PT-2026-28239

SAT CFDI 3.3 contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the 'id' parameter in the signIn endpoint. Attackers can submit POST requests with boolean-based blind, stacked queries, or time-based blind SQL injection payloa...

RockyLinux 8 : kernel-rt (RLSA-2026:3964)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:3964 advisory. kernel: ipv6: BUG in pskbexpandhead as part of calipsoskbuffsetattr CVE-2025-71085 kernel: macvlan: fix possible UAF in macvlanforwardsource CVE-2026-230...

Beyond Content Safety: Real-Time Monitoring for Reasoning Vulnerabilities in Large Language Models

Large language models LLMs increasingly rely on explicit chain-of-thought CoT reasoning to solve complex tasks, yet the safety of the reasoning process itself remains largely unaddressed. Existing work on LLM safety focuses on content safety--detecting harmful, biased, or factually incorrect...

CVE-2026-4389: Improper Neutralization of Input During Web Page Generation

The DSGVO snippet for Leaflet Map and its Extensions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the leafext-cookie-time and leafext-delete-cookie shortcodes in all versions up to, and including, 3.1. This is due to insufficient input sanitization and output escaping on...

PT-2026-30541

Summary Allow-always exec approvals did not unwrap /usr/bin/time, so an unregistered time wrapper could bypass executable binding and reuse approval state for the inner command. Affected Packages / Versions - Package: openclaw npm - Affected: = 2026.3.22 - Latest released tag checked: v2026.3.23-...

PT-2026-28503

Name of the Vulnerable Software and Affected Versions Outline versions 0.86.0 through 1.5.9 Description Outline is a service that allows for collaborative documentation. It uses an Email OTP login flow for users not associated with an Identity Provider. Versions of Outline between 0.86.0 and 1.5....

Outline Security Vulnerabilities

Outline is an open-source knowledge base developed by Outline. Versions of Outline from 0.86.0 to 1.6.0 have security vulnerabilities. These vulnerabilities stem from the failure to invalidate OTP codes based on the number or frequency of invalid submissions, which can lead to brute-force attacks...

CVE-2026-1262

creationtimestamp| type| source ---|---|--- 2026-03-25 23:59:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhwcc7hhxc2i...

CVE-2026-25001

creationtimestamp| type| source ---|---|--- 2026-03-25 20:50:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhvxpbyn5425 2026-03-25 23:01:07+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhw6z4ekhx25...

CVE-2026-33696

creationtimestamp| type| source ---|---|--- 2026-03-25 20:47:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhvxjvy6i62s 2026-03-26 00:00:43+00:00| seen| https://infosec.exchange/users/offseq/statuses/116292533801339150 2026-03-26 00:00:45+00:00| seen|...

CVE-2026-23371

A flaw was found in the Linux kernel's sched/deadline component. When a SCHEDDEADLINE task, which is a type of real-time task, has its priority class changed to a lower setting, it may not correctly inherit parameters from other DEADLINE tasks. This can lead to corruption in the bandwidth...

GHSA-MVHF-547C-H55R thumbler allows OS Command Injection

thumbler through 1.1.2 allows OS command injection via the input, output, time, or size parameter in the thumbnail function because user input is concatenated into a shell command string passed to childprocess.exec without proper sanitization or escaping...

EUVD-2024-55504

OpenCart Core 4.0.2.3 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'search' parameter. Attackers can send GET requests to the product search endpoint with malicious 'search' values to extract sensitiv...

CVE-2026-3215

creationtimestamp| type| source ---|---|--- 2026-03-25 18:02:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhvodk3kkb2j...

EUVD-2026-14490

AVideo has a Blind SQL Injection in Live Schedule Reminder via Unsanitized livescheduleid in Schedulercommands::getAllActiveOrToRepeat...

SUSE CVE-2026-23294

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix race in devmap on PREEMPTRT On PREEMPTRT kernels, the per-CPU xdpdevbulkqueue bq can be accessed concurrently by multiple preemptible tasks on the same CPU. The original code assumes bqenqueue and devflush run atomically...

SUSE CVE-2026-23308

In the Linux kernel, the following vulnerability has been resolved: pinctrl: equilibrium: fix warning trace on load The callback functions 'eqbrirqmask' and 'eqbrirqack' are also called in the callback function 'eqbrirqmaskack'. This is done to avoid source code duplication. The problem, is that ...

SUSE CVE-2026-23364

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Compare MACs in constant time To prevent timing attacks, MAC comparisons need to be constant-time. Replace the memcmp with the correct function, cryptomemneq...

CVE-2026-3119

A flaw was found in BIND, specifically within the named daemon. An authenticated remote attacker, possessing a valid Transaction Signature TSIG key configured on the server, could send a specially crafted query containing a TKEY record. This action may cause the named daemon to crash, leading to ...

CVE-2026-20104

A vulnerability in the bootloader of Cisco IOS XE Software for Cisco Catalyst 9200 Series Switches, Cisco Catalyst ESS9300 Embedded Series Switches, Cisco Catalyst IE9310 and IE9320 Rugged Series Switches, and Cisco IE3500 and IE3505 Rugged Series Switches could allow an authenticated, local...