CVE-2026-67344

ArcadeDB before 26.7.2 fails to enforce the UPDATESCHEMA database permission on the ALTER TYPE ... CUSTOM and ALTER TYPE ... BUCKETSELECTIONSTRATEGY SQL operations, which map to setCustomValue and setBucketSelectionStrategy in LocalDocumentType. An authenticated user with only read access e.g., a...

EUVD-2026-51807

ArcadeDB before 26.7.2 fails to enforce the UPDATESCHEMA database permission on the ALTER TYPE ... CUSTOM and ALTER TYPE ... BUCKETSELECTIONSTRATEGY SQL operations, which map to setCustomValue and setBucketSelectionStrategy in LocalDocumentType. An authenticated user with only read access e.g., a...

CVE-2026-67344 ArcadeDB before 26.7.2 Authentication Bypass via ALTER TYPE

ArcadeDB before 26.7.2 fails to enforce the UPDATESCHEMA database permission on the ALTER TYPE ... CUSTOM and ALTER TYPE ... BUCKETSELECTIONSTRATEGY SQL operations, which map to setCustomValue and setBucketSelectionStrategy in LocalDocumentType. An authenticated user with only read access e.g., a...

CVE-2026-67344 ArcadeDB before 26.7.2 Authentication Bypass via ALTER TYPE

ArcadeDB before 26.7.2 fails to enforce the UPDATESCHEMA database permission on the ALTER TYPE ... CUSTOM and ALTER TYPE ... BUCKETSELECTIONSTRATEGY SQL operations, which map to setCustomValue and setBucketSelectionStrategy in LocalDocumentType. An authenticated user with only read access e.g., a...

CVE-2026-67344

ArcadeDB before 26.7.2 is affected: ALTER TYPE operations for CUSTOM and BUCKETSELECTIONSTRATEGY do not enforce UPDATE_SCHEMA, allowing an authenticated user with only read access (e.g., a read‑only API token) to mutate a type’s custom schema metadata and bucket‑selection strategy via the HTTP co...

Piggybacking on Perception: Stealthy Concurrent Audio Prompt Injections against Multimodal LLM Agents

Large Language Model LLM-driven multimodal agents are increasingly deployed to execute autonomous tasks via continuous audio interaction. While this paradigm enhances interaction naturalness, it introduces a critical yet under-explored attack surface, as audio inputs inevitably contain...

CVE-2026-59888

A flaw was found in jackson-databind. When Java Records use a PropertyNamingStrategy, an attacker can bypass the @JsonIgnore annotation during deserialization. This allows a renamed JSON key to be assigned to a Record constructor parameter, even if it was intended to be ignored. Consequently, an...

GHSA-3PJW-73GF-8QR5 jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy

Summary For Java Records, POJOPropertiesCollector.removeUnwantedIgnorals records a @JsonIgnore-annotated component under its original implicit name before renameUsing applies the PropertyNamingStrategy. After the rename, ignoredPropertyNames still holds only the pre-rename name, so ignorableProps...

EUVD-2026-43957

jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy...

jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy

Summary For Java Records, POJOPropertiesCollector.removeUnwantedIgnorals records a @JsonIgnore-annotated component under its original implicit name before renameUsing applies the PropertyNamingStrategy. After the rename, ignoredPropertyNames still holds only the pre-rename name, so ignorableProps...

CVE-2026-16073

A security vulnerability has been detected in AstrBotDevs AstrBot up to 4.25.2. Affected by this issue is the function Star.texttoimage/NetworkRenderStrategy.render of the file astrbot/core/star/base.py of the component T2I Feature. The manipulation leads to cross site scripting. The attack is...

CVE-2026-16073

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2026-21729

Loki queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy...

EUVD-2026-44862

Loki queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy...

CVE-2026-21729

Loki queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy...

CVE-2026-15909

A vulnerability has been found in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. Affected is an unknown function of the file proses/add.php. The manipulation of the argument kdcs leads to authorization bypass. The attack is possible to be carried out remotely. This produ...

SUSE CVE-2026-59888

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector.removeUnwantedIgnorals records an...

CVE-2026-59888

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector.removeUnwantedIgnorals records an...

UBUNTU-CVE-2026-59888

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector.removeUnwantedIgnorals records an...

CVE-2026-59888

The CVE-2026-59888 issue affects Jackson Databind (Java Records) where, from 2.15.0 through 2.18.8, 2.21.4, and 3.1.4, a PropertyNamingStrategy can cause a bypass of @JsonIgnore. This occurs because POJOPropertiesCollector._removeUnwantedIgnorals() records an ignored component under its original ...