PT-2026-58999

Summary The Timesheet API PATCH /api/timesheets/id and POST /api/timesheets endpoints accept a user-supplied project ID and resolve it through a Symfony EntityType whose query builder allows the submitted ID to satisfy the access predicate via an unconditional OR branch. As a result, any...

GHSA-FPXG-5XMV-922M SurrealDB has bypass of field-level SELECT permissions through JSON Patch `copy` and `move` with empty `from`

SurrealDB lets callers modify records using JSON Patch operations via the UPDATE … PATCH statement and SDK equivalents such as db.patch. One of those operations is copy, which duplicates one field's value into another field of the same record. A PATCH with an empty from — for example, UPDATE...

CVE-2025-36083

IBM Concert Software 1.0.0 through 2.0.0 could allow a local user to obtain sensitive information from buffers due to improper clearing of heap memory before release...

OESA-2024-1358 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: There may be information leakage vulnerabilities in the tcmopen function in drivers/staging/gmjstcm/tcm.c The tcmopen function does not set the memory block to 0 when allocating memory kmalloc, which may lead to information leaka...