PT-2026-61078

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mm/vma component where the mmap prepare function incorrectly attempts to unmap a Virtual Memory Area VMA when invoked from the mmap hook of stacked drivers, such a...

Fake Coding Tests Deliver OtterCookie-Aligned Malware Hidden in SVG Flag Images

North Korean threat actors linked to the Contagious Interview campaign have been observed employing steganography in SVG image files to conceal malicious payloads as part of a campaign using fake job postings and coding challenges. "Any user who ran the project ended up with a four-stage payload...

Oracle Linux 10 : python3.14-pip (ELSA-2026-36193)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-36193 advisory. 25.2-5 - Fix gating plan - removed unnecessary older VERSION= tests - removed bootstrap test - fix pipinstallupgrade to run pip-3.14 - fix bash completion +...

akto v2.13.3

Akto.io API Security Contributors What is Akto? How it works • Getting-Started • API Inventory • API testing • Add Test • Join Discord community • Akto is an instant, open source API security platform that takes only 60 secs to get started. Akto is used by security teams to maintain a continuous...

postgresql-jdbc security update

42.7.2-1.2 - Add tests for CVE-2026-42198 42.7.2-1.1 - Limit SCRAM PBKDF2 iterations to prevent DoS via malicious server - Resolves: RHEL-173479...

openSUSE 16: cryptsetup / cryptsetup-lang / cryptsetup-ssh / libcryptsetup-devel / etc (openSUSE-SU-2026:21325-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21325-1 advisory. Changes in cryptsetup: - Fix for bsc1270254 to avoid undesired pinning of all volume keys via the thread keyring through the caller's credentials when t...

openSUSE 16 Security Update : libredwg (openSUSE-SU-2026:21346-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21346-1 advisory. Changes in libredwg: - Update to snapshot 0.14.8413 fix dwgnextentity NULL pointer dereference CVE-2026-15184, boo1271170 Fix dwgbmp thumbnail...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: glib2: glib2-2.89.1-1.2.hum1 aarch64, x8664 glib2-devel-2.89.1-1.2.hum1 aarch64, x8664 glib2-doc-2.89.1-1.2.hum1 aarch64, x8664 glib2-static-2.89.1-1.2.hum1 aarch64, x8664...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: glib2: glib2-2.89.1-1.1.hum1 aarch64, x8664 glib2-devel-2.89.1-1.1.hum1 aarch64, x8664 glib2-doc-2.89.1-1.1.hum1 aarch64, x8664 glib2-static-2.89.1-1.1.hum1 aarch64, x8664...

vulnlab

vulnlab 🔓 !CI Statushttps://github.com/37Linard/vulnlab/a...

Oracle Linux 10 : skopeo (ELSA-2026-19031)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-19031 advisory. - Rebuild for new golang to address CVE-2025-68121 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Not...

Oracle Linux 10 : buildah (ELSA-2026-19032)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-19032 advisory. - Rebuild for new golang to address CVE-2025-68121 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Not...

CVE-2026-47732

Twig Sandbox: multiple __toString() policy bypasses via unguarded string coercion points existed prior to 3.26.0, enabling string coercion of Stringable operands through various constructs (conditional expressions, matches operator, loose comparisons, tests, template-loading tags, dynamic attribu...

AlmaLinux 10 : buildah (ALSA-2026:38494)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:38494 advisory. os: golang: Go os.Root: Symlink following vulnerability allows directory traversal CVE-2026-39822 Tenable has extracted the preceding description block directly...

SUSE-SU-2026:22645-1 Security update for cryptsetup

This update for cryptsetup fixes the following issues: Changes in cryptsetup: - Fix for bsc1270254 to avoid undesired pinning of all volume keys via the thread keyring through the caller's credentials when the kernel opens a file. This is due to the refactoring in kernel commit a28d893eb327 "md:...

SUSE-SU-2026:22602-1 Security update for cryptsetup

This update for cryptsetup fixes the following issues: Changes in cryptsetup: - Fix for bsc1270254 to avoid undesired pinning of all volume keys via the thread keyring through the caller's credentials when the kernel opens a file. This is due to the refactoring in kernel commit a28d893eb327 "md:...

OPENSUSE-SU-2026:21325-1 Security update for cryptsetup

This update for cryptsetup fixes the following issues: Changes in cryptsetup: - Fix for bsc1270254 to avoid undesired pinning of all volume keys via the thread keyring through the caller's credentials when the kernel opens a file. This is due to the refactoring in kernel commit a28d893eb327 "md:...

PYSEC-2026-2773 Open Babel has out-of-bounds write in ORCA nAtoms parser (second variant)

Summary A memory-safety vulnerability in Open Babel's ORCA parser allowed an out-of-bounds write when reading a crafted input file. Details A second variant of the nAtoms out-of-bounds write in the ORCA reader: a different malformed-input path produced the same class of write past the end of the...

Open Babel has Use-after-free in GAMESS GAMESSOutputFormat::ReadMolecule

SummaryA memory-safety vulnerability in Open Babel's GAMESS output parsercaused a use-after-free when reading a crafted input file. DetailsThe flaw was in GAMESSOutputFormat::ReadMolecule. A malformed inputcaused the parser to dereference a stale pointer after the underlyingobject had been freed...

PYSEC-2026-2410 ciguard: SCA HTTP client reads response body without size cap

Summary Both SCA HTTP clients src/ciguard/analyzer/sca/osv.py and src/ciguard/analyzer/sca/endoflife.py call payload = json.loadsresp.read.decode'utf-8' without a maximum-bytes cap. A hostile or compromised endoflife.date / OSV.dev or a successful TLS MITM could return a multi-GB response,...