Aggregator

Submit #902242 / VDB-399409

Submit #902241 / VDB-399408

Submit #902240 / VDB-399407

Submit #902239 / VDB-399406

Submit #902275 / VDB-238633

A vulnerability was found in vercel next.js up to 15.5.23/16.3.2 on Windows. It has been declared as critical. Affected is an unknown function of the component Router. Such manipulation leads to path traversal. This vulnerability is traded as CVE-2026-75604. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability described as very critical has been identified in WebPros cPanel up to 11.138.0.0. The impacted element is an unknown function. Such manipulation leads to code injection. This vulnerability is traded as CVE-2026-65643. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is recommended.

A vulnerability classified as problematic was found in Kamailio up to 6.1.1. Affected by this vulnerability is an unknown functionality of the component IMS P-CSCF Registration Handler. The manipulation results in denial of service. This vulnerability is reported as CVE-2026-52022. The attack can be launched remotely. No exploit exists.

A vulnerability was found in ggml-org llama.cpp and classified as problematic. This issue affects some unknown processing of the component Reranking. Executing a manipulation of the argument top_n can lead to resource consumption. This vulnerability is handled as CVE-2026-52132. The attack can be executed remotely. There is not any exploit available.

A vulnerability was found in tsi-coop tsi-dpdp-cms up to 0.5.0. It has been declared as critical. This vulnerability affects unknown code. The manipulation results in client-side enforcement of server-side security. This vulnerability is reported as CVE-2026-84841. The attack can be launched remotely. Moreover, an exploit is present. It is recommended to upgrade the affected component.

A vulnerability classified as critical has been found in Drupal Disable Login Page Plugin up to 1.1.4. Impacted is an unknown function. The manipulation leads to improper authentication. This vulnerability is uniquely identified as CVE-2026-16647. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability, which was classified as problematic, has been found in Jenkins Project Jenkins up to 2.567.x. This vulnerability affects unknown code of the component Appearance Configuration Page. This manipulation causes improper privilege management. This vulnerability appears as CVE-2026-84653. The attack may be initiated remotely. There is no available exploit. It is advisable to upgrade the affected component.

A vulnerability, which was classified as problematic, has been found in Jenkins Project Job Configuration History Plugin up to 1367.vc8fa_b_15101dc. The affected element is an unknown function of the component Data Binding. Performing a manipulation results in improper input validation. This vulnerability is reported as CVE-2026-84666. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability identified as critical has been detected in Submariner. Impacted is an unknown function of the file ipsec.conf of the component IPsec. Performing a manipulation of the argument CableName/Subnets results in injection. This vulnerability is cataloged as CVE-2026-66786. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability, which was classified as problematic, was found in ggml-org llama.cpp up to b5693. This affects an unknown part of the file common/json-schema-to-grammar.cpp. Such manipulation leads to uncontrolled recursion. This vulnerability is traded as CVE-2026-52130. The attack may be launched remotely. There is no exploit available.

A vulnerability has been found in ggml-org llama.cpp and classified as problematic. This vulnerability affects the function gguf_reader::read of the component gguf_reader. Performing a manipulation results in reachable assertion. This vulnerability is known as CVE-2026-52131. Remote exploitation of the attack is possible. No exploit is available. It is suggested to install a patch to address this issue.

AI agents secretly took over a 25-year-old German wiki for two months to cheat on tests, and OpenAI sat on the news until reporters found it first OpenAI finally admitted this weekend that a swarm of its own AI agents hijacked a German programming wiki earlier this year, turning it into a private message board […]

Learn how Shai-Hulud compromises trusted software workflows, exposes credentials across CI/CD environments, and creates attack paths into cloud, production, and downstream systems, and how security teams can contain and recover from the compromise.

The post Shai-Hulud in the Wild: What Security and Incident Response Teams Need to Know appeared first on Sygnia.

Плановое обслуживание превратило резервируемую инфраструктуру Google Cloud в единую точку отказа.

A vulnerability described as critical has been identified in maximhq Bifrost up to 1.x. Impacted is the function plugin.Open of the file /api/plugins of the component HTTP Transport. Such manipulation leads to server-side request forgery. This vulnerability is traded as CVE-2026-86242. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is recommended.