CVE-2026-92903 Improper Input Validation in Snowflake CLI Versions Allow Unsanitized User-Controlled Values to be Interpolated into SQL Strings

Improper input validation in Snowflake CLI versions prior to 3.27.0 allowed unsanitized user-controlled values to be interpolated into SQL strings that are executed as multi-statement queries. An attacker who is able to supply a malicious project configuration file or craft command-line input can...

CVE-2026-92903 Improper Input Validation in Snowflake CLI Versions Allow Unsanitized User-Controlled Values to be Interpolated into SQL Strings

Improper input validation in Snowflake CLI versions prior to 3.27.0 allowed unsanitized user-controlled values to be interpolated into SQL strings that are executed as multi-statement queries. An attacker who is able to supply a malicious project configuration file or craft command-line input can...

CVE-2026-78425

Authorised users of outside applications behind the same corporate identity provider IdP, for example, a wiki, a ticketing system, an expenses tool, or anything they legitimately hold an account on can log into their system via SAML SSO. The IdP issues an assertion to them. If that assertion is...

OpenAI Reveals Six Model Incidents Involving Hidden Failures and Unauthorized Uploads

OpenAI on Wednesday disclosed six new instances of "unexpected or concerning model behavior" that took place over the past six months, while sharing a new framework for reporting, tracking, investigating, and disclosing model misalignment in a bid to improve transparency. "As AI systems grow more...

CVE-2026-78425

Authorised users of outside applications behind the same corporate identity provider IdP, for example, a wiki, a ticketing system, an expenses tool, or anything they legitimately hold an account on can log into their system via SAML SSO. The IdP issues an assertion to them. If that assertion is...

CVE-2026-78425 SAML Audience Confusion Allows Cross-SP Authentication

Authorised users of outside applications behind the same corporate identity provider IdP, for example, a wiki, a ticketing system, an expenses tool, or anything they legitimately hold an account on can log into their system via SAML SSO. The IdP issues an assertion to them. If that assertion is...

Vulnerabilities found in Cisco Identity Services Engine (ISE)

Cisco has identified 21 vulnerabilities in Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC. These vulnerabilities concern various security issues in Cisco ISE and ISE-PIC, including opportunities for unauthorized and low-privilege malicious actors to perform...

scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check

...

Gyazo Breach Exposes 23.62 Million User Records and 490 Million Image Metadata Records

A security breach at Gyazo , Helpfeel's image-sharing service, exposed about 23.62 million user records, including email addresses and password hashes, the Kyoto-based company said in a notice published Wednesday. It also exposed about 490 million image metadata records, mostly for images from...

CVE-2026-90982

@fastify/static is a Fastify plugin that serves static files from a configured root directory. In versions before 10.1.4, on a case-insensitive filesystem such as Windows or the default macOS volume, a route guard or allowedPath restriction can be bypassed by altering the letter case of a path...

CVE-2026-90982

CVE-2026-90982 affects the @fastify/static plugin (versions before 10.1.4 ). On case-insensitive filesystems such as Windows or the default macOS volume, a mismatch between the case-sensitive route matcher and the case-insensitive filesystem allows an unauthenticated attacker to bypass route guar...

CVE-2026-90982 @fastify/static vulnerable to route guard bypass via path case-folding

@fastify/static is a Fastify plugin that serves static files from a configured root directory. In versions before 10.1.4, on a case-insensitive filesystem such as Windows or the default macOS volume, a route guard or allowedPath restriction can be bypassed by altering the letter case of a path...

EUVD-2026-81383

@fastify/static is a Fastify plugin that serves static files from a configured root directory. In versions before 10.1.4, on a case-insensitive filesystem such as Windows or the default macOS volume, a route guard or allowedPath restriction can be bypassed by altering the letter case of a path...

Exploit for CVE-2026-67401

CVE-2026-67401 — cPanel/WHM EmailTrack SQL Injection → Root RC...

CVE-2026-85128

The Choose User Role at Registration WordPress plugin before 1.3.3 does not validate the role requested at registration against the roles an administrator chose to offer, allowing unauthenticated users to request any role, including administrator, and to be granted it once the request is approved...

CVE-2026-85128 Choose User Role at Registration for WooCommerce < 1.3.3 - Unauthenticated Privilege Escalation via Registration Role Request

The Choose User Role at Registration WordPress plugin before 1.3.3 does not validate the role requested at registration against the roles an administrator chose to offer, allowing unauthenticated users to request any role, including administrator, and to be granted it once the request is approved...

CVE-2026-85128

CVE-2026-85128 affects the Choose User Role at Registration WordPress plugin (also referenced as "for WooCommerce") before version 1.3.3 . The vulnerability is a missing role validation check: when a user registers, the plugin does not verify the requested role against the list of roles the admin...

EUVD-2026-81336

The Choose User Role at Registration WordPress plugin before 1.3.3 does not validate the role requested at registration against the roles an administrator chose to offer, allowing unauthenticated users to request any role, including administrator, and to be granted it once the request is approved...

U.S. Seizes NightmareStresser Domains Linked to Hundreds of Thousands of DDoS Attacks

The U.S. Department of Justice DoJ on Tuesday announced the court-authorized seizure of internet domains associated with a distributed denial-of-service DDoS-for-hire service known as NightmareStresser. The domains in question are: nightmare-stresser.com and nightmarestresser.org. Visitors to the...

gstreamer-plugins-base: GStreamer: Arbitrary code execution via OGG file parsing buffer overflow

A flaw was found in GStreamer. This vulnerability, a stack-based buffer overflow, occurs during the parsing of OGG files due to improper validation of user-supplied data length. A remote attacker could exploit this by tricking a user into visiting a malicious page or opening a malicious file,...