GHSA-2RC9-8CX9-FXPR vulnerabilities

Vulnerabilities for packages: gitlab-runner-fips, gitlab-rails-ce, gitlab-runner, gitlab-workhorse-ce-fips, gitlab-cng, gitlab-workhorse-ce, gitlab-cng-fips, gitlab-rails-ce-fips...

CVE-2026-14351 vulnerabilities

Vulnerabilities for packages: gitlab-runner-fips, gitlab-rails-ce, gitlab-runner, gitlab-workhorse-ce-fips, gitlab-cng, gitlab-workhorse-ce, gitlab-cng-fips, gitlab-rails-ce-fips...

UBUNTU-CVE-2026-58045

A flaw in Node.js allows a spoofed TypedArray byteLength to trigger a reachable assertion in the synchronous node:zlib APIs, causing the entire process to crash. All 11 synchronous zlib functions are affected. Repeated exploitation of this condition can result in a denial of service. This...

Important: Red Hat Security Advisory: ldns security update

An update for ldns is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

Important: kernel-livepatch-6.18.30-61.119

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs CVE-2026-64531 In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping after cycling ILOCK CVE-2026-64600...

Important: python3.9

Issue Overview: The incremental HTML parser html.parser.HTMLParser allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data. CVE-2026-15308 In the Tarfile.extract function, the filter parameter is not passed properly when extracting...

Important: perl-YAML-Syck

Issue Overview: YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack. In the bundled libsyck, when an anchor name is redefined or removed, syckhdlraddanchor and syckhdlrremoveanchor free the node stored unde...

ALSA-2026:49927 Moderate: fence-agents security update

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fixes: urllib3: urllib3: Information disclosure via cross-origin redirects...

Important: rclone

Issue Overview: Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, with -l/--links, rclone serializes symlinks as .rclonelink text objects and recreates them on a local destination without validating the target, allowing ...

CVE-2026-18685

creationtimestamp| type| source ---|---|--- 2026-08-03 23:56:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms7p5zk45z2f 2026-08-04 00:00:37+00:00| seen| https://infosec.exchange/users/offseq/statuses/117034296046822265 2026-08-04 00:00:39+00:00| seen|...

SUSE CVE-2026-8400

IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous delivery has a flaw in the ORB component in IBM SDK, Java Technology Edition, may allow a malicious IIOP server to induce loading and instantation of arbitrary classes...

SUSE CVE-2026-55685

React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. This issue is a follow up to CVE-2026-42342, and does not does not impact React...

CVE-2026-18684

creationtimestamp| type| source ---|---|--- 2026-08-03 23:04:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms7mazaa2b2p 2026-08-04 03:00:30+00:00| seen| https://infosec.exchange/users/offseq/statuses/117035003364698464 2026-08-04 03:00:32+00:00| seen|...

CVE-2026-48331

creationtimestamp| type| source ---|---|--- 2026-08-03 23:00:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms7lzvvkyb2p 2026-08-04 02:22:22+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3ms7xdm562k2s 2026-08-04 02:50:19+00:00| seen|...

CVE-2026-62870

CVE-2026-62870 describes a use-after-free in Microsoft Excel that could allow a remote attacker to execute code over a network. The issue has a high impact (C/H/I/A) with network-based, low-attack-complexity exploitation and requires user interaction. Microsoft has published a security update (KB...

CVE-2026-67616

Camaleon CMS through 2.9.2, fixed in commit 88ab703, contains a missing authorization vulnerability on the drafts endpoint that allows any authenticated low-privileged user to create draft posts by bypassing role and permission checks. Attackers can send requests to the drafts endpoint using only...

CVE-2026-10849

The CVE concerns the hawkBit OTA client in Zephyr (subsys/mgmt/hawkbit/hawkbit.c). A heap-based out-of-bounds write occurs when terminating the received HTTP body: the buffer holds the body but no space for a NUL, so response_data[downloaded_size] = '\0' writes past the allocation. This is trigge...

CVE-2026-56158

creationtimestamp| type| source ---|---|--- 2026-08-03 21:00:03+00:00| seen| https://t.me/GithubRedTeam/96489 2026-08-04 00:00:09+00:00| published-proof-of-concept| Telegram/C7mZW8YEibhjuVQ7-UjPpcsJfq8AEPUYczTR6mXKULyoi4s 2026-08-04 00:00:12+00:00| published-proof-of-concept|...

CVE-2026-38446

creationtimestamp| type| source ---|---|--- 2026-08-03 20:41:22+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3ms7ebtfrsn2j...

CVE-2026-68980

Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Contexts through the REST API. The framework authorizes asset deletion against the owning Parameter Context using the supplied Parameter Context Identifier and Asset Identifier. The framework...