Distributed Point Functions and Function Secret Sharing

A distributed point function DPF is a cryptographic primitive that enables compressed additive sharing of a secret weight-1 vector equivalently, a point function across two or more parties. The appealing lightweight structure of DPF constructions has enabled a wide range of applications. These...

PT-2026-76248

A floating point math calculation in ScaleAnyToQuantum of /MagickCore/quantum-private.h could lead to undefined behavior in the form of a value outside the range of type unsigned long long. The flaw could be triggered by a crafted input file under certain conditions when it is processed by...

PT-2026-66430

An unauthenticated remote attacker can trigger a firmware update download via the OCPP backend by supplying an invalid firmware file. This will cause the file to remain accessible for a short period before it is deleted due to improper locking during the cleanup process...

CVE-2026-35847

An issue in dnsmgr v.2.15 and before allows a local attacker to execute arbitrary code via the ping function of the CheckUils.php file...

CVE-2026-13308

Autel MaxiCharger AC Elite Home WebSockets Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to exploit this...

CVE-2026-13204 affecting package bind for versions less than 9.20.26-1

CVE-2026-13204 affecting package bind for versions less than 9.20.26-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-67435

linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations. Prior to version 6.0.0, lib.url.fetch followed cross-origin redirects while forwarding caller-supplied credential headers other than Authorization and Cookie, allowing a malicious...

CVE-2026-67436 Linuxfabrik monitoring-plugins: SSRF and auth-token disclosure via unvalidated @odata.id link in redfish-* plugins

Linuxfabrik monitoring-plugins provides Python monitoring plugins for Icinga, Nagios, and related monitoring systems. In 6.0.0 and earlier, the redfish- plugins built request URLs by concatenating an operator-supplied base URL with response-supplied @odata.id links, allowing a malicious or...

CVE-2026-64497

A flaw was found in the Linux kernel's iio: chemical: scd30 driver, which manages a specific type of sensor. This vulnerability involves an error in how the driver processes numerical data, specifically a 'sign-extension bug' that can corrupt a part of a floating-point number called the exponent...

CVE-2026-13697

undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be stored in the default shared cache and...

CVE-2026-54735

Prebid Server is an open-source solution for running real-time advertising auctions in the cloud. Prior to version 4.4.0, certain bidder adapters in Prebid Server interpolate user-supplied parameters into outbound request URLs without properly validating host and subdomain values, allowing crafte...

prebid-server's request forgery vulnerability allows for possible host environment data extraction

Impact Certain bidder adapters accept user-supplied parameters that are interpolated into outbound request URLs. Without proper input validation, a malicious actor could craft bid request parameters that cause the server to send HTTP requests to unintended destinations, potentially exposing...

CVE-2026-54735 prebid-server's request forgery vulnerability allows for possible host environment data extraction

Prebid Server is an open-source solution for running real-time advertising auctions in the cloud. Prior to version 4.4.0, certain bidder adapters in Prebid Server interpolate user-supplied parameters into outbound request URLs without properly validating host and subdomain values, allowing crafte...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: python3.12: python3.12-3.12.13-3.7.hum1 aarch64, x8664 python3.12-debug-3.12.13-3.7.hum1 aarch64, x8664 python3.12-devel-3.12.13-3.7.hum1 aarch64, x8664 python3.12-idle-3.12.13-3.7.hum1 aarch64,...

CVE-2026-33385

Quick.CMS 6.8 is affected by a Blind SQL injection in the administration panel, resulting from improper neutralization of input fields accessed by a high-privileged user. The vulnerability can bypass front-end validation controls and potentially lead to database destruction. The CVSS-derived metr...

CVE-2026-33385 Blind SQL Injection in Quick.CMS

A Blind SQL injection vulnerability has been identified in Quick.CMS. Improper neutralization of input provided by a high-privileged user into multiple fields in administration panel allows for Blind SQL Injection attacks. The vendor states that this administration panel already allows for...

CVE-2026-33385

A Blind SQL injection vulnerability has been identified in Quick.CMS. Improper neutralization of input provided by a high-privileged user into multiple fields in administration panel allows for Blind SQL Injection attacks. The vendor states that this administration panel already allows for...

CVE-2026-50641 Plaintext password storage in Streamsoft Business Intelligence

Streamsoft Business Intelligence BI stores users' passwords in plaintext form in the database This issue was fixed in version 6.8.0.0, users were also requested to change their password on the first login...

EUVD-2026-50237

Description: Missing Authorization in Apache Atlas. A missing authorization vulnerability in Apache Atlas's admin endpoints allows any authenticated user, regardless of their assigned role, to perform administrative operations. Affect Version: This issue affects Apache Atlas: from 0.8 through...

Public PoC Released for Exploited Check Point SmartConsole Authentication Bypass

Cybersecurity researchers have shared additional technical details about a recently patched critical security flaw impacting Check Point Security Management Server and Multi-Domain Security Management Server MDS that has come under active exploitation in the wild. The vulnerability, tracked as...