CVE-2026-76847

act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs of that backend, including CreateArtifact, GetSignedArtifactURL, ListArtifacts, FinalizeArtifact and DeleteArtifact, accept a caller-supplied...

CVE-2026-76847 act 0.2.81 through 0.2.89 Missing Authorization in the Artifacts V4 Backend

act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs of that backend, including CreateArtifact, GetSignedArtifactURL, ListArtifacts, FinalizeArtifact and DeleteArtifact, accept a caller-supplied...

CVE-2026-76847

act (nektos/act) versions 0.2.81 through 0.2.89 are affected by a missing authorization flaw in the Artifacts V4 backend , which is started whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. Three compounding issues enable unauthenticated artifact access: (1) val...

CVE-2026-76847 act 0.2.81 through 0.2.89 Missing Authorization in the Artifacts V4 Backend

act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs of that backend, including CreateArtifact, GetSignedArtifactURL, ListArtifacts, FinalizeArtifact and DeleteArtifact, accept a caller-supplied...

EUVD-2026-64852

act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs of that backend, including CreateArtifact, GetSignedArtifactURL, ListArtifacts, FinalizeArtifact and DeleteArtifact, accept a caller-supplied...

CVE-2026-76847 act 0.2.81 through 0.2.89 Missing Authorization in the Artifacts V4 Backend

act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs of that backend, including CreateArtifact, GetSignedArtifactURL, ListArtifacts, FinalizeArtifact and DeleteArtifact, accept a caller-supplied...

CERTFR-2026-ACT-036

creationtimestamp| type| source ---|---|--- 2026-08-24 12:25:06+00:00| seen| https://bsky.app/profile/cert-fr.bsky.social/post/3mttcdsg5h72k 2026-08-24 12:25:09+00:00| seen| https://social.numerique.gouv.fr/users/certfr/statuses/117150469642843401...

CVE-2026-76847: Missing Authorization

act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs of that backend, including CreateArtifact, GetSignedArtifactURL, ListArtifacts, FinalizeArtifact and DeleteArtifact, accept a caller-supplied...

PT-2026-80856

Name of the Vulnerable Software and Affected Versions nektos/act versions 0.2.81 through 0.2.89 Description The software starts an HTTP Artifacts V4 backend when workflows use actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs, including 'CreateArtifact',...

PT-2026-79625

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2-rc6 Description An issue exists in the network scheduler where the act gact and act police components fail to properly range check fallback control actions supplied by user space. Specifically, the TCA GACT...

PT-2026-79626

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2-rc6 Description An issue exists in the net/sched component where a memory leak occurs when header checks reject a packet. Specifically, the tcf ct handle fragments function performs sanity checks using tcf ct...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099762)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099762 advisory. In the Linux kernel, the following vulnerability has been resolved: dm cache policy smq: check allocation under invalidate lock commit 2d1f7b65f5de dm cache policy...

PT-2026-72246

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the net/sched component where the tcf ct handle fragments function calls nf ct handle fragments without saving and restoring the skb-cb control buffer. Because the...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: kots, newrelic-infra-operator, act, kubeflow, argo-events, cluster-autoscaler, envconsul, slsa-verifier, crossplane-provider-aws-firehose, kubernetes, crossplane-provider-aws-lambda, cert-exporter, fuse-overlayfs-snapshotter, kubeflow-pipelines,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: kots, trivy-operator, act, argo-events, slsa-verifier, crossplane-provider-aws-firehose, kine, kubernetes, crossplane-provider-aws-lambda, pulumi-kubernetes-operator, teleport, scorecard, buildah, tflint, cloud-provider-aws, crossplane-provider-aws-memorydb,...

CVE-2026-55182

creationtimestamp| type| source ---|---|--- 2026-08-13 08:45:03+00:00| seen| https://www.cert.ssi.gouv.fr/actualite/CERTFR-2026-ACT-034 2026-08-18 18:35:03+00:00| published-proof-of-concept| https://github.com/librenms/librenms/security/advisories/GHSA-c9fv-cgmm-2wg7 2026-08-28 04:40:03+00:00|...

IAGA-Sentinel v2.0.1

IAGA Sentinel The EU AI Act conformity evidence layer for AI agents. Cryptographically signed, replay-verifiable evidence of every action an agent routes through it, structured to support AI Act Article 12 record-keeping and Annex IV documentation. Documentation · Quickstart · Autonomous agent...

EUVD-2026-56724

CVET-EOP...

CVE-2026-68377

CVE-2026-68377 affects the Linux kernel net/sched component, specifically act_tunnel_key. The issue is a race leading to use-after-free during tunnel_key_release_params() where metadata_dst is released synchronously via dst_release() while the old params are freed with kfree_rcu(), allowing a con...

RLSA-2026:49214 Important: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: rtnetlink: add missing netlinknscapable check for peer netns CVE-2026-31692 kernel: netfilter: ctnetlink: ensure safe access to master conntrack CVE-2026-43116 kernel: fanotify: fix false...