PT-2026-107755

The Inline Formatter Field module allows site builders to template and style entities with a field. This module does not properly protect against template injection when parsing, allowing users to render protected data or execute unsafe Twig commands...

Rocky Linux 8 [CIQ] Security Update: cjose / cjose-debuginfo / cjose-debugsource / cjose-devel / etc (crlsa-2025_3997)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20253997 advisory. modauthopenidc: modauthopenidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data CVE-2025-31492 Tenable has extracted the preceding description bloc...

Intel TDX Scalable SGX AMD SEV-SNP Data Compromise

The vulnerability of implementations of confidential computing technologies such as Intel TDX, Intel Scalable SGX, and AMD SEV-SNP microprogramming software for Intel and AMD processors is related to insufficient verification of data authenticity. Exploiting this vulnerability can allow attackers...

CVE-2026-84587

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access protected user data...

CVE-2026-65380

CVE-2026-65380 is a vulnerability in Apple macOS related to improper handling of snapshots , where insufficient permissions logic could allow an app to access protected user data . The issue is fixed in macOS Golden Gate 27 ; the connected NCSC advisory also lists Sequoia 15.8 and Tahoe 26.7 amon...

NTFS Disclosure

The vulnerability of the NTFS file system in Windows operating systems relates to reading data beyond the buffer in memory. Exploiting this vulnerability can allow an attacker to disclose protected information...

ROS-20260810-73-0011

The vulnerability of the Networking component of the Oracle Java SE software platform, as well as of the Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition virtual machines, is related to insufficient protection of operational data. Exploiting this vulnerability can allow an attacker to...

Linux kernel efivarfs buffer overflow DoS

The vulnerability of the efivarentryget function in the fs/efivarfs/vars.c file of the Linux kernel file system is related to deficiencies in error handling. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected...

ksmbd_tree_conn_connect ksmbd_tree_connect ksmbd_tree_conn_

The vulnerabilities of the functions ksmbdtreeconnconnect, ksmbdtreeconnect PUT, and ksmbdtreeconndisconnect in the module fs/smb/server/mgmt/treeconnect.c, as well as the function smb2treedisconnect in the module fs/smb/server/smb2pdu.c, are related to the reuse of previously freed memory due to...

Linux Ntb Switchtec Buffer Overflow DoS

The vulnerability of the switchtecntbinitshared function in the drivers/ntb/hw/mscc/ntbhwswitchtec.c driver for Linux’s non-visible kernel bridges is related to unvalidated array indexing. Exploiting this vulnerability could allow an attacker to access protected information or cause service...

Microweber Unauthorized Access Phishing

The vulnerability of the Microweber content tagging system’s management system is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information and...

py-djangorestframework -- two vulnerabilities

Bruno Alla reports: Potential bypass of Django DATAUPLOADMAXMEMORYSIZE when parsing oversized JSON and urlencoded request bodies via DRF request.data AdminRenderer may disclose GET-protected data when rendering invalid write requests...

GitPython Repo.clone_from() Unauthorized Access

The vulnerability of the Repo.clonefrom function in the Python library for interacting with Git repositories in GitPython is related to insufficient protection of operational data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected...

MediaWiki Unauthorized Access

The vulnerability of the software for implementing the hypertext environment MediaWiki is related to insufficient protection of operational data. Exploiting this vulnerability may allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

MediaWiki Unauthorized Access

The vulnerability of the software for implementing the hypertext environment MediaWiki is related to insufficient protection of operational data. Exploiting this vulnerability may allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

STS AssumeRoleWithLDAPIdentity Unauthorized Access

The vulnerability of the endpoint of the STS Security Token Service, which manages MinIO object storage, is related to inconsistencies in response to incoming requests. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

CVE-2026-14541 Authentication Bypass and Audience Confusion in MCP Toolbox OAuth Provider

An authentication bypass and audience confusion vulnerability exists in the Google OAuth provider component of Google mcp-toolbox version 1.4.0. When a Google authService is initialized with mcpEnabled: true but lacks an explicitly defined audience or clientId, the ValidateMCPAuth pipeline for...

CVE-2026-14541

An authentication bypass and audience confusion vulnerability exists in the Google OAuth provider component of Google mcp-toolbox version 1.4.0. When a Google authService is initialized with mcpEnabled: true but lacks an explicitly defined audience or clientId, the ValidateMCPAuth pipeline for...

Microsoft Office Buffer Overflow Info Disclosure

The vulnerability of Microsoft Office packages, Microsoft 365 Apps for Enterprise, and Microsoft SharePoint relates to reading data beyond the buffer in memory. Exploiting this vulnerability can allow an attacker to disclose protected information...

Vite Local Development Path Traversal

The vulnerability of the Vite and Vite+ application development local servers is related to incorrect restrictions on path names to the catalog. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information...