skilo add follows symbolic links, allowing arbitrary local file disclosure from a malicious skill source

Impact skilo add installs a skill by recursively copying the skill directory into the target skills directory. The copy routine copydirall classified each entry with std::fs::DirEntry::filetype — which does not follow symlinks — and then copied non-directory entries with std::fs::copy, which does...

EUVD-2026-44800

NocoBase: Sensitive Data Exposure via SQL Blacklist Bypass...

CVE-2026-54619

sqlite3 provides Ruby bindings for the SQLite3 embedded database. In version 2.9.4 and earlier, redefining a SQLite function with a different arity frees the previously registered function handler while SQLite may still reference it, resulting in a use-after-free. This issue is fixed in version...

CVE-2026-54620 sqlite3-ruby has Use-After-Free in SQLite Aggregate Function Callbacks

sqlite3 provides Ruby bindings for the SQLite3 embedded database. From 2.1.0 to 2.9.4, the callbacks used for SQLite aggregate functions can be freed while still referenced during aggregation, resulting in a use-after-free. This issue is fixed in version 2.9.5...

PT-2026-65482

Pivotick contains a cross-site scripting vulnerability in the inspect and edit node modals. Node labels and descriptions originating from graph data were interpolated directly into HTML used to construct the modal headers. An attacker able to supply or modify graph data could insert a malicious...

PT-2026-65605

Name of the Vulnerable Software and Affected Versions Cosmos versions prior to 0.22.19 Description Cosmos discloses Constellation device metadata to any requester who provides a non-empty Authorization header. The system fails to validate the token provided in the header, stripping the Bearer...

CVE-2026-64763

An out-of-bounds write issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing a maliciously crafted file m...

CVE-2026-64729

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination...

CVE-2026-43763

A permissions issue in the ATS component of macOS allows an application to read files outside of its sandbox. The vulnerability was addressed by removing the affected code. This issue is fixed in macOS Sequoia 15.7.8 , macOS Sequoia 15.8 , macOS Sonoma 14.8.8 , macOS Tahoe 26.6 , and macOS Tahoe ...

BIT-OPENBAO-2024-8185 Vault Vulnerable to Denial of Service When Processing Raft Join Requests

Vault Community and Vault Enterprise “Vault” clusters using Vault’s Integrated Storage backend are vulnerable to a denial-of-service DoS attack through memory exhaustion through a Raft cluster join API endpoint . An attacker may send a large volume of requests to the endpoint which may cause Vaul...

UBUNTU-CVE-2026-64526

In the Linux kernel, the following vulnerability has been resolved: ethtool: tsconfig: fix missing ethnlopscomplete tsconfigpreparedata calls ethnlopsbegin, we need to call ethnlopscomplete before returning the error...

CVE-2026-64296

In the Linux kernel, the following vulnerability has been resolved: exfat: bound uniname advance in exfatfinddirentry In exfatfinddirentry, each TYPEEXTEND file name entry advances the output pointer by a fixed amount while the loop guard only tracks the accumulated name length: if ++order == 2...

EUVD-2026-42629

Open WebUI: Cross-user model-list exposure via static cache key in getallmodels aiocache key= vs keybuilder= misuse...

EUVD-2026-44927

Microsoft Kiota: Code Generation Literal Injection in Kiota Python Generator...

CVE-2026-64244

In the Linux kernel, the following vulnerability has been resolved: drivers/base/memory: set mem-altmap after successful device registration If addmemoryblock fails at xastore under memory pressure for example, deviceunregister is called, which eventually triggers memoryblockrelease with mem-altm...

CVE-2026-64222

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: avoid double free of pool-stack on AQ init failure otx2poolaqinit frees pool-stack when mailbox sync or retry allocation fails, but leaves the pointer unchanged. Later, otx2sqaurapoolinit unwinds the partial setup...

DEBIAN-CVE-2026-56391

GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w --check-chars option is used. The findfield function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input,...

CVE-2026-47752

Tugtainer is a self-hosted app for automating updates of Docker containers. Versions prior to 1.30.2 are vulnerable to Server-Side Template Injection SSTI in the notification template feature. The titletemplate and bodytemplate fields are rendered using an unsandboxed jinja2.Environment, allowing...

7zip-26.02-1.1 on GA media (moderate)

7zip-26.02-1.1 on GA media Announcement ID: openSUSE-SU-2026:11319-1 Rating: moderate Cross-References: CVE-2026-14266 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the 7zip-26.02-1.1 packag...

CVE-2026-47708 MCP-for-Stata: Command injection via log_file_name parameter in Stata command wrapper

MCP-for-Stata is an MCP server for Stata to integrate Stata into an agent. Prior to version 1.17.3, the logfilename parameter in the statado API and CLI is directly interpolated into a Stata command string without sanitization. The security guard GuardValidator only scans the do-file content but...