CVE-2026-90711

proxy-addr is a Node.js module that backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7 , a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix (e.g., ::ffff:10.0.0.0/8 instead of /104) is silently accepted, causing every IPv4 address to be treated as trusted...

Security Bulletin: IBM Planning Analytics Local is affected by security vulnerabilities

Summary The Planning Analytics Workspace component of IBM Planning Analytics is affected by security vulnerabilities. These vulnerabilities have been addressed in IBM Planning Analytics Local v2.0 - IBM Planning Analytics Workspace version 2.1.22. Vulnerability Details CVEID:CVE-2026-41417...

CVE-2026-84598

A path traversal issue was addressed with improved path validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27. An attacker with physical access to a trust-paired device may be able to read and write arbitrary files...

CVE-2026-84598

A path traversal issue was addressed with improved path validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27. An attacker with physical access to a trust-paired device may be able to read and write arbitrary files...

CVE-2026-84598

CVE-2026-84598 is a path traversal vulnerability in Apple iOS and iPadOS , caused by insufficient path validation. An attacker with physical access to a trust-paired device may be able to read and write arbitrary files . The issue is fixed in iOS 26.7 , iPadOS 26.7 , iOS 27 , and iPadOS 27 . CISA...

EUVD-2026-78001

A path traversal issue was addressed with improved path validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27. An attacker with physical access to a trust-paired device may be able to read and write arbitrary files...

CVE-2025-24890

A flaw was found in gix-sec. On Windows, an elevated administrator running a program that uses gix-sec may incorrectly trust repositories controlled by another user. This bypasses security protections, allowing repository configurations or hooks to execute commands with the administrator's...

CVE-2025-24890

gitoxide is an implementation of git written in Rust. Prior to 0.13.3, the gix-sec crate on Windows incorrectly treats repositories controlled by another user as trusted when an administrator runs a dependent program with an unfiltered elevated token. In gix-sec/src/identity.rs,...

AZL-100953 CVE-2025-24890 affecting package rust 1.75.0-31

gitoxide is an implementation of git written in Rust. Prior to 0.13.3, the gix-sec crate on Windows incorrectly treats repositories controlled by another user as trusted when an administrator runs a dependent program with an unfiltered elevated token. In gix-sec/src/identity.rs,...

AZL-100956 CVE-2025-24890 affecting package rust 1.96.1-1

gitoxide is an implementation of git written in Rust. Prior to 0.13.3, the gix-sec crate on Windows incorrectly treats repositories controlled by another user as trusted when an administrator runs a dependent program with an unfiltered elevated token. In gix-sec/src/identity.rs,...

EUVD-2025-210908

gitoxide is an implementation of git written in Rust. Prior to 0.13.3, the gix-sec crate on Windows incorrectly treats repositories controlled by another user as trusted when an administrator runs a dependent program with an unfiltered elevated token. In gix-sec/src/identity.rs,...

CVE-2025-24890 gix-sec safe.directory protections absent for elevated administrators

gitoxide is an implementation of git written in Rust. Prior to 0.13.3, the gix-sec crate on Windows incorrectly treats repositories controlled by another user as trusted when an administrator runs a dependent program with an unfiltered elevated token. In gix-sec/src/identity.rs,...

Astra Linux – Vulnerability in grub2

The GRUB2’s shimlock verifier allows non-kernel files to be loaded on shim-powered secure boot systems. Allowing such files to be loaded may lead to unverified code and modules being loaded in GRUB2, thereby breaking the secure boot trust-chain...

Astra Linux – Vulnerability in PostgresSQL 11

When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries during the initial establishment of a connection, despite the use of SSL certificate verification and encryption...

Astra Linux - Vulnerability in Golang-1.19

The ParseAddressList function improperly handles comments text within parentheses within display names. Since this contradicts conforming address parsers, it can lead to different trust decisions being made by programs that use different parsers...

Astra Linux – Vulnerability in Intel Microcode

In the memory subsystem of certain IntelR XeonR 6 processors, out-of-bounds writing when using IntelR SGX or IntelR TDX may allow a privileged user to potentially enable privilege escalation through local access...

CVE-2026-85195

Joomla Extension - regularlabs.com - Privileged stored XSS via link option in Articles Anywhere extension for Joomla 20.0.0 - Articles Anywhere accepts link options such as onclick and onmouseover. In affected versions, those options become real HTML event attributes without checking the article...

Linux Distros Unpatched Vulnerability : CVE-2025-24890

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gitoxide is an implementation of git written in Rust. Prior to 0.13.3, the gix-sec crate on Windows incorrectly treats repositories controlled by another user a...

CVE-2026-90651

Socket Firewall (socketdev/socket-registry-firewall) in registry mode before 2.0.0 does not verify upstream TLS certificates by default. When api_ssl_verify and upstream_ssl_verify are omitted from socket.yml, the generated OpenResty/Lua HTTP client accepts any certificate without chain validatio...

CVE-2026-90553

A flaw was found in vLLM. The LlavaOnevision2 processor loader incorrectly ignores the trustremotecode parameter, which is designed to prevent the execution of untrusted code. This oversight allows an attacker to craft a malicious model containing arbitrary code. When such a model is loaded, the...