9317 matches found
openSUSE 16 Security Update : rustup (openSUSE-SU-2026:22016-1)
The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22016-1 advisory. - CVE-2024-12224: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded bsc1243862. - CVE-2025-58160:...
[SECURITY] Fedora 45 Update: ctags-6.2.1-5.fc45
Ctags generates an index or tag file of C language objects found in C source and header files. The index makes it easy for text editors or other utilities to locate the indexed items. Ctags can also generate a cross reference file which lists information about the various objects found in a set o...
Security update for rustup (important)
openSUSE security update: security update for rustup ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22016-1 Rating: important References: bsc1230032 bsc1243862 bsc1249008 bsc1257902 bsc1270186 bsc1270521 bsc1270619 bsc1270644 bsc1270795 bsc1270870...
CVE-2026-78006-POC
CVE-2026-78006-POC CVE-2026-78006 的 POC The Events Calendar !IMPORTANT 当前随此仓库发布的研究 PoC 内部标识为针对 上述版本范围遵循 Wordfence 公告 （ 供应商公告核实确切的受影响/修复版本。 --- 根本原因 该易受攻击的行为与 小部件安全检查及 PHP...
sqlite3-ruby: Use-After-Free in SQLite Aggregate Arguments in Heap-Allocated Argument Array
Summary Using Databasecreateaggregate, createaggregatehandler, or Databasedefineaggregator to define an aggregate function that takes two or more arguments, and then evaluating it over TEXT or BLOB column values, can free the Ruby objects holding those arguments while a later argument is still...
GHSA-MWM8-39RW-8826 sqlite3-ruby: Use-After-Free in SQLite Aggregate Arguments in Heap-Allocated Argument Array
Summary Using Databasecreateaggregate, createaggregatehandler, or Databasedefineaggregator to define an aggregate function that takes two or more arguments, and then evaluating it over TEXT or BLOB column values, can free the Ruby objects holding those arguments while a later argument is still...
Security Bulletin: User Entity Behavior Analytics App for IBM QRadar SIEM contains components with known vulnerabilities
Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. User Entity Behavior Analytics App for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2011-4969 DESCRIPTION:...
Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for September 2026.
Summary In addition to many updates of operating system level packages, the following security vulnerabilities are addressed with IBM Cloud Pak for Business Automation released in September 2026. Vulnerability Details CVEID:CVE-2025-71329 DESCRIPTION: image-size through 2.0.2 contains a denial of...
OPENSUSE-SU-2026:22016-1 Security update for rustup
This update for rustup fixes the following issues: - CVE-2024-12224: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded bsc1243862. - CVE-2025-58160: tracing-subscriber: Tracing log pollution bsc1249008. - CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve...
Security Bulletin: Multiple secuirty vulnerabilities addressed with IBM Business Automation Workflow traditional and containers September 2026
Summary In addition to updating many operating system level packages, IBM Business Automation Workflow traditional and container fixes address the following vulnerabilities. Vulnerability Details CVEID:CVE-2026-53668 DESCRIPTION: React Router is a router for React. In versions 6.30.2 through 6.30...
Kentico Xperience 13 CMS - Staging Service Authentication Bypass (WT-2025-0006)
An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password handling for the server defined None type. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through...
openSUSE 16 Security Update : rclone (openSUSE-SU-2026:21999-1)
The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21999-1 advisory. Changes in rclone: - Update to version 1.75.1: boo1279548 - Security - archive - Fix zip slip path traversal in untrusted zip files...
PYSEC-2026-4143 PyJWT: PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation
Summary A service that verifies HS256 tokens using an empty oct JWK through PyJWK, including a PyJWK obtained from PyJWKSet, can therefore accept attacker-generated tokens as authenticated. PyJWT 2.13.0 rejects an empty HMAC key when it is supplied through the raw str/bytes key path, but accepts...
Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context
SummaryDecepticon wraps web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK Bring Your Own Key deployment model, users configure their own LLM credentials to any OpenAI-compatible...
PYSEC-2026-4034 Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context
Summary Decepticon wraps web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK Bring Your Own Key deployment model, users configure their own LLM credentials to any OpenAI-compatible...
Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context
SummaryDecepticon wraps web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK Bring Your Own Key deployment model, users configure their own LLM credentials to any OpenAI-compatible...
PYSEC-2026-4033 Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context
Summary Decepticon wraps web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK Bring Your Own Key deployment model, users configure their own LLM credentials to any OpenAI-compatible...
Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context
SummaryDecepticon wraps web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK Bring Your Own Key deployment model, users configure their own LLM credentials to any OpenAI-compatible...
PYSEC-2026-4032 Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context
Summary Decepticon wraps web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK Bring Your Own Key deployment model, users configure their own LLM credentials to any OpenAI-compatible...
GHSA-H85J-HV3C-QFGQ vm2 exposes host HTTPS credentials and TLS traffic through globalAgent
Summary vm2 3.11.6 exposes the host process's real https.globalAgent when a NodeVM is explicitly allowed to require https. The module is wrapped as read-only, but calls to methods on the shared agent still mutate the host object. Sandbox code can register a free listener and receive host request...