Important: Red Hat Security Advisory: postgresql:12 security update

An update for the postgresql:12 module is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A...

Security Bulletin: Multiple vulnerabilities affect the Windows S-TAP component as part of IBM Guardium Data Protection (CVE-2026-82344, CVE-2026-82334)

Summary Multiple vulnerabilities have been addressed in the Windows S-TAP component as part of IBM Guardium Data Protection Vulnerability Details CVEID:CVE-2026-82344 DESCRIPTION: IBM Security Guardium is vulnerable to a heap-based buffer overflow in the S-TAP TrafficTap TDS login reassembly...

CVE-2026-107660

FFmpeg versions prior to 8.1.3 and 9.x before 9.0.2 are vulnerable to an improper certificate validation flaw in the tls_open() function within libavformat/tls_mbedtls.c. The root cause is that the software skips hostname checks for hosts identified by IP addresses. This allows a network attacker...

MAL-2026-17689 Malicious code in @galicia-toolkit/error-master (npm)

@galicia-toolkit/[email protected] claims the @galicia-toolkit scope and describes itself as a dependency-confusion PoC. Its postinstall hook runs on npm install using node postinstall.js || true and sends encoded hostname, working-directory, platform, runtime-version, and username data as DNS...

MAL-2026-17690 Malicious code in @galicia-toolkit/spa-build-config (npm)

@galicia-toolkit/[email protected] and @galicia-toolkit/[email protected] claim the @galicia-toolkit scope and describe themselves as dependency-confusion PoCs. Their postinstall hook runs on npm install with node postinstall.js || true. The script collects package and host...

CVE-2026-93034

SGLang contains an arbitrary code execution vulnerability caused by the ZMQ message decoder unconditionally deserializing PickleWrapper payloads via pickle.loads in maybeunwrappickle without type allowlisting or authentication; this vulnerability persists via the msgpack path even when...

DEBIAN-CVE-2026-107565

A flaw was found in luksmeta. A local attacker with administrative privileges can cause data corruption when saving metadata to a Linux Unified Key Setup LUKS device. Due to incorrect boundary calculations and flawed overlap detection, new metadata entries can be written beyond available free spa...

CVE-2026-107565

A flaw was found in luksmeta. A local attacker with administrative privileges can cause data corruption when saving metadata to a Linux Unified Key Setup LUKS device. Due to incorrect boundary calculations and flawed overlap detection, new metadata entries can be written beyond available free spa...

CVE-2026-105826

Rejected reason: This CVE ID has been rejected as a duplicate...

CVE-2026-107565

A flaw was found in luksmeta. A local attacker with administrative privileges can cause data corruption when saving metadata to a Linux Unified Key Setup LUKS device. Due to incorrect boundary calculations and flawed overlap detection, new metadata entries can be written beyond available free spa...

CVE-2026-107565

A flaw in luksmeta allows a local attacker with administrative privileges to cause data corruption when saving metadata to a Linux Unified Key Setup (LUKS) device. The root cause is identified as incorrect boundary calculations and flawed overlap detection within the luks1 metadata allocator. Con...

EUVD-2026-95032

A flaw was found in luksmeta. A local attacker with administrative privileges can cause data corruption when saving metadata to a Linux Unified Key Setup LUKS device. Due to incorrect boundary calculations and flawed overlap detection, new metadata entries can be written beyond available free spa...

CVE-2026-107565 Luksmeta: incomplete gap-boundary and overlap checks in luks1 metadata allocator allow data corruption

A flaw was found in luksmeta. A local attacker with administrative privileges can cause data corruption when saving metadata to a Linux Unified Key Setup LUKS device. Due to incorrect boundary calculations and flawed overlap detection, new metadata entries can be written beyond available free spa...

CVE-2026-107565 Luksmeta: incomplete gap-boundary and overlap checks in luks1 metadata allocator allow data corruption

A flaw was found in luksmeta. A local attacker with administrative privileges can cause data corruption when saving metadata to a Linux Unified Key Setup LUKS device. Due to incorrect boundary calculations and flawed overlap detection, new metadata entries can be written beyond available free spa...

CVE-2026-107565

A flaw was found in luksmeta. A local attacker with administrative privileges can cause data corruption when saving metadata to a Linux Unified Key Setup LUKS device. Due to incorrect boundary calculations and flawed overlap detection, new metadata entries can be written beyond available free spa...

CVE-2026-107565

A flaw was found in luksmeta. A local attacker with administrative privileges can cause data corruption when saving metadata to a Linux Unified Key Setup LUKS device. Due to incorrect boundary calculations and flawed overlap detection, new metadata entries can be written beyond available free spa...

MAL-2026-17681 Malicious code in node-env-resolve (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f3e0e1b364a3d74534d6ce1eca74778a85e508cf10952f84f36bf1badd8a581 The package is advertised as an environment configuration resolver but its postinstall script installs a hidden persistent agent into user-level...

CVE-2026-90460

A flaw was found in OpenStack Keystone. Tokens obtained via delegated authentication methods trusts, application credentials, OAuth1 access tokens can move a credential to an unauthorized project by supplying a new projectid in a PATCH /v3/credentials request, because only the pre-update project ...

CVE-2026-79993

A flaw was found in Apache ZooKeeper. The deleteContainer opcode is processed without verifying Access Control List ACL permissions. A remote, unauthenticated attacker with network access to the ZooKeeper client port can delete any empty persistent znode, including container and TTL nodes. This c...

ARTEX AI Pentesting Tool Used in Data Theft Attacks on South Korean Financial Firms

Cybersecurity researchers have disclosed details of a targeted campaign aimed at South Korean financial organizations that used an artificial intelligence AI pen testing tool named ARTEX to carry out the attacks. The activity, per CrowdStrike Intelligence, was active from late September to early...