The vulnerability of the DNS LDNS library, related to the lack of a mechanism for verifying the source of data, allows attackers to compromise the integrity of the data.

The vulnerability of the DNS LDNS library is related to a lack of mechanisms for verifying the source of data. Exploiting this vulnerability could allow a malicious actor to compromise the integrity of the data...

PT-2026-82900

Name of the Vulnerable Software and Affected Versions Linux Kernel affected versions not specified Description A use-after-free issue exists in the batman-adv module. The pskb may pull function called by batadv get vid can reallocate the buffer behind the socket buffer skb. If variables pointing ...

PT-2026-82915

Name of the Vulnerable Software and Affected Versions Linux Kernel affected versions not specified Description A false-positive memcpy overflow occurs in the tun dst unclone function within the dst metadata component. When built with clang and source fortification, the compiler incorrectly...

CVE-2026-80615: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: dstmetadata: fix false-positive memcpy overflow in tundstunclone kmallocflex in metadatadstalloc sets countedby for the structure to the optionslen, which is then initialized to zero. Later, we're initializing the structure ...

GraftyVul: Synthesising Insecure Programs through Real-World Vulnerability Grafting

Vulnerability datasets underpin a wide range of security research, including vulnerability detection, automated remediation, and secure code generation. However, existing datasets sacrifice at least one of three desirable properties: diversity of language or vulnerability type,...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: rubygem-bundler (UTSA-2024-005622)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2024-005622 advisory. Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem...

GHSA-6HX8-3WJJ-GR8G

creationtimestamp| type| source ---|---|--- 2026-08-27 23:33:29+00:00| seen| https://gist.github.com/alon710/3f2dc90a23f10e17e098821e66e18187 2026-08-28 00:01:48+00:00| seen| https://gist.github.com/alon710/3f2dc90a23f10e17e098821e66e18187...

Security Bulletin: Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway due to information disclosure (CVE-2026-3159)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to information disclosure. Vulnerability Details CVEID:CVE-2026-3159 DESCRIPTION: IBM IBM Sterling File Gateway is vulnerable to an information disclosure due to sensitive information being included...

CVE-2026-54085

Wazuh (open-source XDR/SIEM platform), versions 4.2.0 through 4.14.6 , contains missing input validation in multiple active response scripts that pass attacker-influenced alert fields to privileged system commands running as root. Five scripts (route-null.c, netsh.c, pf.c, npf.c, ipfw.c ) omit th...

CVE-2026-54085 Wazuh: Missing input validation in multiple active response scripts allows argument injection

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.2.0 through 4.14.6, multiple active response scripts pass attacker-influenced alert fields to privileged system commands without validating their format, allowing...

CVE-2026-81838

creationtimestamp| type| source ---|---|--- 2026-08-27 22:18:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/e5cw3pczptem6...

CVE-2026-81730

creationtimestamp| type| source ---|---|--- 2026-08-27 22:12:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/2vkvq4f4uofm4 2026-08-27 22:59:48+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mu3x7he4yh24 2026-08-27 22:59:49+00:00| seen|...

CVE-2026-53579

creationtimestamp| type| source ---|---|--- 2026-08-27 22:09:19+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mu3uf75aaz2f 2026-08-28 07:50:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mu4utoras525...

CVE-2026-18885

creationtimestamp| type| source ---|---|--- 2026-08-27 22:08:35+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mu3udv6djg2m 2026-08-28 03:02:20+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mu4eqr6anp2y 2026-08-28 07:50:09+00:00| seen|...

Security Bulletin: Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway due to information disclosure in mailbox UI (CVE-2026-3157)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to information disclosure in mailbox UI. Vulnerability Details CVEID:CVE-2026-3157 DESCRIPTION: IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.52, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through...

CVE-2026-69519

creationtimestamp| type| source ---|---|--- 2026-08-27 18:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mu3ijqlmnk2h...

CVE-2026-81819

creationtimestamp| type| source ---|---|--- 2026-08-27 18:33:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/2qhkptqxzcrll...

CVE-2026-81827

creationtimestamp| type| source ---|---|--- 2026-08-27 18:15:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/2aycrsxvjyqle...

“Sorry, I can’t help with that”: How your guardrails might become the attacker’s best friend

Welcome to this week's edition of the Threat Source newsletter. Hello, everyone. Long time reader, first time writer here at the Threat Source newsletter! I wanted to start out by introducing myself. My colleague and friend Mick Baccio set the bar pretty high last week, so I was planning to tell...

CVE-2026-81335

Baserow dispatches an Application Builder data source without acting on the result of its permission check. The dispatch and record-name views in backend/src/baserow/contrib/builder/api/datasources/views.py are declared with a permission class that admits any caller, so a request carrying no...