CVE-2026-17424

CVE-2026-17424 affects IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 . The root cause is an improper limitation of a pathname to a restricted directory , allowing a remote attacker to bypass security restrictions . The CVSS 3.1 score is 4.8 (Medium) with a network attack vector, high complexity, no r...

net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls

A flaw was found in the net/http/httputil package, specifically within the ReverseProxy component. This vulnerability allows the ReverseProxy to forward query parameters that are not visible to Rewrite functions. This occurs because the ReverseProxy does not correctly consider the url.ParseQuery...

GHSA-XPV2-HRFC-HW62 Laravel Backpack CRUD: Unverified password change in MyAccountController via mass assignment

Summary The MyAccountController::postAccountInfoForm action bound to POST /admin/edit-account-info calls $this-guard-user-update$request-except'token'. Because the controller uses except'token' rather than $request-validated or the restricted keys defined in AccountInfoRequest::validationData, an...

EUVD-2026-63494

Mongoose is an embedded web server and network library. Prior to 7.23, a network attacker can impersonate a TLS server to a Mongoose client configured with a multi-certificate CA bundle. In src/tlsbuiltin.c, the mgtlsinit function stores the bundle in tls-cabundleder while tls-cader.len remains...

GHSA-89V8-RHWQ-HF77 asteval has a Sandbox Escape via BaseException Subclasses

Summary An attacker who can supply expressions to asteval.Interpreter.eval can raise SystemExit, KeyboardInterrupt, GeneratorExit, or BaseException from inside the sandbox. These exceptions are subclasses of BaseException but not Exception, so they bypass the except Exception: safety net in both...

USN-8653-1 postgresql-14, postgresql-16, postgresql-18 vulnerabilities

It was discovered that PostgreSQL incorrectly handled COPY FROM STDIN when an early failure occurred. An authenticated user could possibly use this issue to execute arbitrary SQL commands. CVE-2026-6464 It was discovered that PostgreSQL incorrectly reset extended statistics ownership during ALTER...

USN-8653-1: PostgreSQL vulnerabilities

It was discovered that PostgreSQL incorrectly handled COPY FROM STDIN when an early failure occurred. An authenticated user could possibly use this issue to execute arbitrary SQL commands. CVE-2026-6464 It was discovered that PostgreSQL incorrectly reset extended statistics ownership during ALTER...

GHSA-RMMH-P597-PPVV vulnerabilities

Vulnerabilities for packages: opensearch-dashboards...

KLA91240 Multiple vulnerabilities in Microsoft Windows

Multiple vulnerabilities were found in Microsoft Windows. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, gain privileges, spoof user interface. Below is a complete list of vulnerabilities: 1. A spoofing vulnerability in Windows Remote...

MiracleLinux 8 : dotnet10.0-10.0.111-1.el8_10 (AXSA:2026-1582:17)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1582:17 advisory. .NET: .NET Core: .NET Security Feature Bypass Vulnerability CVE-2026-62899 .NET: .NET Information Disclosure Vulnerability CVE-2026-62900 .NET: .NET...

PT-2026-79240

Name of the Vulnerable Software and Affected Versions IBM AIX versions 7.2 and 7.3 IBM PowerVM VIOS version 4.1 Description Remote attackers can bypass security restrictions because the system does not properly limit pathnames to restricted directories. Recommendations At the moment, there is no...

KLA91239 Multiple vulnerability in Microsoft Server Software

Multiple vulnerability was found in Microsoft Server Software. Malicious users can exploit this vulnerability to bypass security restrictions, gain privileges. Original advisories CVE-2026-65801 Exploitation Related products Microsoft-Exchange-Online CVE list CVE-2026-65801 unknown Solution Insta...

CVE-2026-67567: Unintended Proxy or Intermediary

A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a tenant, who has the ability to create HelmRelease custom resources CRs, to bypass existing security controls. The system's HelmRelease controller processes Helm chart templates using its own elevated...

KLA91233 Multiple vulnerabilities in Google Chrome

Multiple vulnerabilities were found in Google Chrome. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code. Below is a complete list of vulnerabilities: 1. A remote code execution vulnerability in Chromoting can be...

The vulnerability in the social_login.cgi script of the Zyxel networking device allows attackers to bypass existing security mechanisms.

The vulnerability of the sociallogin.cgi script of the Zyxel networking devices is related to deficiencies in authentication procedures. Exploiting this vulnerability allows a malicious actor to bypass existing security mechanisms remotely...

GHSA-HFG8-HC9C-6C3H vulnerabilities

Vulnerabilities for packages: docker-fips, buildkitd-fips, buildah-fips, skaffold-fips, kubescape-server-fips, kaniko, docker-cli-buildx, buildah, podman, telegraf, kubescape, buildkitd, falcoctl-fips, openbao, ctop-fips, skaffold, kaniko-fips, openbao-fips, kubescape-server, podman-fips,...

CVE-2026-15065

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote attacker to bypass security restrictions due to the exposure of intermediate certificate authority private keys in a publicly available update file...

EUVD-2026-62424

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote attacker to bypass security restrictions due to the exposure of intermediate certificate authority private keys in a publicly available update file...

CVE-2026-15065 Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote attacker to bypass security restrictions due to the exposure of intermediate certificate authority private keys in a publicly available update file...

CVE-2026-15065 Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote attacker to bypass security restrictions due to the exposure of intermediate certificate authority private keys in a publicly available update file...