Index
Search
Search the public record. Drafts and scheduled notes are not included.
news
PostgreSQL pg_basebackup symlink overwrite is CVE-2026-6475
PostgreSQL's May 2026 minor releases fix CVE-2026-6475: symlink following in pg_basebackup plain format and pg_rewind lets an origin superuser overwrite local files and hijack the OS account. Practical mainly if data is moved or snapshotted before server start. CVSS 3.1 8.8. Not in CISA KEV. No confirmed public PoC of the original flaw.
Published 4h ago
news
wolfSSH 1.6.0 fixes five security flaws
wolfSSL released wolfSSH 1.6.0 on 6 October 2026 with five CVE fixes: CVE-2026-16516 (Critical, CVSS 4.0 9.0), an ECDSA host key curve check that enables server impersonation by an active MitM against clients with lax host key checks; CVE-2026-83540 (High, 7.7), Windows wolfSSHd logon token reuse across connections; and three Medium issues in key exchange, TCP forwarding and SFTP paths. Not in CISA KEV. No public PoC.
Published 4d ago
CVE-2026-16516
wolfSSH ECDSA host key curve not validated, enabling server impersonation
Auth bypass
Published 6d ago
CVE-2026-84897
wolfSSH server accepts server-only DH group exchange messages from clients
DoS
Published 6d ago
news
h1-brain brings HackerOne context to local MCP clients
Patrik Grobshäuser’s open-source h1-brain is a local Python MCP server that syncs a researcher’s HackerOne history into SQLite and ships a searchable database of more than 3,600 bounty-awarded public disclosures. It briefs AI clients; it is not a vulnerability scanner and has no CVE.
Published 6d ago
research
Two MongoDB driver bugs are not confirmed code execution
CVE-2026-96748 lets an untrusted hostname add a server to a PyMongo client. CVE-2026-96746 can crash the C driver. Both are scored 8.3. Neither NVD text is arbitrary code execution, and neither is in the CISA catalog.
Published 7d ago
CVE-2026-6475
PostgreSQL pg_basebackup and pg_rewind symlink file overwrite
Other
Published 14 May 2026