CVE-2026-104949

WarehousePG WHPG 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability CWE-862 in gpaddcoordinatorstandby. The function is named gpaddmasterstandby in WHPG 6, and WHPG 7 keeps that name as an alias. Unlike the other segment add and remove functions, i...

CVE-2026-104949

WarehousePG WHPG 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability CWE-862 in gpaddcoordinatorstandby. The function is named gpaddmasterstandby in WHPG 6, and WHPG 7 keeps that name as an alias. Unlike the other segment add and remove functions, i...

CVE-2026-104949

WarehousePG (WHPG) versions 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are susceptible to a missing authorization vulnerability (CWE-862 ) in the gp_add_coordinator_standby() function (known as gp_add_master_standby() in WHPG 6). The root cause is the lack of superuser privilege requirements f...

EUVD-2026-107264

WarehousePG WHPG 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability CWE-862 in gpaddcoordinatorstandby. The function is named gpaddmasterstandby in WHPG 6, and WHPG 7 keeps that name as an alias. Unlike the other segment add and remove functions, i...

Vibe-Trading LLM-callable Tools Permit Command Execution, Code Injection, And SSRF

Summary: 5 findings — "BashTool" shell-injection sink F6, the canonical RCE primitive, "BackgroundRunTool" async shell-injection sink F7, backtest "execmodule" runs top-level statements before the "SignalEngine" class check F8 — independent RCE path that does not match BashTool signatures,...

Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities

Summary IBM Guardium Data Protection has addressed multiple vulnerabilities in an update. Vulnerability Details CVEID:CVE-2026-33186 DESCRIPTION: gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of th...

Security update for python-hpack

This update for python-hpack fixes the following issue: CVE-2026-59980: unbounded variable integer decoding can cause run-away computation on malformed input, leading to quadratic runtime bsc1283035. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods lik...

SUSE-SU-2026:4832-1 Security update for python-hpack

This update for python-hpack fixes the following issue: - CVE-2026-59980: unbounded variable integer decoding can cause run-away computation on malformed input, leading to quadratic runtime bsc1283035...

php2shell-bypass-aslr-exp

php2shell – Official environment; no need for displayerrors,...

Exploit for CVE-2026-109618

php2shell-check Check, then apply, the php2shell fix on y...

BIT-NGINX-GATEWAY-2026-93479 NGINX map directive and regex matching vulnerability

A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a...

BIT-NGINX-2026-93479 NGINX map directive and regex matching vulnerability

A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a...

BIT-NGINX-GATEWAY-2026-15176 NGINX ngx_http_core_module vulnerability

A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $requestfilename variable. Alternatively, the same result could be achieved when the $requestfilename variable...

BIT-NGINX-2026-15176 NGINX ngx_http_core_module vulnerability

A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $requestfilename variable. Alternatively, the same result could be achieved when the $requestfilename variable...

CLSA-2025-1759431860 kernel: Fix of 39 CVEs

ASoC: topology: Clean up route loading CVE-2024-41069 - ASoC: topology: Fix references to freed memory CVE-2024-41069 - drm/dpmst: Fix MST sideband message body length check CVE-2024-56616 - Bluetooth: L2CAP: Fix not validating setsockopt user input CVE-2024-35965 - Bluetooth: L2CAP:...

CLSA-2025-1759431869 kernel: Fix of 39 CVEs

ASoC: topology: Clean up route loading CVE-2024-41069 - ASoC: topology: Fix references to freed memory CVE-2024-41069 - drm/dpmst: Fix MST sideband message body length check CVE-2024-56616 - Bluetooth: L2CAP: Fix not validating setsockopt user input CVE-2024-35965 - Bluetooth: L2CAP:...

An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating optimisations were possible in the accumulator variable in hmac.compare_digest.

...

Security update for ImageMagick

This update for ImageMagick fixes the following issues: CVE-2026-93586: use-after-free in the ImagesToBlob method can lead to a process crash bsc1281912. CVE-2026-93587: policy bypass in the PCD, CUBE and HALD coders can lead to extra memory allocation and a denial of service bsc1281909...

Security update for bouncycastle

This update for bouncycastle fixes the following issues: CVE-2026-17507: negative signed leafindex values from unsigned wire encodings can cause heap exhaustion bsc1284075. CVE-2026-17508: unbounded KDF iteration and memory parameters can cause resource exhaustion bsc1284073. CVE-2026-18036:...

Important: Red Hat Security Advisory: sudo security update

An update for sudo is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for ea...