PT-2026-64700

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An uninitialized heap leak exists in the ALSA sequencer. The snd seq event dup function copies an incoming event into a pool cell. In UMP-enabled builds, a check is performed to clear th...

PT-2026-59356

Summary The ydoc:document:join Socket.IO handler checks note ownership only when the document id starts with note: colon. However, the YdocManager storage layer normalizes all document IDs by replacing colons with underscores document id.replace":", " ". An attacker can join a document room using...

CVE-2026-49858

API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. In versions from 2.6.0 prior to 4.1.29, 4.2.26, and 4.3.12, a missing isCacheKeySafe gate in the JSON:API and HAL item normalizers causes a cross-user attribute leak. ApiPropertysecurity: ... is evaluated per request...

CVE-2026-46481 OpenMetadata: TEST_CONNECTION workflow leaks ingestion-bot JWT and database password to regular users

OpenMetadata is a unified metadata platform. Prior to version 1.12.4, a non-admin SSO user can trigger a TESTCONNECTION workflow for a Database Service and receive, in the HTTP 201 response of POST /api/v1/automations/workflows, both the cleartext database password in...

CVE-2025-25176

The Imagination Graphics DDK , a suite of GPU driver tools from Imagination UK , contains a security vulnerability where intermediate register values of secure workloads can be exfiltrated. This exposure occurs when workloads are scheduled from applications running in the platform's non-secure en...

EUVD-2018-18226

Malware in sbrugna...

EUVD-2019-14044

Malware in sbrugna...

EUVD-2017-9548

Malware in sbrugna...

EUVD-2017-0124

Malware in sbrugna...

EUVD-2017-17393

Malware in sbrugna...

EUVD-2003-0149

Malware in sbrugna...

EUVD-2006-2871

Malware in sbrugna...

EUVD-2006-6809

Malware in sbrugna...

Important: postgresql17

Issue Overview: PostgreSQL optimizer statistics allow a user to read sampled data within a view that the user cannot access. Separately, statistics allow a user to read sampled data that a row security policy intended to hide. PostgreSQL maintains statistics for tables by sampling data available ...

A week in security (August 11 – August 17)

Last week on Malwarebytes Labs: Italian hotels breached for tens of thousands of scanned IDs National Public Data returns after massive Social Security Number leak Romance scammers in Ghana charged with more than $100 million in theft Netflix scammers target jobseekers to trick them into handing...

XWiki leaks password hashes and other accessible password properties

Impact Any user with edit right on a page of the wiki can create an XClass with a database list property that references a password property, for example the password hash that is stored for users. When adding an object of that XClass, the content of that password property is displayed. In...

CVE-2023-33741

Macrovideo v380pro v1.4.97 shares the device id and password when sharing the device...

CVE-2022-4346

The All-In-One Security AIOS WordPress plugin before 5.1.3 leaked settings of the plugin publicly, including the used email address...

Rsync: rsync server leaks arbitrary client files

...

fetch: Authorization headers not dropped when redirecting cross-origin

Summary When you send a request with the Authorization header to one domain, and the response asks to redirect to a different domain, Deno'sfetch redirect handling creates a follow-up redirect request that keeps the original Authorization header, leaking its content to that second domain. Details...