CVE-2026-125125 is a low-severity vulnerability in the compose-lint GitHub Action versions 0.30.0 through 0.31.x. It involves improper output neutralization for logs (CWE-117) where error messages related to SARIF file subdirectory creation can be manipulated to inject workflow commands into the job log. This occurs when a committed symlink points to a directory with a specially crafted name containing newline and workflow commands. The issue is fixed in compose-lint version 0.32.0.
Eclipse Kura versions 5.0.0 through 5.6.2 have a vulnerability in the Web Console where each request to certain authentication endpoints allocates a new HTTP session without limits. This allows an unauthenticated attacker to cause unbounded session allocation, exhausting JVM heap memory and crashing the Kura process.
compose-lint version 0.31.0 contains an improper output neutralization vulnerability related to Azure Pipelines logging commands. Specifically, it fails to neutralize the Azure Pipelines ##vso[ logging-command opener in output paths, which could allow crafted Compose values or file names to inject logging commands into Azure Pipelines job logs. The issue does not affect GitHub Actions and was not reproducible by the maintainer on an Azure Pipelines agent. This vulnerability is fixed in version 0.32.0.
CVE-2026-125123 is a low-severity vulnerability in compose-lint version 0.31.0 where improper output neutralization for logs allows injection of workflow-command syntax into stderr output. This occurs when a repository path is passed without a preceding -- separator, enabling a carriage return to position commands at the start of a new line in GitHub Actions logs. The default pre-commit configuration and GitHub Action workflows are not affected. The issue is fixed in compose-lint version 0.32.0.
compose-lint version 0.31.0 has an improper output neutralization vulnerability (CWE-117) where the ##[ workflow-command opener is not sanitized in JSON or SARIF formatted output to stdout. This can cause GitHub Actions runners to interpret these strings as workflow commands when printed in logs. The issue does not affect lint results and is fixed in version 0.32.0.
CVE-2026-92684 is a high-severity vulnerability in Neo4j's @neo4j/graphql library versions 5.0.0 before 5.12.17 and 7.0.0 before 7.6.8. It involves missing authentication enforcement on aggregation queries, allowing unauthenticated remote attackers to read protected data. Specifically, field-level @authentication is not applied to string aggregates, and connection-root aggregates bypass entity-level aggregate authentication requirements, exposing sensitive aggregate results.
This content discusses the evolving role of Software Bill of Materials (SBOM) in software supply chain security, highlighting the challenges introduced by AI components and the need for actionable use of SBOM data. It emphasizes that SBOMs are foundational for understanding software composition but must be integrated into operational security processes to effectively manage vulnerabilities. The emergence of AI BOMs adds complexity due to dynamic models and data sources. The discussion also covers the importance of Vulnerability Exploitability eXchange (VEX) to prioritize risks and addresses concerns about SBOM disclosure from a defender's perspective.
compose-lint versions 0.31.0 up to but not including 0.32.0 contain a vulnerability where improper output neutralization for logs allows untrusted Compose values or repository paths starting with Unicode whitespace followed by :: to be interpreted as GitHub Actions workflow commands in CI environments. This flaw does not affect the linting result and is fixed in version 0.32.0.
Google has expanded access to its Gemini 4 Carbon AI model, which was used by DeepMind to formally verify the security guarantees of the Signal protocol's reference implementation (libsignal). This verification includes guarantees such as forward secrecy, post-compromise security, and authentication at the compiled machine code level. The AI-driven formal verification process significantly reduced the time required for proof generation and helped reclassify and patch critical bugs in open source projects. The verification excludes side channels and applies to Google's build of the code, not Signal's own applications. This advancement suggests AI can make formal verification more practical for real-world security-critical software.
CVE-2026-57907 is a privilege escalation vulnerability in WatchGuard Endpoint Security. It involves improper privilege management in the inter-process communication between the console and the protection service. A local, low-privileged authenticated user can exploit this flaw to execute arbitrary code with SYSTEM privileges by injecting code into the trusted console process and issuing privileged commands. The vulnerability affects versions prior to 8.00.26.0011 and has a high severity rating with a CVSS score of 8.5. A fix is available in version 8.00.26.0011.
VNote versions 3.11.0 through 4.11.x contain an OS command injection vulnerability in the Tasks feature. This occurs because magic variables like ${bufferName} and ${selectedText} are inserted into shell command strings without proper escaping. An attacker can craft a notebook with notes whose filenames or text include shell metacharacters, causing arbitrary commands to execute when a task referencing these variables is run. The vulnerability is fixed in version 4.12.0.
A Server-Side Request Forgery (SSRF) vulnerability exists in Intermesh Group-Office versions prior to 26.0.37. The vulnerability arises from the Bookmark.php description() action, which accepts an attacker-controlled URL parameter and passes it without validation to an HTTP client request. This allows an attacker to induce the server to make arbitrary HTTP requests. The issue has been fixed in version 26.0.37.
GroupOffice versions prior to 6.8.167, 25.0.102, and 26.0.27 contain a critical code injection vulnerability in the Contact/labels JMAP endpoint. This flaw allows an authenticated attacker to supply a crafted template string that leads to arbitrary OS command execution via PHP's eval() function. The vulnerability arises from insufficient validation of expressions within template assignments, enabling execution of system commands as the web server user. The issue is patched in the specified fixed versions.
Group-Office versions prior to 6.8.172, 25.0.108, and 26.0.33 contain a stored cross-site scripting (XSS) vulnerability. A low-privileged user can create manual reminders with arbitrary HTML/JavaScript and assign them to other users. When the victim's browser fetches notifications, the malicious script executes in the notification panel, enabling full account takeover of the victim's session. This vulnerability has been patched in the specified versions.
CVE-2026-115791 is a vulnerability in the Python standard library command line interfaces for gzip, tarfile, and zipfile. When decompressing archives, a malicious Python script can be extracted that shadows standard library modules, such as traceback.py. If an error occurs during subsequent decompression, the malicious script may be executed due to Python adding the current directory to sys.path. This vulnerability affects CPython versions prior to 3.16.0 and is fixed in version 3.16.0 by removing sys.path[0] to prevent module shadowing.
CVE-2026-125271 is a vulnerability in AWS aws-api-mcp-server before version 1.5.1 where incorrect normalization of operation names in custom security policy enforcement allows bypassing policy restrictions. This flaw permits execution of AWS API operations that should be denied or require elicitation, by exploiting operation names with consecutive capital letters. The issue is fixed in version 1.5.1.
CVE-2026-57884 is an escalation of privilege vulnerability in Intel(R) Graphics Software versions before 26.14.2303.1. It involves an uncontrolled search path in user applications running in Ring 3. An unprivileged, authenticated user could exploit this vulnerability with high complexity and active user interaction, potentially impacting system confidentiality, integrity, and availability. The CVSS score is 5.4, indicating a medium severity level.
Akamai CLI versions before 2.0.6 have a path traversal vulnerability that allows malicious packages to write files outside the intended install directory by exploiting unvalidated pathname segments in cli.json. This can lead to overwriting executables on the user's PATH, potentially persisting after uninstall.
CVE-2026-56438 is an escalation of privilege vulnerability in libva software affecting all versions. It involves an uncontrolled search path that may allow a local, authenticated, unprivileged user to escalate privileges through a high complexity attack requiring active user interaction. The vulnerability impacts confidentiality, integrity, and availability at a high level within the vulnerable system context.