A wireless access point, a GoAhead-style httpd, and a single sprintf that copies an attacker-controlled GO parameter straight into a 64-byte stack buffer with no length check. One HTTP POST and the management service segfaults; with the right payload the saved return address is …
On August 6, 2026, NIST’s National Vulnerability Database published CVE-2026-70638, a high-severity integer-overflow vulnerability sitting not in some obscure plugin, but in llama.cpp itself — specifically the JNI wrapper that powers on-device LLM inference on Android. NVD…
On July 30, 2026, NIST’s National Vulnerability Database published CVE-2026-17543, a SQL injection vulnerability sitting not in some neglected WordPress plugin, but in PHP itself — specifically the pgsql extension that ships with the language. NVD scores it 9.8 Critical (C…
On July 24, 2026, a security researcher going by Kai Aizen (SnailSploit) reported a bypass of a patch that was less than six weeks old. The patch, shipped in pgAdmin 4 v9.16 on June 18, was supposed to stop the AI Assistant from executing anything but read-only SQL. The bypass, …
On July 25, 2026, NIST’s National Vulnerability Database published CVE-2026-66012, a missing-authorization vulnerability in SiYuan — the privacy-first, block-level note-taking application with over 45,000 GitHub stars and a large Docker-hosted user base. NVD scores it 10.0…