CVE-2026-67449 Portabase: Unauthenticated path traversal in TUS webhook overwrites AES-256-GCM master key

Portabase is a database backup and restore tool for PostgreSQL, MySQL, MsSQL, MariaDB, Firebird SQL, SQLite, MongoDB, Redis, Files and Docker Volume. Prior to version 1.21.2, a path traversal in the TUS upload webhook handler app/api/tus/hooks/route.ts allowed an unauthenticated attacker to...

CVE-2026-111455 Apache Airflow: Connections API: async connection test authorizes create at enqueue but overwrites a later-created connection at commit

Apache Airflow's asynchronous connection test checked permissions when the test was queued — only create permission when the connection ID did not exist yet — but, when the test completed with commitonsuccess, wrote the tested connection under that ID. A user allowed to create but not edit...

CVE-2026-111455 Apache Airflow: Connections API: async connection test authorizes create at enqueue but overwrites a later-created connection at commit

Apache Airflow's asynchronous connection test checked permissions when the test was queued — only create permission when the connection ID did not exist yet — but, when the test completed with commitonsuccess, wrote the tested connection under that ID. A user allowed to create but not edit...

CVE-2026-118668

The langgraph-api library (versions 0.1.2 through 0.15.0 ) contains a vulnerability where JavaScript or TypeScript custom authentication handlers can return a rewritten namespace that fails to carry across the runtime boundary. This allows an authenticated user to bypass isolation and access anot...

CVE-2026-118668 LangGraph JavaScript custom authentication may permit cross-user Store access

langgraph-api implements the LangGraph API for rapid development and testing. From 0.1.2 until 0.15.0, JavaScript or TypeScript custom authentication Store authorization handlers can return a rewritten namespace that is not carried across the runtime boundary and applied before the Store operatio...

CVE-2026-118668 LangGraph JavaScript custom authentication may permit cross-user Store access

langgraph-api implements the LangGraph API for rapid development and testing. From 0.1.2 until 0.15.0, JavaScript or TypeScript custom authentication Store authorization handlers can return a rewritten namespace that is not carried across the runtime boundary and applied before the Store operatio...

Linux Distros Unpatched Vulnerability : CVE-2026-79824

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A directory traversal vulnerability in HPE NonStop Python 3.x could allow attackers to overwrite arbitrary files via a .. dot dot sequence in filenames in a TAR...

EUVD-2026-98837

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.5, and 42.0.0-beta.2, Electron applications on macOS that use Squirrel.Mac-based automatic updates are vulnerable to a local race in the privileged ShipIt helper. The...

CVE-2026-104355 Temporal Server applies inbound namespace replication from a connected peer cluster to local namespaces

A connected peer cluster can modify a Temporal Server cluster's local namespaces, which are never replicated to that peer, because the receiving cluster applies inbound namespace replication updates to them. In a multi-cluster deployment, each cluster pulls replication tasks from the remote...

TencentOS Server 2: abrt (TSSA-2026:1088)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1088 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:...

Rocky Linux 8 [CIQ] Security Update: apcu-panel / libzip / libzip-debuginfo / libzip-debugsource / etc Multiple Vulnerabilities (crlsa-2022_6542)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20226542 advisory. ArchiveTar: allows an unserialization attack because phar: is blocked but PHAR: is not blocked CVE-2020-28948 ArchiveTar: improper filename sanitization...

rsync: rsync: Local Privilege Escalation via Symlink Following

A symlink-following vulnerability in rsync allows local attackers to redirect predictable output paths to arbitrary filesystem locations. When rsync runs with elevated privileges such as setuid or a privileged daemon, this enables arbitrary file overwrites and local privilege escalation...

abrt: event handler scripts follow symlinks when writing output files, allowing arbitrary file overwrites

A symlink following vulnerability was found in the ABRT post-create event handler scripts in libreport. Event scripts write output files using shell redirections without the ONOFOLLOW flag. If the target file is replaced with a symlink, the shell process running as root follows the symlink and...

abrt: event handler scripts follow symlinks when writing output files, allowing arbitrary file overwrites

A symlink following vulnerability was found in the ABRT post-create event handler scripts in libreport. Event scripts write output files using shell redirections without the ONOFOLLOW flag. If the target file is replaced with a symlink, the shell process running as root follows the symlink and...

Important: Red Hat Security Advisory: abrt security update

An update for abrt is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability...

RHEL 8 : abrt (RHSA-2026:69116)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69116 advisory. The Automatic Bug Reporting Tool ABRT recognizes defects in applications and creates bug reports that help maintainers fix the defects. ABR...

RHEL 7 : abrt (RHSA-2026:69121)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:69121 advisory. The Automatic Bug Reporting Tool ABRT recognizes defects in applications and creates bug reports that help maintainers fix the defects. ABRT uses a...

Malicious code in chai-as-promised-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be02bee1e19ad24ae6091f0793dc22af62e54030388bbdc7d1aa29b078ac17a5 The package name mimics the widely-used chai-as-promised assertion helper and reuses its README/description. lib/chai-as-promised-plus.js defines the...

Malicious code in bitcoinlib-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 32582a69a108bf3ab34d8bd16122918dd29a56bff6f68a771b77c6c946bf9308 During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category:...

Malicious code in osinthell (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 458757b4c185e84321b45bd7fec158459300d68106826e5774df2399818c7916 The package's only exported function, sorgu, invokes 26 sibling modules under public/a/b/.../z/ that carry out an immediate, irreversible destructive...