EulerOS 2.0 SP10 : perl-IO-Compress (EulerOS-SA-2026-3759)

According to the versions of the perl-IO-Compress packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob...

EulerOS 2.0 SP10 : perl-IO-Compress (EulerOS-SA-2026-3712)

According to the versions of the perl-IO-Compress packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob...

MAL-2026-16273 Malicious code in blue-string-formatter-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa3c9f5edcc636fc8d38e40a6bb225aed8f6b638be31f2abf8b6e747212c9565 The package advertises itself as 'Utility helpers for string formatting' but its shipped main file performs a single behavior: an XMLHttpRequest GET ...

CVE-2026-92757

Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption...

CVE-2026-92757 Malformed connection string may disable field level encryption

Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption...

Malformed connection string may disable field level encryption

Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption...

CVE-2026-92757

MongoDB Entity Framework Core Provider is affected by a vulnerability where placing a database name in the connection string may inadvertently disable field-level encryption , leaving sensitive data unprotected. The root cause is a malformed connection string interpretation by the provider. The i...

EUVD-2026-82382

Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption...

CVE-2026-92757 Malformed connection string may disable field level encryption

Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption...

CVE-2026-92758

This MongoDB -related vulnerability occurs when the application logging mode is set to DEBUG or a malformed MongoDB connection string is used, causing application logs to capture sensitive information such as passwords and AWS secure access keys. The root cause is overly verbose or misconfigured ...

CVE-2026-92758 Logs may collect sensitive information

If logging mode is set to DEBUG or a malformed MongoDB connection string is used, application logs may collect sensitive information if in use such as passwords and AWS secure access keys...

CVE-2026-92758 Logs may collect sensitive information

If logging mode is set to DEBUG or a malformed MongoDB connection string is used, application logs may collect sensitive information if in use such as passwords and AWS secure access keys...

Logs may collect sensitive information

If logging mode is set to DEBUG or a malformed MongoDB connection string is used, application logs may collect sensitive information if in use such as passwords and AWS secure access keys...

CVE-2026-86862

A flaw was found in pgAdmin 4. Authenticated users with toolsrestore or toolsmaintenance permissions can exploit a connection-string injection issue in the Restore and Maintenance tools. By manipulating the 'database' field passed to the --dbname option of pgrestore and psql, an attacker can...

CVE-2026-86864

A flaw was found in pgAdmin 4. An authenticated user with 'toolsbackup' permission can exploit an argument injection vulnerability in the Backup tool to create or overwrite arbitrary files on the system where pgAdmin is running. Additionally, a connection-string injection vulnerability allows the...

Information Exposure

Overview Steeltoe.Management.Endpoint is a package that provides building blocks for development of .NET applications that integrate with Spring and Spring Boot environments, as well as Cloud Foundry and Kubernetes with first-party support for Tanzu. Affected versions of this package are vulnerab...

GHSA-8PHW-XRJ9-CPQP Steeltoe.Management.Endpoint: HttpExchanges URI masking leaks query-string secrets

Summary Steeltoe's /actuator/httpexchanges endpoint records and displays request URIs after passing them through MaskedUri. The masking only covers the UserInfo portion of the URI inline user:password@host credentials and does not inspect the query string. With IncludeQueryString enabled by...

Steeltoe.Management.Endpoint: HttpExchanges URI masking leaks query-string secrets

Summary Steeltoe's /actuator/httpexchanges endpoint records and displays request URIs after passing them through MaskedUri. The masking only covers the UserInfo portion of the URI inline user:password@host credentials and does not inspect the query string. With IncludeQueryString enabled by...

AZL-102365 CVE-2026-92480 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Validate string descriptors The string descriptor length includes a two-byte header while the UTF-16 payload starts after it. utf16stoutf8s expects a count of UTF-16 code units, not bytes. Passing the payload byt...

CVE-2026-92480

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Validate string descriptors The string descriptor length includes a two-byte header while the UTF-16 payload starts after it. utf16stoutf8s expects a count of UTF-16 code units, not bytes. Passing the payload byt...