CVE-2026-90134: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix kmaplocalpage usage in compress Several compressed I/O paths discard the address returned by kmaplocalpage and later access or unmap the page using pageaddress. This is invalid for highmem pages, and local mappings must...

CVE-2026-90056: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: fec: only stop PTP if it was initialized fecptpinit is only called when fep-bufdescex is available. However, fecprobe unconditionally calls fecptpstop on the failedinit path, and fecdrvremove unconditionally calls fecptpstop...

CVE-2026-77614: Session Fixation

Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to versions 19.7 and 20.2, the default security configuration in etc/security/mhdefaultorg.xml accepts a client-selected JSESSIONID from the ;jsessionid= URL path parameter and does no...

CVE-2026-92860: Improper Input Validation

A security flaw has been discovered in rcourtman Pulse up to 6.0.4/6.1.0-rc.4. Affected by this issue is the function fmt.Sprintf of the file /api/security/quick-setup of the component Quick Security Setup Handler. The manipulation of the argument Username results in improper input validation. Th...

CVE-2026-78427: Reliance on Untrusted Inputs in a Security Decision

The NeuVector admission webhook silently excludes containers from policy evaluation when their image path matches one of three hardcoded service mesh sidecar images. Since the image path is entirely controlled by the workload author, any user capable of deploying workloads can evade admission den...

Trust, but Validate the Instrument: Auditing AI-Generated RTL Verification Plans on Authored Security-Regression Proxies

AI-generated RTL verification plans can satisfy a provider schema yet fail at the boundary to trusted execution. We present SecTB-RTL, an auditable framework covering 31 tasks and 124 authored hardware-security regressions. A deterministic non-AI baseline killed 36, 75, and 78 mutants at increasi...

CVE-2026-93037: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Propagate sdmatxinitahg errors settxreqheaderahg ignores the return value of sdmatxinitahg. If sdmatxinitahg fails, it returns before initializing tx-txreq. However, settxreqheaderahg ignores the error and returns the...

CVE-2026-93158: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: crypto: sa2ul - stop probe if context pool creation fails saulprobe calls sainitmem to create the DMA pool used for security context buffers, but ignores its return value. If pool creation fails, probe still continues with DMA...

RHEL 9 : tomcat (RHSA-2026:68659)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:68659 advisory. Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. Security Fixes: Apache Tomcat: Apache...

WordPress 7.0.0 < 7.1.1

WordPress versions 7.0.0 7.1.1 are affected by one or more vulnerabilities %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from WordPress Security Advisory wordpress-7-1-1-maintenance-and-security-release. include'compat.inc'; if descripti...

RHEL 8 : tomcat (RHSA-2026:68677)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:68677 advisory. Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. Security Fixes: tomcat-coyote: Apache...

Experimental Demonstration of Finite-Size General Security Via Discrete-Modulated CVQKD with Real Time Postprocessing

Continuous-variable quantum key distribution CVQKD is compatible with telecommunication infrastructure, but implementing composable security with experimentally practical resources has remained challenging, particularly for discrete-modulated DM protocols. We report the first experimental...

ALSA-2026:68660 Moderate: tomcat security, bug fix, and enhancement update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. Security Fixes: Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix CVE-2026-32990 tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication...

Important: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. Security Fixes: tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication CVE-2026-43512 tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated CVE-2026-41293...

ALSA-2026:68677 Important: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. Security Fixes: tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication CVE-2026-43512 tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated CVE-2026-41293...

image-builder security update

72.0.0-1.0.3 - Rebuild for CVE-2026-25681, CVE-2026-27136, CVE-2026-41178, CVE-2026-42502...

CVE-2026-92523: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/nldev: validate dynamic counter attribute length RDMANLDEVATTRSTATHWCOUNTERS is a nested attribute whose children are consumed directly with nlagetu32. The top-level policy validates only the container, so it does not...

SUSE CVE-2026-32597

PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit Critical Header Parameter defined in RFC 7515 4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting...

EUVD-2026-44650

Grav: XSS Blueprint Validation Bypass via Twig String Concatenation...

CVE-2026-92748

BC Security Empire before 6.7.1 fails to validate the multipart filename parameter in upload endpoints, allowing authenticated operators to write files to arbitrary paths on the C2 server. Attackers can use path traversal sequences in the filename to bypass directory containment and write malicio...