CVE-2026-47407 PraisonAI Platform has a cross-workspace IDOR + member-role privilege escalation

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Prior to version 0.1.4, the Platform server exposes resources under /api/v1/workspaces/workspaceid/... and protects them with a requireworkspacememberworkspaceid FastAPI dependency. The dependency only checks tha...

CVE-2026-47407

PraisonAI Platform prior to v0.1.4 has cross-tenant IDOR and privilege-escalation flaws: the URL workspace_id is not validated against inner resources, enabling read/update/delete of other tenants’ data; and member-role checks allow basic members to promote themselves or modify/remove others and ...

CVE-2026-47393

PraisonAI's code generator for API servers (praisonai.deploy.api.generate_api_server_code) emits a Flask API server with authentication disabled by default. Default config sets auth_enabled=False and auth_token=None, causing check_auth() to short-circuit and accept unauthenticated requests to /ch...

bind: bind9: Unnecessary validation of DNSSEC signed records

The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND always validates all RRSIG records in an answer, even if they are not strictly needed. A query to an authoritative server/zone which returns many valid but superfluous RRSIG records causes the validator to...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: bind: bind-9.18.50-22.hum1 aarch64, x8664 bind-chroot-9.18.50-22.hum1 aarch64, x8664 bind-devel-9.18.50-22.hum1 aarch64, x8664 bind-dnssec-utils-9.18.50-22.hum1 aarch64, x8664...

EulerOS Virtualization 2.12.0 : bind (EulerOS-SA-2026-2768)

According to the versions of the bind packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessive CPU...

EulerOS Virtualization 2.12.1 (EulerOS-SA-2026-2722)

According to the versions of the packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessive CPU...

SUSE-SU-2026:3130-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2023-20585: iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19 bsc1243603. - CVE-2025-71302: drm/panthor: fix for dma-fence safe acce...

Linux Distros Unpatched Vulnerability : CVE-2026-64124

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: net: devmem: reject dma-buf bind with non-page-aligned size or SG length netdevmembinddmabu...

CVE-2026-64124 net: devmem: reject dma-buf bind with non-page-aligned size or SG length

In the Linux kernel, the following vulnerability has been resolved: net: devmem: reject dma-buf bind with non-page-aligned size or SG length netdevmembinddmabuf trusts dmabuf-size and sgdmalen to be PAGESIZE multiples without checking: - txvec is sized dmabuf-size / PAGESIZE, and netdevmemgetniov...

CVE-2026-64124

In the Linux kernel, the following vulnerability has been resolved: net: devmem: reject dma-buf bind with non-page-aligned size or SG length netdevmembinddmabuf trusts dmabuf-size and sgdmalen to be PAGESIZE multiples without checking: - txvec is sized dmabuf-size / PAGESIZE, and netdevmemgetniov...

CVE-2026-64124

In the Linux kernel, the following vulnerability has been resolved: net: devmem: reject dma-buf bind with non-page-aligned size or SG length netdevmembinddmabuf trusts dmabuf-size and sgdmalen to be PAGESIZE multiples without checking: - txvec is sized dmabuf-size / PAGESIZE, and...

CVE-2026-64124

CVE-2026-64124 concerns the Linux kernel net: devmem: bind via dma-buf with non-page-aligned size or SG length. The issue arises because net_devmem_bind_dmabuf() trusts dmabuf->size and sg_dma_len() to be multiples of PAGE_SIZE without checking, causing an out-of-bounds access: tx_vec is sized...

EUVD-2026-45809

In the Linux kernel, the following vulnerability has been resolved: net: devmem: reject dma-buf bind with non-page-aligned size or SG length netdevmembinddmabuf trusts dmabuf-size and sgdmalen to be PAGESIZE multiples without checking: - txvec is sized dmabuf-size / PAGESIZE, and netdevmemgetniov...

EUVD-2026-45743

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: bind uarg before filling zerocopy skb virtiotransportsendpktinfo allocates or reuses the zerocopy uarg before entering the send loop, but virtiotransportallocskb still fills the skb before it inherits that uarg. Whe...

MiracleLinux 9 : bind-9.16.23-40.el9_8.2 (AXSA:2026-1302:07)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1302:07 advisory. bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation CVE-2026-3039 bind: BIND: Denial of Service via specially crafted DNS messages...

Updated bind packages fix a security vulnerability

The updated bind packages fix a security vulnerability: When BIND 9 was configured to use DNS64 and encounters a DNAME redirect, it could end up using freed memory for the DNS response owner name. This caused the response to contain corrupted data...

MGASA-2026-0258 Updated bind packages fix a security vulnerability

The updated bind packages fix a security vulnerability: When BIND 9 was configured to use DNS64 and encounters a DNAME redirect, it could end up using freed memory for the DNS response owner name. This caused the response to contain corrupted data...

Oracle Linux 10 : bind (ELSA-2026-24338)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-24338 advisory. - Fix GSS-API resource leak CVE-2026-3039 - Invalid handling of CLASS != IN CVE-2026-5946 Tenable has extracted the preceding description block...

K000162281: BIND vulnerabilities CVE-2026-3039 and CVE-2026-5946

Security Advisory Description CVE-2026-3039 BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption when receiving and processing maliciously-constructed packets. Typically these servers will be found in Active Directory...