CVE-2026-66142 Apache Neethi: Uncontrolled recursion in policy processing

Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures, which may lead to a denial of service attack when parsing policies due to runtime memory exhaustion. Users are recommended to upgrade to version 3.2.3, which fixes th...

CVE-2026-66142 Apache Neethi: Uncontrolled recursion in policy processing

Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures, which may lead to a denial of service attack when parsing policies due to runtime memory exhaustion. Users are recommended to upgrade to version 3.2.3, which fixes th...

OESA-2026-3143 python-filelock security update

Security Fixes: filelock is a platform-independent file lock for Python. In versions prior to 3.20.1, a Time-of-Check-Time-of-Use TOCTOU race condition allows local attackers to corrupt or truncate arbitrary user files through symlink attacks. The vulnerability exists in both Unix and Windows loc...

EUVD-2026-48557

A Cross-Site Scripting XSS vulnerability in Google Cloud Looker versions prior to 25.6.103, 25.12.65, 25.18.68, 26.0.66, 26.2.47, 26.4.36, 26.6.28, and 26.8.7 on Looker-hosted and Self-hosted allows an attacker to execute arbitrary JavaScript leading to administrative account takeover using a...

CVE-2026-15810 Cross-Site Scripting (XSS) in Looker allows Admin Account Takeover

A Cross-Site Scripting XSS vulnerability in Google Cloud Looker versions prior to 25.6.103, 25.12.65, 25.18.68, 26.0.66, 26.2.47, 26.4.36, 26.6.28, and 26.8.7 on Looker-hosted and Self-hosted allows an attacker to execute arbitrary JavaScript leading to administrative account takeover using a...

CVE-2026-15810

CVE-2026-15810 is a cross-site scripting (XSS) vulnerability in Google Cloud Looker prior to versions 25.6.103, 25.12.65, 25.18.68, 26.0.66, 26.2.47, 26.4.36, 26.6.28, and 26.8.7. The issue affects both Looker-hosted and self-hosted deployments and enables an attacker to execute arbitrary JavaScr...

CVE-2026-15810

A Cross-Site Scripting XSS vulnerability in Google Cloud Looker versions prior to 25.6.103, 25.12.65, 25.18.68, 26.0.66, 26.2.47, 26.4.36, 26.6.28, and 26.8.7 on Looker-hosted and Self-hosted allows an attacker to execute arbitrary JavaScript leading to administrative account takeover using a...

OPENSUSE-SU-2026:21440-1 Security update for java-17-openjdk

This update for java-17-openjdk fixes the following issues - Upgrade to upstream tag jdk-17.0.20+8 July 2026 CPU - CVE-2026-41254: Information disclosure or denial of service via integer overflow in CubeSize bsc1264994. - CVE-2026-46917: partial denial of service via TLS bsc1272223. -...

SUSE-SU-2026:22953-1 Security update for java-17-openjdk

This update for java-17-openjdk fixes the following issues - Upgrade to upstream tag jdk-17.0.20+8 July 2026 CPU - CVE-2026-41254: Information disclosure or denial of service via integer overflow in CubeSize bsc1264994. - CVE-2026-46917: partial denial of service via TLS bsc1272223. -...

SUSE-SU-2026:22944-1 Security update for java-17-openjdk

This update for java-17-openjdk fixes the following issues - Upgrade to upstream tag jdk-17.0.20+8 July 2026 CPU - CVE-2026-41254: Information disclosure or denial of service via integer overflow in CubeSize bsc1264994. - CVE-2026-46917: partial denial of service via TLS bsc1272223. -...

Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say

Redis shipped seven security releases on July 23 after researchers published authenticated RCE PoCs for stock Redis 6.2.22, 7.4.9, 8.6.4, and 8.8.0. All four chains require RESTORE. The Streams chains also need EVAL and XGROUP; the 8.8.0 chain needs EVAL and the bundled RedisBloom module. Redis...

CVE-2026-16870

Multiple security vulnerabilities in Snowflake libsnowflakeclient versions prior to 2.9.2 could allow remote code execution and credential exfiltration. A stack-based buffer overflow in the file download path could allow remote code execution on a victim host. An attacker could exploit this by...

CVE-2026-16870

CVE-2026-16870 involves multiple security vulnerabilities in Snowflake libsnowflakeclient, affecting versions prior to 2.9.2. The issues include a stack-based buffer overflow in the file download path that could lead to remote code execution, and a related out-of-bounds write causing memory corru...

CVE-2026-16870 Multiple Security Vulnerabilities in Snowflake libsnowflakeclient

Multiple security vulnerabilities in Snowflake libsnowflakeclient versions prior to 2.9.2 could allow remote code execution and credential exfiltration. A stack-based buffer overflow in the file download path could allow remote code execution on a victim host. An attacker could exploit this by...

EUVD-2026-48485

Multiple security vulnerabilities in Snowflake libsnowflakeclient versions prior to 2.9.2 could allow remote code execution and credential exfiltration. A stack-based buffer overflow in the file download path could allow remote code execution on a victim host. An attacker could exploit this by...

CVE-2026-16870

Multiple security vulnerabilities in Snowflake libsnowflakeclient versions prior to 2.9.2 could allow remote code execution and credential exfiltration. A stack-based buffer overflow in the file download path could allow remote code execution on a victim host. An attacker could exploit this by...

SUSE CVE-2026-16317

Missing validation of the outer contenttype byte on TLS 1.3 encrypted records in s2n-tls allows an active man-in-the-middle to silently discard individual application data records without either endpoint detecting the modification. RFC 8446 Section 5.2 requires that the outer contenttype of all...

SUSE CVE-2026-16318

The QUIC transport parameters extension handler in s2n-tls incorrectly uses s2nalloc instead of s2nrealloc to store the peer's transport parameters. When a TLS 1.3 connection goes through a HelloRetryRequest, the handler is called twice on the same connection. On the second call, s2nalloc zeroes...

EUVD-2026-48439

A vulnerability was identified in OWASP DefectDojo 2.59.0. This issue affects the function UserSerializer of the file dojo/apiv2/serializers.py of the component API/Web. Such manipulation of the argument isstaff leads to improper privilege management. The attack may be performed from remote. The...

PT-2026-64284

Name of the Vulnerable Software and Affected Versions Apache NimBLE versions prior to 1.10.0 Description Improper input validation in the Mesh Proxy SAR reassembly process can lead to the transmission of corrupted data to the application. This may cause memory pressure and unstable parsing...