Network-AI: CVE-2026-46701 fix incomplete — empty default secret still authorizes all requests

Advisory / Disclosure Network-AI — CVE-2026-46701 fix is incomplete: the "Empty Default Secret" unauth path survives Target: Jovancoding/Network-AI npm network-ai, latest v5.7.1 Status: the advisory "Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default Secret" named three flaws. The...

CVE-2026-41156

creationtimestamp| type| source ---|---|--- 2026-06-19 12:14:02+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moncxa52lf2r...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: iio: frequency: admv1013: fix NULL pointer dereference on str When devicepropertyreadstring fails, str remains uninitialized, but the code proceeds to strcmpstr, …, resulting in dereferencing a garbage pointer. Replace manual...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Input: edt-ft5x06 – fixed the use-of-memory issue during the debugfs teardown process. The commit 68743c500c6e “Input: edt-ft5x06 – used per-client debugfs directory” removed the manual debugfs teardown process, relying on the I2...

MINI-V4QC-JF39-4WHX

Bulletin has no description...

Security Bulletin: Multiple vulnerabilities in IBM MQ Operator and Queue manager container images

Summary Multiple vulnerabilities were addressed in IBM MQ Operator and Queue manager container images Vulnerability Details CVEID:CVE-2026-27142 DESCRIPTION: Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an...

BELL-CVE-2026-53613

Bulletin has no description...

RLSA-2026:25999 Moderate: yggdrasil-worker-package-manager security update

yggdrasil-worker-package-manager is a simple package manager yggd worker. It knows how to install and remove packages, add, remove, enable and disable repositories, and does rudimentary detection of the host it is running on to guess the package manager to use. It only installs packages that matc...

postfix security update

An update is available for postfix. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The postfix packages provide a Mail Transport Agent MTA, which supports...

CVE-2026-8805

Integer Overflow or Wraparound vulnerability in the EtherNet/IP function of Mitsubishi Electric MELSEC iQ-F Series FX5-EIP EtherNet/IP module FX5-EIP versions 1.000 and prior allows a remote attacker to cause a denial-of-service DoS condition in the affected product by rapidly establishing a larg...

PT-2026-53797

Summary vcrpy deserializes YAML cassette files with PyYAML's object-constructing loader yaml.CLoader / yaml.Loader instead of the safe loader yaml.CSafeLoader / yaml.SafeLoader. A cassette containing a !!python/object/apply: or similar tag therefore executes arbitrary Python code the moment the...

PT-2026-51020

Name of the Vulnerable Software and Affected Versions Mercator versions prior to 2025.05.19 Description The Query Engine allows authenticated users to execute queries via a JSON DSL Domain Specific Language, which is a specialized language used to define data queries. The controller method...

EUVD-2025-210287

Microsoft HEIF Image Extensions 1.2.22.0 has an out-of-bounds read because CHEIFItemInfoEntryGetDataSize can return success while leaving the reported data size as 0. This causes a caller to make a 1-byte allocation. Later, CopyPixels computes copysize = stride absroiheight but does not check the...

PT-2026-51068

Name of the Vulnerable Software and Affected Versions Traefik versions 3.7.0-ea.1 through 3.7.4 Description A fail-open authentication issue exists in the Kubernetes Ingress NGINX provider. When an Ingress explicitly enables BasicAuth or DigestAuth using the nginx.ingress.kubernetes.io/auth-type...

PT-2026-53775

Summary A GitHub Actions workflow is vulnerable to command injection through the issue title. The workflow is triggered when an issue is opened or closed, and it directly inserts github.event.issue.title into a Bash variable assignment. If an issue title contains command substitution syntax, Bash...

PT-2026-51023

Name of the Vulnerable Software and Affected Versions Lima versions prior to 2.1.3 Description On Lima instances using the qemu driver with the guest agent enabled, a local unprivileged user within the virtual machine can achieve root privileges. The issue stems from the guest agent socket...

EulerOS Virtualization 2.12.0 : kernel (EulerOS-SA-2026-2432)

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : xfrm: esp: avoid in-place decrypt on shared skb fragsCVE-2026-43284 crypto: algifaead - Revert to operating...

KLA91111 Multiple vulnerabilities in Microsoft Browser

Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to execute arbitrary code, bypass security restrictions, gain privileges, inject malicious code, cause denial of service, perform cross-site scripting attack, obtain sensitive information...

PT-2026-51601

Name of the Vulnerable Software and Affected Versions OpenRemote versions prior to 1.25.0 Description An insecure direct object reference IDOR exists in the bulk alarm deletion endpoint. This occurs because the removeAlarms function in AlarmResourceImpl.java fails to perform realm-scoping...

Cocoa widget Data Compromise

The vulnerability of the Cocoa widget in Mozilla Firefox, Firefox ESR, and the Thunderbird email client is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to compromise the accessibility of protected information...