UBUNTU-CVE-2026-50161

libre is a generic library for real-time communications with asynchronous input and output support. Prior to 4.8.1, the websockdecode function in src/websock/websock.c contains an integer overflow when validating a masked WebSocket frame that uses the 64-bit extended length encoding. The expressi...

Akamai Valkey Managed Database: Real-Time Memory for Enterprise AI

Introducing Akamai Valkey Managed Database: a low-latency, in-memory data layer to optimize AI inference costs, accelerate RAG, and power real-time AI agents...

CVE-2026-75850

ArcadeDB before 26.8.1 fails to bind the authenticated principal setCurrentUser on its batch and time-series HTTP handlers. Because no principal is bound on the worker thread, the engine's fine-grained per-type ACL layer LocalBucket.checkPermissionsOnFile does not execute for these handlers. In...

CVE-2026-75834

Grav before 2.0.14 contains a stored cross-site scripting vulnerability in the Security::detectXss function system/src/Grav/Common/Security.php. All XSS detection patterns use the PCRE /u UTF-8 modifier, so a single invalid UTF-8 byte anywhere in page content causes pregmatch to return false for...

CVE-2026-75829

grav-plugin-api versions before 1.0.15 fail to validate Twig content in the translate endpoint, allowing attackers with api.pages.write permission to persist pages with process.twig enabled. Attackers can submit crafted header and content parameters to execute server-side template injection...

CVE-2026-75850 ArcadeDB before 26.8.1 Per-Type ACL Bypass via Batch Handlers

ArcadeDB before 26.8.1 fails to bind the authenticated principal setCurrentUser on its batch and time-series HTTP handlers. Because no principal is bound on the worker thread, the engine's fine-grained per-type ACL layer LocalBucket.checkPermissionsOnFile does not execute for these handlers. In...

CVE-2026-75850 ArcadeDB before 26.8.1 Per-Type ACL Bypass via Batch Handlers

ArcadeDB before 26.8.1 fails to bind the authenticated principal setCurrentUser on its batch and time-series HTTP handlers. Because no principal is bound on the worker thread, the engine's fine-grained per-type ACL layer LocalBucket.checkPermissionsOnFile does not execute for these handlers. In...

CVE-2026-75850

ArcadeDB before 26.8.1 contains a per-type ACL bypass in its batch and time-series HTTP handlers . The root cause is that the authenticated principal (setCurrentUser) is not bound on the worker thread, causing the engine's fine-grained ACL layer (LocalBucket.checkPermissionsOnFile) to be skipped ...

EUVD-2026-60611

ArcadeDB before 26.8.1 fails to bind the authenticated principal setCurrentUser on its batch and time-series HTTP handlers. Because no principal is bound on the worker thread, the engine's fine-grained per-type ACL layer LocalBucket.checkPermissionsOnFile does not execute for these handlers. In...

CVE-2026-75850

ArcadeDB before 26.8.1 fails to bind the authenticated principal setCurrentUser on its batch and time-series HTTP handlers. Because no principal is bound on the worker thread, the engine's fine-grained per-type ACL layer LocalBucket.checkPermissionsOnFile does not execute for these handlers. In...

CVE-2026-75834

Grav before 2.0.14 contains a stored cross-site scripting vulnerability in the Security::detectXss function system/src/Grav/Common/Security.php. All XSS detection patterns use the PCRE /u UTF-8 modifier, so a single invalid UTF-8 byte anywhere in page content causes pregmatch to return false for...

CVE-2026-75834 Grav before 2.0.14 Stored XSS via Invalid UTF-8 Byte

Grav before 2.0.14 contains a stored cross-site scripting vulnerability in the Security::detectXss function system/src/Grav/Common/Security.php. All XSS detection patterns use the PCRE /u UTF-8 modifier, so a single invalid UTF-8 byte anywhere in page content causes pregmatch to return false for...

CVE-2026-75834

Grav CMS before 2.0.14 contains a stored cross-site scripting vulnerability in the Security::detectXss() function (system/src/Grav/Common/Security.php). All XSS detection patterns use the PCRE /u (UTF-8) modifier, so a single invalid UTF-8 byte anywhere in page content causes preg_match() to retu...

CVE-2026-75829

grav-plugin-api versions before 1.0.15 fail to validate Twig content in the translate endpoint, allowing attackers with api.pages.write permission to persist pages with process.twig enabled. Attackers can submit crafted header and content parameters to execute server-side template injection...

Vulnerabilities in Citrix Netscaler ADC and Netscaler Gateway

Citrix has identified vulnerabilities in NetScaler ADC and NetScaler Gateway that are related to inadequate input validation, incorrect access control, and improper memory release. The vulnerabilities, identified as CVE-2026-8451 and CVE-2026-10817, arise from inadequate input validation, where t...

SUSE CVE-2026-19548

Multiple Use-After-Free vulnerabilities were found in the addarchiveelement function in ld/ldmain.c of the GNU linker ld, a component of binutils. The root cause is that pluginmaybeclaim in ld/plugin.c frees the original BFD object via bfdclose/bfddeletebfd when entry-thebfd-myarchive == NULL, bu...

SUSE CVE-2026-70453

rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hashsearch function that allows a remote attacker to cause a denial of service by delivering a carefully constructed file list. A sender can exploit the quadratic-time worst-case behavior in hash lookups to exhaust receive...

PT-2026-76947

ArcadeDB before 26.8.1 fails to bind the authenticated principal setCurrentUser on its batch and time-series HTTP handlers. Because no principal is bound on the worker thread, the engine's fine-grained per-type ACL layer LocalBucket.checkPermissionsOnFile does not execute for these handlers. In...

PT-2026-76934

Name of the Vulnerable Software and Affected Versions Grav versions prior to 2.0.14 Description A stored cross-site scripting issue exists in the Security::detectXss function located in system/src/Grav/Common/Security.php. The XSS detection patterns utilize the PCRE /u UTF-8 modifier, which cause...

PT-2026-76929

grav-plugin-api versions before 1.0.15 fail to validate Twig content in the translate endpoint, allowing attackers with api.pages.write permission to persist pages with process.twig enabled. Attackers can submit crafted header and content parameters to execute server-side template injection...