools and integration libraries for the Go language-based OpenTelemetry framework is related to the use of an unreliable search path. Exploiting this vulnerability allows an attacker to execute arbitrary code...

ROS-20260710-73-0023

The vulnerability of the Go programming language is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to compromise the accessibility of protected information...

ROS-20260710-73-0007

The vulnerability of the LookupCNAME function in the Go programming language is related to a memory reclamation error when processing CNAME records. Exploiting this vulnerability can allow an attacker to cause service interruptions...

ROS-20260710-73-0005

The vulnerability of the Go programming language’s crypto-x509 component is related to unlimited resource distribution. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

PT-2026-57279

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, @logto/core reflected the SAML RelayState, SAMLResponse, and actionUrl into a Logto-origin auto-submit HTML form in packages/core/src/saml-application/SamlApplication/utils.ts without HTML-attribute...

ROS-20260710-73-0025

The vulnerability of the Reader.ReadResponse function in the Go programming language is related to an uncontrolled resource consumption resulting from incorrect connection handling during the creation of a response string. Exploiting this vulnerability can allow a malicious actor to cause service...

ROS-20260710-73-0006

The vulnerability of the Go programming language is related to errors in the certificate validation process. Exploiting this vulnerability can allow an attacker, operating remotely, to cause service failures...

ROS-20260710-73-0009

The vulnerability in the HTTP/2 implementation using the Go programming language arises from executing a loop with an unreachable exit condition when processing the value of SETTINGSMAXFRAMESIZE, which is equal to 0. Exploiting this vulnerability could allow a remote attacker to cause a service...

ROS-20260710-73-0019

The vulnerability of the Go programming language component tar Reader is related to unlimited distribution of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

ROS-20260710-73-0029

The vulnerability of the Go programming language is related to lack of access control. Exploiting this vulnerability can allow a remote attacker to increase their privileges...

EulerOS 2.0 SP12 : kata-containers (EulerOS-SA-2026-2534)

"According to the versions of the kata-containers package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input...

Linux Distros Unpatched Vulnerability : CVE-2026-59856

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script in runtime/autoload/phpcomplete.vim interpolates a class or...

CVE-2026-55615 Langroid: Neo4jChatAgent executes LLM-generated Cypher without validation (prompt-to-Cypher injection; config-conditional RCE), mirroring the SQLChatAgent bug fixed in CVE-2026-25879

Langroid is a framework for building large-language-model-powered applications. Prior to version 0.65.5, Neo4jChatAgent passes LLM-generated Cypher queries straight to the Neo4j driver with no validation, no statement-type allowlist, and no opt-out gate. The query text is influenceable by prompt...

EUVD-2026-42753

Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script in runtime/autoload/phpcomplete.vim interpolates a class or trait name, taken from the contents of the edited buffer, into a search pattern that is run via winexecute without escaping. A name...

CVE-2026-59858

Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in runtime/autoload/ccomplete.vim interpolates the typeref: or typename: extension field of a tags entry, without escaping, into a :vimgrep pattern that is run through :execute. Because :vimgrep honor...

CVE-2026-59857

Vim is an open source, command line text editor. Prior to 9.2.0725, the single-byte branch of spellsoundfoldsal in src/spell.c translates a word through a spell file's SAL sound-folding rules into a caller-owned result buffer, but its result writes are guarded with reslen MAXWLEN, allowing reslen...

CVE-2026-59834

SiYuan URI: The vulnerability affects the block search endpoint POST /api/search/fullTextSearchBlock prior to version 3.7.1. An attacker-controlled paths value is concatenated into SQL predicates used by non-SQL search modes, enabling an unauthenticated publish visitor to inject a UNION SELECT an...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the deletePage process. An attacker can execute arbitrary SQL commands and exfiltrate sensitive data or disrupt database integrity by crafting a malicious page tag, making it non-orphaned through legitimate linking...

CVE-2026-55208 Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password hashes

Pimcore Studio Backend Bundle is the backend bundle for Pimcore Studio. Prior to 2025.4.6 and 2026.1.6, an authenticated user can extract the admin password hash and other database content through time-based blind SQL injection in the DateFilter column key parameter. The POST...