PostgreSQL JDBC Driver: Silent channel-binding authentication downgrade via unsupported certificate algorithms

Impact channelBinding=require connections can be silently downgraded from SCRAM-SHA-256-PLUS with channel binding to plain SCRAM-SHA-256 without it, losing the man-in-the-middle protection the setting is meant to guarantee. An attacker who can intercept the TLS connection triggers the downgrade...

EUVD-2026-41903

PostgreSQL JDBC Driver: Silent channel-binding authentication downgrade via unsupported certificate algorithms...

CVE-2026-16450

A vulnerability was identified in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. This affects the function getTenantId of the file /api/system/sys/dept/page of the component MyBatis-Plus Tenant Plugin. Such manipulation of the argument X-Tenant-Id leads to authorization...

CVE-2026-16450 zsadmin2025 ZS-Admin MyBatis-Plus Tenant Plugin page getTenantId authorization

A vulnerability was identified in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. This affects the function getTenantId of the file /api/system/sys/dept/page of the component MyBatis-Plus Tenant Plugin. Such manipulation of the argument X-Tenant-Id leads to authorization...

EUVD-2026-46283

A vulnerability was identified in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. This affects the function getTenantId of the file /api/system/sys/dept/page of the component MyBatis-Plus Tenant Plugin. Such manipulation of the argument X-Tenant-Id leads to authorization...

CVE-2026-16450

The CVE-2026-16450 issue affects zsadmin2025 ZS-Admin (up to commit b52e14536d59fda11e56e2536a1c32e82a38cead) in the MyBatis-Plus Tenant Plugin, specifically the function getTenantId in /api/system/sys/dept/page. The underlying problem is manipulation of the X-Tenant-Id argument, which leads to a...

CVE-2026-54291

A flaw was found in pgjdbc, an open-source PostgreSQL JDBC Driver. A remote attacker who can intercept a TLS Transport Layer Security connection can silently downgrade connections configured to require channel binding from SCRAM-SHA-256-PLUS to plain SCRAM-SHA-256. This downgrade bypasses the...

CVE-2026-64608 Apache Fory: Heap type confusion and out-of-bounds read/write in C++ compatible-mode field-skip paths

Heap type confusion and out-of-bounds read/write in the Apache Fory C++ implementation. When deserializing data in compatible mode, the field-skip paths do not correctly validate the declared field types against the actual data, so input with an inconsistent schema can cause type confusion and...

CVE-2026-64608 Apache Fory: Heap type confusion and out-of-bounds read/write in C++ compatible-mode field-skip paths

Heap type confusion and out-of-bounds read/write in the Apache Fory C++ implementation. When deserializing data in compatible mode, the field-skip paths do not correctly validate the declared field types against the actual data, so input with an inconsistent schema can cause type confusion and...

CVE-2026-64608

The Apache Fory C++ implementation is vulnerable to heap type confusion and out-of-bounds read/write issues. This flaw occurs during data deserialization in compatible mode because the field-skip paths fail to properly validate declared field types against actual data. An attacker providing input...

CVE-2026-3183

Zohocorp ManageEngine ADSelfService Plus versions before 6524 are vulnerable to Multi Factor Authentication Bypass...

CVE-2026-3183

CVE-2026-3183 affects ManageEngine ADSelfService Plus versions before 6524. The vulnerability is described as a Multi Factor Authentication (MFA) bypass, enabling an attacker with network access and low privileges to bypass MFA (per CVSS 3.1 metrics: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N; base scor...

CVE-2026-3183 Multi Factor Auth Bypass

Zohocorp ManageEngine ADSelfService Plus versions before 6524 are vulnerable to Multi Factor Authentication Bypass...

EUVD-2026-46164

Zohocorp ManageEngine ADSelfService Plus versions before 6524 are vulnerable to Multi Factor Authentication Bypass...

PT-2026-61853

Heap type confusion and out-of-bounds read/write in the Apache Fory C++ implementation. When deserializing data in compatible mode, the field-skip paths do not correctly validate the declared field types against the actual data, so input with an inconsistent schema can cause type confusion and...

PT-2026-61842

Zohocorp ManageEngine ADSelfService Plus versions before 6524 are vulnerable to Multi Factor Authentication Bypass...

CVE-2026-63985 ethtool: eeprom: add more safeties to EEPROM Netlink fallback

In the Linux kernel, the following vulnerability has been resolved: ethtool: eeprom: add more safeties to EEPROM Netlink fallback The Netlink fallback path for reading module EEPROM fallbacksetparams validates that offset totallen return -EINVAL; This could lead to surprises in both drivers and...

[SECURITY] Fedora 43 Update: log4cxx-1.7.0-2.fc43

Log4cxx is a popular logging package written in C++. One of its distinctive features is the notion of inheritance in loggers. Using a logger hierarchy it is possible to control which log statements are output at arbitrary granularity. This helps reduce the volume of logged output and minimize the...

CVE-2026-53712

The CVE describes a vulnerability in the OnGres SCRAM library (com.ongres.scram:scram-client and scram-common) where, prior to version 3.3, a TLS MITM can silently downgrade SCRAM-SHA-256-PLUS with channel binding to SCRAM-SHA-256 without channel binding when an X.509 certificate uses modern sign...

Security Bulletin: Vulnerability in IBM Data Product Hub

Summary A vulnerability was addressed in IBM Data Product Hub version 5.4.0 Patch 1 Vulnerability Details CVEID:CVE-2026-25087 DESCRIPTION: Use After Free vulnerability in Apache Arrow C++. This issue affects Apache Arrow C++ from 15.0.0 through 23.0.0. It can be triggered when reading an Arrow I...