CVE-2026-71437

A flaw was found in Mermaid, a JavaScript tool for creating diagrams. This vulnerability, known as prototype pollution, occurs when a specially crafted diagram defines a group with a specific identifier. An attacker who can provide malicious diagram text can exploit this by manipulating core...

SSHafe: A Real-Time SSH Brute Force Attack Detection and Novel Credential Rotation Standard

SSH remains a critical yet heavily targeted protocol for remote system administration, with password-based authentication exposing servers to large-scale brute-force, dictionary, and credential-spray attacks. Existing rule-based defences such as Fail2Ban fail to detect slow, distributed, or...

CVE-2026-33817

Index out-of-range when encountering a branch page with zero elements in go.etcd.io/bbolt Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to...

CVE-2026-47659

Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's /$result endpoint allows a caller who can obtain any valid async export job ID to supply file parameter values containing path...

EUVD-2026-54642

Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's /$result endpoint allows a caller who can obtain any valid async export job ID to supply file parameter values containing path...

CVE-2026-47661

Pathling Server prior to 2.0.0 is vulnerable in the /$result endpoint: an attacker with a valid async export job ID can supply file parameters with path traversal sequences. The handler only validates the supplied job and does not normalise or confine the requested file path to the job’s director...

CVE-2026-47659

Pathling Server prior to 2.0.0 exposes a path traversal vulnerability in the /$result endpoint. An attacker who can obtain a valid async export job ID can supply file parameters containing traversal sequences and the handler only validates the job ID, not the file path, allowing reads across the ...

CVE-2026-19206 MZ Automation libiec61850 ASDU Element sv_subscriber.c SVReceiver_stopThreadless heap-based overflow

A security flaw has been discovered in MZ Automation libiec61850 up to 1.6.1. This affects the function SVReceiverstopThreadless of the file src/sampledvalues/svsubscriber.c of the component ASDU Element Handler. Performing a manipulation results in heap-based buffer overflow. The attack must be...

Taxonomy-Driven Analysis of Open-Source AI Risk Mitigation Tools

Rapid adoption of large language models LLMs in enterprise settings has introduced operational, security, and governance risks. As generative AI applications move from pilot to production, manual harm identification and mitigation are becoming difficult to scale. Although many tools support model...

AlmaLinux 8 : firefox (ALSA-2026:47105)

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:47105 advisory. libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode CVE-2026-56208 firefox: thunderbird: Site isolation issue in the...

CVE-2026-16552

REJECTED A flaw was found in systemd-tmpfiles. When processing a tmpfiles.d configuration entry that writes to a file, systemd-tmpfiles can follow a symbolic link placed by an unprivileged local user, and an existing safety check does not detect this specific case because it always treats...

CVE-2026-68480

An attacker executing code on affected system could inject an interrupt at a precise moment to disrupt "Safe RET", the default Linux mitigation for speculative Return Overflow SRSO, which could potentially weaken that protection and may result in information disclosure...

CVE-2026-12844

A flaw was found in List::SomeUtils::XS. This vulnerability, a heap buffer overflow, occurs within the pairwise function. When a block call returns more than four times the current memory allocation, it causes data to be written beyond the intended buffer, corrupting the heap. This heap corruptio...

CVE-2026-67304

A null pointer dereference flaw in FreeRDP allows a remote attacker to cause a denial of service DoS via specially crafted smartcard requests. If reader-state decoding fails, the system attempts to free uninitialized states during cleanup, resulting in a process crash. Mitigation To mitigate this...

CVE-2026-71192

A flaw was found in the S3API middleware of OpenStack Swift. When configured with s3acl=true non-default, Swift-native control headers such as X-Copy-From and X-Copy-From-Account are not sanitized from S3 API requests. Because the S3 ACL mode bypasses Swift's native authorization, an authenticate...

CVE-2026-71191

A flaw was found in the S3API middleware of OpenStack Swift. The SigV4 presigned URL implementation does not require that semantic x-amz- headers be included in the request signature. An attacker who obtains a presigned PUT URL can inject unsigned headers such as X-Amz-Copy-Source to copy objects...

CVE-2026-18967

A flaw was found in the SAML broker component of Keycloak, an identity and access management solution. When configured as a SAML broker using the IdP-Initiated flow, Keycloak fails to enforce the OneTimeUse condition in SAML assertions. This allows an attacker who captures a valid, unused asserti...

Exploit for CVE-2026-65058

Trezor Safe Calldata Confirmation-Binding Bypass — CVE-2026-65...

CVE-2026-71267

A flaw was found in microtar. The mtarwritefileheader and mtarwritedirheader functions copy a caller-supplied entry name into a fixed 100-byte stack buffer using strcpy without validating the name length. An application that archives an attacker-controlled or externally supplied filename longer...

RLSA-2026:49621 Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Site isolation issue in the DOM: Navigation component CVE-2026-15719 firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component CVE-2026-15718 firefox: thunderbird: Mitigation...