CVE-2026-19565

Apache::AppSamurai::Util versions through 1.01 for Perl generate predictable session authentication keys from the clock and process id in CreateSessionAuthKey. CreateSessionAuthKey runs five rounds of SHA-256, each over a fresh Time::HiRes reading formatted to six decimal places, the running...

CVE-2026-19565

The Apache::AppSamurai::Util module for Perl (versions through 1.01 ) contains a vulnerability where it generates predictable session authentication keys via the CreateSessionAuthKey function. The root cause is the use of low-entropy inputs, specifically Time::HiRes readings and process IDs , to ...

CVE-2026-19565 Apache::AppSamurai::Util versions through 1.01 for Perl generate predictable session authentication keys from the clock and process id in CreateSessionAuthKey

Apache::AppSamurai::Util versions through 1.01 for Perl generate predictable session authentication keys from the clock and process id in CreateSessionAuthKey. CreateSessionAuthKey runs five rounds of SHA-256, each over a fresh Time::HiRes reading formatted to six decimal places, the running...

Arbitrary Code Execution

JSONata is vulnerable to Arbitrary Code Execution. The vulnerability is due to a bypassable hasOwnProperty check that allows crafted expressions to access object prototypes and constructors, which allows an attacker to invoke process.getBuiltinModule with childprocess and execute arbitrary code...

SUSE CVE-2026-76019

Incorrect authorization in Workers in Google Chrome prior to 151.0.7922.173 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: High...

Linux Distros Unpatched Vulnerability : CVE-2026-76023

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper resource control in Linux Toolkit Theming in Google Chrome prior to 151.0.7922.173 allowed a remote attacker who had compromised the renderer process t...

Linux Distros Unpatched Vulnerability : CVE-2026-76019

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in Workers in Google Chrome prior to 151.0.7922.173 allowed a remote attacker who had compromised the renderer process and leveraged...

PT-2026-79536

Name of the Vulnerable Software and Affected Versions better-npm-audit versions 3.x through 3.11.0 better-npm-audit version 4.0.0-rc.2 Description The software constructs an npm audit command by interpolating the user-supplied --registry option into a command string within...

CVE-2026-53530

RaTeX is a KaTeX-compatible math rendering engine written in Rust. Prior to version 0.1.11, the public parser entrypoint ratexparser::parse&str panics on the 9-byte input \verbéxé i.e. \verb followed by the non-ASCII delimiter é. When handling a \verb command, the parser slices the verbatim...

CVE-2026-53530 ratex-parser panics on `\verb` with a multibyte delimiter (UTF-8 byte-boundary slice)

RaTeX is a KaTeX-compatible math rendering engine written in Rust. Prior to version 0.1.11, the public parser entrypoint ratexparser::parse&str panics on the 9-byte input \verbéxé i.e. \verb followed by the non-ASCII delimiter é. When handling a \verb command, the parser slices the verbatim...

CVE-2026-53530 ratex-parser panics on `\verb` with a multibyte delimiter (UTF-8 byte-boundary slice)

RaTeX is a KaTeX-compatible math rendering engine written in Rust. Prior to version 0.1.11, the public parser entrypoint ratexparser::parse&str panics on the 9-byte input \verbéxé i.e. \verb followed by the non-ASCII delimiter é. When handling a \verb command, the parser slices the verbatim...

CVE-2026-63462

Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the shared OpenAPI validation error path in src/lib/error/bad-data-error.ts passes a raw request value from lodash.get to JSON.stringify in genericErrorMessage and fromOpenApiValidationErrors without guarding...

GHSA-W4MQ-XH27-6XPX Unleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted username

Vulnerability Details File: src/lib/addons/feature-event-formatter-md.ts Line: 355 in v8.0.1; format method Root Cause FeatureEventFormatterMd.format does: ts Mustache.escape = text = text; const text = Mustache.renderaction, context; mustache pinned ^4.2.0, confirmed installed 4.2.0 keeps escape...

CVE-2026-63462

Unleash , an open-source feature management platform, is vulnerable to an unauthenticated denial-of-service in versions prior to 7.5.2, 7.6.5, and 8.0.2 . The root cause is in the shared OpenAPI validation error path (src/lib/error/bad-data-error.ts), which passes a raw request value from lodash....

CVE-2026-63462

Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the shared OpenAPI validation error path in src/lib/error/bad-data-error.ts passes a raw request value from lodash.get to JSON.stringify in genericErrorMessage and fromOpenApiValidationErrors without guarding...

CVE-2026-62674 Omnigent: Shared Agent Bundle Overwrite Leads to Authenticated Runner RCE

Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, PUT /sessions/sessionid/agent checks LEVELEDIT permission for a session but does not reject a bound shared or template agent whose agent.sessionid is None. An authenticated user with ed...

CVE-2026-77087

Paperclip before 0.3.1 running in its default local_trusted mode fails to validate Host headers , enabling DNS rebinding attacks. An attacker can craft a malicious webpage that, when visited by a developer with Paperclip running locally, makes authenticated API requests and executes arbitrary com...

CVE-2026-77087

Paperclip before 0.3.1 in default localtrusted mode fails to validate Host headers, allowing attackers to execute arbitrary commands via DNS rebinding. An attacker can craft a malicious webpage that, when visited by a developer running Paperclip locally, uses DNS rebinding to make authenticated A...

CVE-2026-77087 Paperclip before 0.3.1 Remote Code Execution via DNS Rebinding

Paperclip before 0.3.1 in default localtrusted mode fails to validate Host headers, allowing attackers to execute arbitrary commands via DNS rebinding. An attacker can craft a malicious webpage that, when visited by a developer running Paperclip locally, uses DNS rebinding to make authenticated A...

SUSE-SU-2026:23251-1 Security update for sssd

This update for sssd fixes the following issues: - CVE-2026-68742: insufficient validation in the NSS responder can lead to an out-of-bounds read and a process crash when a crafted GETHOSTBYADDR request is sent to the NSS responder socket bsc1273922. - CVE-2026-68743: insufficient validation in t...