CVE-2026-97685

In LimeSurvey Community Edition 7.3.0 , an authenticated user with survey creation privileges can perform a cross-survey object authorization bypass via the REST survey-patching endpoint . While the endpoint correctly validates permissions against the survey ID in the URL, the underlying persiste...

CVE-2026-97685 LimeSurvey Community Edition 7.3.0 - Cross-survey object authorization bypass in REST survey patch operations

An authenticated LimeSurvey Community Edition 7.3.0 user allowed to create surveys can use their own survey as an authorized context while supplying question or answer identifiers belonging to another user's survey. The REST survey-patching endpoint checks the attacker's permission against the...

EUVD-2026-88608

An authenticated LimeSurvey Community Edition 7.3.0 user allowed to create surveys can use their own survey as an authorized context while supplying question or answer identifiers belonging to another user's survey. The REST survey-patching endpoint checks the attacker's permission against the...

CVE-2026-97685 LimeSurvey Community Edition 7.3.0 - Cross-survey object authorization bypass in REST survey patch operations

An authenticated LimeSurvey Community Edition 7.3.0 user allowed to create surveys can use their own survey as an authorized context while supplying question or answer identifiers belonging to another user's survey. The REST survey-patching endpoint checks the attacker's permission against the...

Where Do LLMs Decide to Break the Rules? Mechanistic Localization of Prompt Injection Compliance

When a prompt injection attack succeeds, a Large Language Model LLM abandons its assigned system role to comply with an adversarial instruction. While prior work has extensively quantified how often this occurs, we ask a more fundamental question: where inside the network does the model actually...

CVE-2026-97685: Authorization Bypass Through User-Controlled Key

An authenticated LimeSurvey Community Edition 7.3.0 user allowed to create surveys can use their own survey as an authorized context while supplying question or answer identifiers belonging to another user's survey. The REST survey-patching endpoint checks the attacker's permission against the...

PT-2026-102439

Name of the Vulnerable Software and Affected Versions LimeSurvey Community Edition version 7.3.0 Description An authenticated user with permissions to create surveys can manipulate the REST survey-patching endpoint. While the system verifies the user's permission against the survey ID in the...

ROOT-APP-NPM-CVE-2026-71867 CVE-2026-71867 in orval - Patched by Root

Root has patched CVE-2026-71867 in the orval package for Root:npm. Multiple fixed versions available...

Securing the unpatchable in an age of AI-driven vulnerabilities

AI is accelerating vulnerability discovery, leaving unpatchable operational technology OT systems at risk. Hoping for the best is not a viable anti-exploitation strategy. Deploying next-generation firewalls directly upstream allows for virtual patching through deep packet inspection. These system...

Whetstone

Whetstone On-device JIT enabler for iOS 12 / 13, all devi...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: powerpc/code-patching: Fixed a KASAN vulnerability by not marking the text patching area as a VMALLOC. Erhard reported the following KASAN vulnerabilities while booting his PowerMac G4 with a KASAN-enabled kernel 6.13-rc6: -...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: powerpc/64s: Fixed the PTE update for kernel memory on radix. When adding a PTE, a ptesync is required to ensure that the PTE update is performed correctly. Otherwise, a spurious fault may occur. radixsetpteat does not perform th...

Microsoft’s Patching

Once a month, Microsoft pushes a security update to all Windows users. Tomorrow's is a new record: Microsoft's patch for September is a doozy, with a record number of roughly 972 vulnerabilities fixed and 112 of them meeting the high critical-severity threshold. It was only two months ago that...

Important: kernel-livepatch-6.12.90-120.164

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring reconfiguration CVE-2026-74580 Affected Packages: kernel-livepatch-6.12.90-120.164 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

Important: kernel-livepatch-6.1.175-219.357

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring reconfiguration CVE-2026-74580 Affected Packages: kernel-livepatch-6.1.175-219.357 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

ROOT-OS-DEBIAN-12-CVE-2026-53296 CVE-2026-53296 in linux - Patched by Root

Root has patched CVE-2026-53296 in the linux package for Root:Debian:12. Multiple fixed versions available...

Security update for openssl-3-livepatches

This update for openssl-3-livepatches fixes the following issues: CVE-2026-14457: RPK server signature algorithm selection can dereference a missing certificate bsc1275145, bsc1274792. CVE-2026-63072: heap buffer overflow in CMS key unwrapping bsc1275133, bsc1274788. CVE-2026-63076: invalid point...

Security update for openssl-1_1-livepatches

This update for openssl-11-livepatches fixes the following issue: CVE-2026-63072: heap buffer overflow in CMS key unwrapping bsc1275133, bsc1274788. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternativel...

Security update for openssl-1_1-livepatches

This update for openssl-11-livepatches fixes the following issues: CVE-2026-63072: heap buffer overflow in CMS key unwrapping bsc1275133, bsc1274788. HollowByte: DoS vector against OpenSSL TLS ClientHello via remote, attacker-controlled memory allocations bsc1271712, bsc1271713. Patch Instruction...

Security update for openssl-1_1-livepatches

This update for openssl-11-livepatches fixes the following issue: CVE-2026-63072: heap buffer overflow in CMS key unwrapping bsc1275133, bsc1274788. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternativel...