kernel: tipc: fix double-free in tipc_buf_append()

A flaw was found in the Linux kernel's Transparent Inter-Process Communication TIPC module. This vulnerability, a double-free, occurs when the tipcbufappend function incorrectly handles memory after a socket buffer skb reallocation. An attacker could potentially exploit this to cause system...

kernel: tipc: fix double-free in tipc_buf_append()

A flaw was found in the Linux kernel's Transparent Inter-Process Communication TIPC module. This vulnerability, a double-free, occurs when the tipcbufappend function incorrectly handles memory after a socket buffer skb reallocation. An attacker could potentially exploit this to cause system...

CVE-2026-66138

In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can achieve arbitrary code execution on a running Ironic-Python-Agent via a maliciously constructed configuration, because the value of ntpserver is passed to a shell...

CVE-2026-66138

OpenStack Ironic Python Agent (up to 11.6.0) is affected. A project-scoped user with the manager role can achieve arbitrary code execution on a running Ironic-Python-Agent by supplying a malicious configuration that causes the ntp_server value to be passed to a shell. The vulnerability allows rem...

CVE-2026-66138

In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can achieve arbitrary code execution on a running Ironic-Python-Agent via a maliciously constructed configuration, because the value of ntpserver is passed to a shell...

PT-2026-64232

Name of the Vulnerable Software and Affected Versions OpenStack Ironic Python Agent versions prior to 11.6.1 Description A project-scoped user with the manager role can achieve arbitrary code execution on a running Ironic-Python-Agent. This occurs because the value of the ntp server variable is...

Rockwell Automation Arena < 17.00.01 Multiple Vulnerabilities (SD1784)

The version of Rockwell Automation Arena installed on the remote Windows host is prior to 17.00.01. It is, therefore, affected by multiple vulnerabilities: - A memory corruption vulnerability exists in the model.exe Siman component due to improper validation of user-supplied data, which can resul...

CVE-2024-58354

Cal.com (cal.com/cal.diy) is affected by a repository takeover via its GitHub Actions workflow. The pr.yml workflow uses pull_request_target and passes repo default write permissions to check-types.yml, which then dangerous-checks out the attacker PR and executes it (yarn install, package.json sc...

CVE-2026-65908

In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious Python executable was possible on untrusted project open...

CVE-2026-65908

JetBrains PyCharm is affected by CVE-2026-65908. In PyCharm before 2026.1.4 (and 2026.2), an attacker could achieve arbitrary code execution by opening a malicious Python executable in an untrusted project. Root cause is likely processing of Python executables on project open; CVSSv3.1 indicates ...

CVE-2026-65908

In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious Python executable was possible on untrusted project open...

EUVD-2026-48252

In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious Python executable was possible on untrusted project open...

CVE-2026-64811

In JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before granting project trust via development container configuration...

CVE-2026-64809

In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured interpreter...

CVE-2026-64808

In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via project tooling...

CVE-2026-64802

In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust in the Go Modules integration...

CVE-2026-64804

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local linter tooling...

CVE-2026-64805

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local package-manager tooling...

postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory

A flaw was found in PostgreSQL libpq. A server superuser can exploit a buffer overflow vulnerability in the PQfn function, which is used by client functions such as loexport, loread, lolseek64, and lotell64. This allows the superuser to send an arbitrarily large response, overwriting the client's...

PYSEC-2026-3511 PraisonAI: Jobs API exposes agent-execution endpoints with no authentication

praisonai: Jobs API exposes agent-execution endpoints with no authentication Researcher: Kai Aizen — SnailSploit @SnailSploit, Adversarial & Offensive Security Research Target: https://github.com/MervinPraison/PraisonAI --- Package: praisonai on PyPI Affected version empirically tested: 4.6.48...