CVE-2026-54620

sqlite3 provides Ruby bindings for the SQLite3 embedded database. From 2.1.0 to 2.9.4, the callbacks used for SQLite aggregate functions can be freed while still referenced during aggregation, resulting in a use-after-free. This issue is fixed in version 2.9.5...

CVE-2026-66749

Let's Chat 0.4.0 through 0.4.8 contains a null dereference vulnerability that allows authenticated attackers to crash the server by supplying a valid 24-character hex string room parameter that matches no document in the database. Attackers can send a crafted GET /messages request causing an...

CVE-2026-67181 Rouille 0.3.3 - 3.6.2 HTTP Request Smuggling via proxy Transfer-Encoding Header

Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize HTTP message boundaries by exploiting improper header forwarding in the proxy implementation. The proxy in src/proxy.rs forwards the client's Transfer-Encoding header to...

CVE-2026-61609 Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)

Pterodactyl is a free, open-source game server management panel. From 1.7.0 until 1.13.0, the authentication rate limiter defined in RouteServiceProvider::configureRateLimiting applied a single global bucket to the login and two-factor checkpoint endpoints instead of keying by IP or account: the...

Security Bulletin: IBM Maximo Application Suite uses python_dotenv-1.0.1-py3-none-any.whl which is vulnerable to CVE-2026-28684.

Summary IBM Maximo Application Suite uses pythondotenv-1.0.1-py3-none-any.whl which is vulnerable to CVE-2026-28684. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2026-28684 DESCRIPTION: python-dotenv reads key-value pairs from a...

Cedar-Java has policy injection, type confusion, and incorrect equality comparison vulnerabilities

Summary CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. Under certain circumstances, it could lead to incorrect equality comparisons. Impact EntityIdentifier.equals has inverted null/self branches The...

GHSA-4R9R-4425-74P7 Cedar-Java has policy injection, type confusion, and incorrect equality comparison vulnerabilities

Summary CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. Under certain circumstances, it could lead to incorrect equality comparisons. Impact EntityIdentifier.equals has inverted null/self branches The...

Access of Resource Using Incompatible Type ('Type Confusion')

Overview Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type 'Type Confusion' via the EntityIdentifier.equals method in CedarJava/src/main/java/com/cedarpolicy/value/EntityIdentifier.java. An attacker can trigger incorrect identity checks by supplying an...

CVE-2026-67178 Open Redirect in MISP Installer-Generated Apache Configuration

MISP installation scripts generated an Apache HTTP virtual-host configuration containing an incorrectly formatted HTTP-to-HTTPS redirect: Redirect permanent / https://misp.example Apache’s Redirect directive appends any portion of the requested path that follows the matched prefix to the configur...

CVE-2026-67178

MISP installation scripts generated an Apache HTTP virtual-host configuration containing an incorrectly formatted HTTP-to-HTTPS redirect: Redirect permanent / https://misp.example Apache’s Redirect directive appends any portion of the requested path that follows the matched prefix to the configur...

GHSA-3PWP-G2MJ-5P3V WordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerability

Impact WordPress Coding Standards WordPressCS versions before 3.4.1 contain an arbitrary code execution vulnerability in the WordPress.WP.EnqueuedResourceParameters sniff. As a result, running PHPCS with WordPressCS over untrusted PHP code, for example, in a CI pipeline that lints pull requests, ...

CVE-2026-66713

Deserialization of Untrusted Data CWE-502 in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat only when Tribes clustering is enabled, which is off by default allows an unauthenticated remote attacker with network access to the...

Malicious code in streak-daily-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8664341251bd6864f5aaf9692c5b7bd0945125853bc304c91709aaa335be38f1 On import of index.mjs, setImmediate invokes a syncWorkspace routine whose network destination and paths are reconstructed at runtime from hex-encode...

Malicious code in app-sim-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8470a75b327a72623ec4379302a2fc6ecdbaa302acf4fa1e39f1c688103562be package.json declares a postinstall hook that runs node test.js on npm install; test.js invokes fromstr2 and fromstr1 in index.js. fromstr2 fetches...

ALPINE-CVE-2026-62436

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. With the introduction of Grant Table v2 came the requirement to be able to switch between versions. Switching from v1 to v2 reduces the number of valid grant references, ...

CVE-2026-62435

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. With the introduction of Grant Table v2 came the requirement to be able to switch between versions. Switching from v1 to v2 reduces the number of valid grant references, ...

Malicious Package

Overview json-to-table-util is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-62436

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. With the introduction of Grant Table v2 came the requirement to be able to switch between versions. Switching from v1 to v2 reduces the number of valid grant references, ...

CVE-2026-62436

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. With the introduction of Grant Table v2 came the requirement to be able to switch between versions. Switching from v1 to v2 reduces the number of valid grant references, ...

buffer overruns in libfsimage iso9660 handling

ISSUE DESCRIPTION The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them: The directory loop itself assumes a good record length. This is CVE-2026-42494. The calculation of the System...