CVE-2026-59894

The sqlparse Python library (versions before 0.6.0) fails to escape existing backslashes before quotes in its output_format='python' and output_format='php' modes (sqlparse/filters/output.py:65 and :114). Crafted SQL can break out of the generated string and inject arbitrary Python or PHP code. A...

CVE-2026-59894 sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashes

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.py fails to escape existing backslashes before quotes in sqlparse.format outputformat='python' and outputformat='php' and the corresponding sqlformat -l modes, allowing crafted SQL to terminate the...

MINI-MQXC-QHXX-9GWJ

Bulletin has no description...

MINI-3V7Q-WH86-X3WR

Bulletin has no description...

PYSEC-2026-3754

opensslencrypt versions before 1.4.0 use Python's non-cryptographic random module for steganographic pixel selection in the generatepseudorandomsequence function. Attackers who know the password can recover the Mersenne Twister state from approximately 624 outputs and predict pixel locations...

CVE-2026-74887

opensslencrypt before 1.4.0 imports Python's non-cryptographic 'random' module Mersenne Twister PRNG at line 15 of opensslencrypt/modules/pqc.py. No direct calls to random. were present in the code, so no cryptographic operation is currently affected; however, the import creates a hazard that...

EUVD-2026-60093

opensslencrypt versions before 1.4.0 use Python's non-cryptographic random module for steganographic pixel selection in the generatepseudorandomsequence function. Attackers who know the password can recover the Mersenne Twister state from approximately 624 outputs and predict pixel locations...

openssl: OpenSSL: Heap buffer overflow due to signed integer overflow in Unicode output sizing

A flaw was found in OpenSSL. A signed integer overflow vulnerability exists when sizing the destination buffer for Unicode output. This can lead to a heap buffer overflow, which may result in a crash or potentially allow an attacker to execute arbitrary code. Exploitation requires an application ...

MINI-QC22-4XH5-W22G

Bulletin has no description...

ROS-20260817-73-0032

The vulnerability of the Microsoft .NET software platform is related to incorrect encoding or escaping of output data. Exploiting this vulnerability can allow a malicious actor to execute an SSRF attack remotely...

CVE-2026-19969: Buffer Copy without Checking Size of Input

A security vulnerability has been detected in Open Asset Import Library Assimp 17c12da. The impacted element is the function Assimp::MDLImporter::GenerateOutputMeshes3DGSMDL7 of the file code/AssetLib/MDL/MDLLoader.cpp of the component 3DGS MDL7 Model Output Mesh Generator. The manipulation leads...

Topological Attribution Distance (TAD): Revealing Segment-Level RAG Influence on LLM Output Geometry for Incident Log Analysis

Large Language Models LLMs are increasingly being deployed in cybersecurity operations to assist cybersecurity analysts with rapid decision-making against emerging threats. However, there is a main criteria that must be met when using LLMs in cybersecurity, that is, trust in the generated outputs...

CVE-2026-74885: Improper Output Neutralization for Logs

opensslencrypt versions before 1.4.0 contain a logging bug in restorehiddenmodules that logs module counts after clearing, always showing zero restored modules and corrupting audit trails. Additionally, a race condition exists between module hiding and import hook installation where another threa...

ROS-20260817-73-0033

The vulnerability of the Microsoft .NET software platform is related to incorrect encoding or escaping of output data. Exploiting this vulnerability can allow a malicious actor to execute an SSRF attack remotely...

CVE-2026-46345: Improper Limitation of a Pathname to a Restricted Directory

compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the -o/--output argument in trestle author jinja allows writing files outside the intended workspace. The application does not properly validate, ../, .., or absolute paths. This allows...

Unity Linux 20.1070e Security Update: expat (UTSA-2026-099515)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099515 advisory. xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used. Tenable has extracted the preceding description block...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100310)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100310 advisory. In the Linux kernel, the following vulnerability has been resolved: esp: fix skb leak with espintcp and async crypto When the TX queue for espintcp is full,...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100370)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100370 advisory. In the Linux kernel, the following vulnerability has been resolved: seg6: separate dstcache for input and output paths in seg6 lwtunnel The seg6 lwtunnel uses a sing...

MINI-XRX7-7M96-VH7X

Bulletin has no description...

CVE-2026-74786 Scriban before 7.0.0 Denial of Service via Unbounded Template Output

Scriban before 7.0.0 affected versions = 6.6.0 contains a denial-of-service vulnerability in which the LimitToString safety limit default 1MB can be bypassed because ObjectToString resets the per-call length counter currentToStringLength on every top-level call and StringBuilderOutput enforces no...