CVE-2026-49289 SimpleSAMLphp SAML2: Possible DoS via XPath Transform

The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. In 4.19.2 and 4.20.2, the library permits attacker-controlled XPath transforms while processing XML signatures in specially crafted SAML messages. XPath evaluation can consume uncontrolled processing resources,...

CVE-2026-74281

A flaw was found in the Linux kernel's Transparent Inter-Process Communication TIPC module. A remote attacker, acting as a peer node, could exploit this by sending specially crafted PUBLICATION messages with inverted service ranges. This oversight in validating service range bounds allows the...

PYSEC-2026-3692 Pydantic AI: Unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentials

Summary A client that can submit message history to a Pydantic AI UI adapter can reference arbitrary files in the application's model-provider or cloud-storage account. The server forwards the reference to the model provider, which fetches it using the server's own credentials, allowing the clien...

Pydantic AI: Unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentials

SummaryA client that can submit message history to a Pydantic AI UI adapter can reference arbitrary files in the application's model-provider or cloud-storage account. The server forwards the reference to the model provider, which fetches it using the server's own credentials, allowing the client...

PYSEC-2026-3693 Pydantic AI: Unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentials

Summary A client that can submit message history to a Pydantic AI UI adapter can reference arbitrary files in the application's model-provider or cloud-storage account. The server forwards the reference to the model provider, which fetches it using the server's own credentials, allowing the clien...

SUSE-SU-2026:23195-1 Security update for dracut

This update for dracut fixes the following issue: Update to version 059+suse.645.g79fd74d. Securitys issue fixed: - CVE-2026-15816: root code execution via unescaped error message written to sourced emergency-hook script in die bsc1274432. Other updates and bugfixes: - Fixbase: sanitize message...

SUSE-SU-2026:23246-1 Security update for dracut

This update for dracut fixes the following issue: Update to version 059+suse.611.g7d90691. Securitys issue fixed: - CVE-2026-15816: root code execution via unescaped error message written to sourced emergency-hook script in die bsc1274432. Other updates and bugfixes: - Fixbase: sanitize message...

BIT-POSTGRESQL-2026-14681 PostgreSQL improper enforcement of GSSAPI encryption when coupled with SSL

Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pghba.conf rules, via initial direct TLS connection. Despite a pghba.conf that appears to require GSSAPI, the connection may exchange data over TLS encryption alone. If the TLS...

PT-2026-78505

Name of the Vulnerable Software and Affected Versions Wazuh versions 3.9.0 through 4.14.4 Wazuh versions 5.0.0-beta1 and earlier Description The cluster protocol in framework/wazuh/core/cluster/common.py allows an authenticated cluster node to cause memory exhaustion on the master node. The recei...

PT-2026-78676

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-alpha.18, Lemmy blocks new private messages from a sender after the recipient blocks that sender, but the edit path skips the same block check. create private message checks the recipient's block list with...

Autonomous Cyber Defense in Connected Vehicles: A Multi-Agent Approach to V2X Security

A connected vehicle has roughly 100 milliseconds to decide whether an incoming Basic Safety Message is real or fabricated. If a false emergency braking alert reaches the planning pipeline in time, the car brakes - a safety failure triggered by a security failure. Existing intrusion detection...

CVE-2026-68552: Integer Overflow or Wraparound

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an unauthenticated remote client can send a STUN message over TCP or TLS with a body-length field from 65520 through 65532, causing the uint16t len variable in stungetmessagelenstr in src/client/nsturnmsg.c to...

PT-2026-78699

Name of the Vulnerable Software and Affected Versions Coturn versions prior to 4.15.0 Description An on-path attacker can modify authenticated STUN requests sent over plain UDP or TCP by appending attributes after the MESSAGE-INTEGRITY attribute and adjusting the STUN header length. Because the...

PT-2026-79987

Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pg hba.conf rules, via initial direct TLS connection. Despite a pg hba.conf that appears to require GSSAPI, the connection may exchange data over TLS encryption alone. If the TLS...

CVE-2026-76252: Improper Neutralization of Input During Web Page Generation

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.13, an unauthenticated user who tricks another user into visiting a malicious web page could run unauthorized JavaScript in that user's browser. This could allow for unauthorized access to all relevant data available to that user...

CVE-2026-12632

In Zephyr RTOS, ptp_msg_post_recv() in subsys/net/lib/ptp/msg.c indexes the 14-entry msg_size[] table using an attacker-controlled 4-bit message type (0xE/0xF) with no bounds check, causing out-of-bounds reads and writes via msg_tlv_post_recv(). Any host on the same link can trigger a crash (CVSS...

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Overview Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' via ProcedureDescription.computeReturnTypeAsJavaClass in src/main/java/com/rabbitmq/tools/jsonrpc/ProcedureDescription.java. An attacker can trigger loadin...

CVE-2026-53533

aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.1, SMTP.mail, SMTP.rcpt, SMTP.vrfy, and SMTP.expn send caller-supplied addresses without rejecting embedded CR or LF bytes. Data after the line break is framed as additional standalone SMTP command lines, allowing an...

UBUNTU-CVE-2026-61634

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, the AMQP connection tuning path records the negotiated AMQP framemax value, but src/main/java/com/rabbitmq/client/impl/SocketFrameHandler.java and...

SUSE CVE-2026-68140

In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix use-after-free of a severed iucvpath afiucv queues not-yet-received message notifications on iucv-messageq, each holding a raw pointer to the connection's iucvpath. When the peer severs the connection, iucvseverpath...