CVE-2026-71282

ChirpStack's SQLite-backend device tag filtering chirpstack/src/storage/device.rs, in both getcount and list interpolates the user-supplied tag KEY directly into a raw SQL fragment via Rust's format! macro dsl::sql::&format!"device.tags-'' =", k.bind::v, while only the tag VALUE is safely...

CVE-2026-63563

Sharp and Toshiba Tec MFPs shipped for a market with the user authentication feature disabled by default. When used with this initial configuration, address book editing and Document Filing features can be accessed without authentication, potentially exposing sensitive configuration data. The aff...

CVE-2026-47876

VMware ESX contains an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Non VMXNET3 virtual adapters are no...

Linux Distros Unpatched Vulnerability : CVE-2026-53583

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - - Update libgit2 to version 1.9.6. - Update the libgit2-sys Rust crate to the corresponding version 0.18.7. This includes fixes for various security issues,...

Linux Distros Unpatched Vulnerability : CVE-2026-53585

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - - Update libgit2 to version 1.9.6. - Update the libgit2-sys Rust crate to the corresponding version 0.18.7. This includes fixes for various security issues,...

GHSA-H9FM-XCV2-QFW3 Duplicate Advisory: Unauthenticated Endpoint Allows Cancellation of Any User's Active Test Webhook

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-33q9-f52j-gc75. This link is maintained to preserve external references. Original Description n8n before 2.28.0 and before 2.27.4 on the 2.27.x branch registers the DELETE /$restEndpoint/test-webhook/:id endpoin...

Duplicate Advisory: Unauthenticated Endpoint Allows Cancellation of Any User's Active Test Webhook

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-33q9-f52j-gc75. This link is maintained to preserve external references. Original Description n8n before 2.28.0 and before 2.27.4 on the 2.27.x branch registers the DELETE /$restEndpoint/test-webhook/:id endpoin...

EUVD-2026-47630

n8n before 2.28.0 and before 2.27.4 on the 2.27.x branch registers the DELETE /$restEndpoint/test-webhook/:id endpoint before authentication middleware is applied, allowing any unauthenticated network caller who knows a workflow ID to cancel that workflow's active test webhook registration. The...

PT-2026-63344

n8n before 2.28.0 and before 2.27.4 on the 2.27.x branch registers the DELETE /$restEndpoint/test-webhook/:id endpoint before authentication middleware is applied, allowing any unauthenticated network caller who knows a workflow ID to cancel that workflow's active test webhook registration. The...

CVE-2026-46428 lettre has TLS hostname verification disabled when using Boring TLS backend

lettre is a a mailer library for Rust. Starting in version 0.10.1 and prior to version 0.11.22, an inverted-boolean bug in lettre's boring-tls integration silently disables TLS hostname verification for callers using the default strict configuration. An on-path attacker presenting any chain-valid...

CVE-2026-46428 lettre has TLS hostname verification disabled when using Boring TLS backend

lettre is a a mailer library for Rust. Starting in version 0.10.1 and prior to version 0.11.22, an inverted-boolean bug in lettre's boring-tls integration silently disables TLS hostname verification for callers using the default strict configuration. An on-path attacker presenting any chain-valid...

World's Largest AI Model Repository Hugging Face Breached by Autonomous AI Agent

In an ironic twist, open-source artificial intelligence AI platform Hugging Face revealed that it was the victim of a hack perpetrated by an autonomous AI agent system. The company said it detected and responded to the incident targeting its production infrastructure earlier last week. "We...

OESA-2026-3005 edk2 security update

EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications. Security Fixes: Issue summary: A specially crafted password-encrypted CMS message can trigger a NULL pointer dereference during CMS decryption. Impact summary: This NULL pointer...

K000162282: Node.js vulnerabilities CVE-2026-48931 and CVE-2026-48934

Security Advisory Description CVE-2026-48931 A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request. This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26. CVE-2026-48934 A flaw in...

GHSA-VVP9-H8P2-XWFC Wasmtime: Memory leak in C API with `externref` and `anyref` types

Impact Wasmtime 37.0.0 and 37.0.1 have memory leaks in the C/C++ API when using bindings for the anyref or externref WebAssembly values. This is caused by a regression introduced during the development of 37.0.0 and all prior versions of Wasmtime are unaffected. If anyref or externref is not used...

CVE-2026-61448

Parse Server is affected by a stored cross-site scripting XSS vulnerability in versions = 9.0.0, 9.10.0-alpha.2 and = 8.6.83. When an uploaded file's extension is not recognized by the mime package, Parse Server preserves the client-supplied Content-Type. A malformed Content-Type that is not a...

CVE-2026-61448 Parse Server 9.0.0 Stored XSS via malformed Content-Type

Parse Server is affected by a stored cross-site scripting XSS vulnerability in versions = 9.0.0, 9.10.0-alpha.2 and = 8.6.83. When an uploaded file's extension is not recognized by the mime package, Parse Server preserves the client-supplied Content-Type. A malformed Content-Type that is not a...

K000162176: Spring authorization server vulnerability CVE-2026-22752

Security Advisory Description The cve record for the cve id does not exist. CVE-2026-22752 Impact There is no impact; F5 products are not affected by this vulnerability. Security Advisory Status F5 Product Development has evaluated the currently supported releases for potential vulnerability, and...

EUVD-2026-42688

Multiple protection mechanism failures in the Prisma Access Agent Data Loss Prevention DLP component for Windows allow a local user to bypass DLP policy enforcement controls. The Prisma Access Agent on macOS is not affected...

CVE-2026-0280

CVE-2026-0280 concerns an IPv6 packet processing vulnerability in the dataplane of Palo Alto Networks PAN-OS that allows an unauthenticated attacker to bypass firewall policy enforcement, enabling blocked traffic to reach protected services. Connected sources confirm PAN-OS impacts, with Cloud NG...