GHSA-8G53-9M3C-69XG ImageMagick: Information Disclosure in MNG decoder because allocated memory is left unchanged

In the MNG decoder there is a possible heap information disclosure because part of the pixels are left unchanged...

EUVD-2024-55673

SurrealDB before 2.1.4 silently fails to overwrite table definitions when the DEFINE TABLE ... OVERWRITE clause is used on tables defined with TYPE RELATION. Because table definitions include the PERMISSIONS clause, an attempt to tighten a table's permissions via OVERWRITE does not take effect, a...

CVE-2026-53467

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, the MNG decoder contains a possible heap information disclosure vulnerability because part of the pixels are left unchanged. This issue has been fixed in versio...

PT-2026-54826

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 6.9.13-51 ImageMagick versions prior to 7.1.2-26 Description The MNG decoder contains a heap information disclosure issue where part of the pixels are left unchanged, potentially exposing data from the heap a regi...

USN-8232-1: Django vulnerabilities

It was discovered that Django did not vary cached response headers on cookies when sessions were not modified while SESSIONSAVEEVERYREQUEST was enabled. A remote attacker could possibly use this issue to steal a user's session. CVE-2026-35192 Kyle Agronick and Jacob Walls discovered that Django...

Quantum Computers Are Not a Threat to 128-bit Symmetric Keys

The advancing threat of cryptographically-relevant quantum computers has made it urgent to replace currently-deployed asymmetric cryptography primitives—key exchange ECDH and digital signatures RSA, ECDSA, EdDSA—which are vulnerable to Shor’s quantum algorithm. It does not, however, impact existi...

Stop Fixating on Prompts: Reasoning Hijacking and Constraint Tightening for Red-Teaming LLM Agents

With the widespread application of LLM-based agents across various domains, their complexity has introduced new security threats. Existing red-team methods mostly rely on modifying user prompts, which lack adaptability to new data and may impact the agent's performance. To address the challenge,...

CVE-2026-32326

SHARP routers do not perform authentication for some web APIs. The device information may be retrieved without authentication. If the administrative password of the device is left as the initial one, the device may be taken over...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-005572)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005572 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check stream before comparing them WHAT & HOW amdgpudm can pass a null stream to...

CVE-2025-62000

BullWall Ransomware Containment does not entirely inspect a file to determine if it is ransomware. An authenticated attacker could bypass detection by encrypting a file and leaving the first four bytes unaltered. Versions 4.6.0.0, 4.6.0.6, 4.6.0.7, and 4.6.1.4 were confirmed to be affected; other...

CVE-2025-14553

Exposure of password hashes through an unauthenticated API response in TP-Link Tapo app on iOS and Android for Tapo cameras, allowing attackers to brute force the password in the local network. Issue can be mitigated through mobile application updates. Device firmware remains unchanged...

CVE-2025-14553 Password Hash Leak Could Lead to Unauthorized Access on Tapo App via Local Network

Exposure of password hashes through an unauthenticated API response in TP-Link Tapo app on iOS and Android for Tapo cameras, allowing attackers to brute force the password in the local network. Issue can be mitigated through mobile application updates. Device firmware remains unchanged...

SUSE CVE-2025-40126

In the Linux kernel, the following vulnerability has been resolved: sparc: fix accurate exception reporting in copyfromtouser for UltraSPARC The referenced commit introduced exception handlers on user-space memory references in copyfromuser and copytouser. These handlers return from the respectiv...

EUVD-2025-120008

Malicious code in unchangedplanariansapphire-50 npm...

EUVD-2025-117016

Malicious code in unchanged-tomato-parakeet npm...

Malicious code in unchanged-tomato-parakeet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d7c3df03d5d11071ece7f3d6a02d6d287db936e19a518d6b13433fcfd3df1d6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

PT-2025-46588

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue was identified in the Linux kernel related to exception handling within the copy from user and copy to user functions on the Niagara architecture. The problem stemmed from...

EUVD-2025-101263

Malicious code in unchangedtarantulaz3n npm...

Malicious code in unchanged_tarantula_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector faca7deb97c8d301f65d024b1d173b79d71ca158826c2a01fb03f02ba79e03a6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in unchanged_salmon_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a3df351130e78eb9275d680457521fbf7ec652d7baa6535e2750730a55f5333 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...