MGASA-2026-0456 Updated libreswan package fixes a security vulnerability

FIPS mode assertion failure via malicious CERT payload. CVE-2026-14957...

Updated libreswan package fixes a security vulnerability

FIPS mode assertion failure via malicious CERT payload. CVE-2026-14957...

CVE-2026-100845 MONAI before 1.6.0 Remote Code Execution via NumpyReader

MONAI before 1.6.0 contains an unsafe deserialization vulnerability in the NumpyReader class that unconditionally uses numpy.load with allowpickle=True when loading .npy and .npz files. Attackers can craft malicious .npy files with pickle payloads that execute arbitrary code when loaded through...

CVE-2026-100845 MONAI before 1.6.0 Remote Code Execution via NumpyReader

MONAI before 1.6.0 contains an unsafe deserialization vulnerability in the NumpyReader class that unconditionally uses numpy.load with allowpickle=True when loading .npy and .npz files. Attackers can craft malicious .npy files with pickle payloads that execute arbitrary code when loaded through...

EUVD-2026-87767

The Grav Data Manager plugin getgrav/grav-plugin-datamanager versions 1.0.1 through 1.4.4 render stored data entries in the item-detail view admin/templates/partials/item.html.twig without escaping, applying Twig's raw filter — in some cases after a striptags'' call that PHP's striptags bypasses ...

CVE-2026-100651

vLLM versions before 0.29.0 are vulnerable to a Denial of Service (DoS) due to a lack of decoder prompt-length validation on the disaggregated serving endpoint (/inference/v1/generate). When handling multimodal payloads (e.g., Nemotron Parse , Whisper , and FireRedLID ), the system fails to check...

CVE-2026-100651 vllm before 0.29.0 Denial of Service via Decoder Prompt Length Bypass

vLLM before 0.29.0 fails to enforce decoder prompt-length validation on the disaggregated serving endpoint /inference/v1/generate. When the request contains a 'features' multimodal payload, vllm/entrypoints/serve/disagg/serving.py builds a multimodal EngineInput directly from the caller-supplied...

Linux Distros Unpatched Vulnerability : CVE-2026-97530

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: qla2xxx: Fix soft lockup polling continuation IOCB signature qla27xxcopymultiplepkt and qla27xxcopyfpinpkt poll rspq-ringptr-signature for RESPONSEPROCESS...

CVE-2026-93785 cifs: validate idmap key payload length

In the Linux kernel, the following vulnerability has been resolved: cifs: validate idmap key payload length The cifs.idmap key type stores its payload length in key-datalen, which is limited to U16MAX. Accepting a larger key payload truncates the recorded length and can make later users interpret...

CVE-2026-4637: Improper Neutralization of Input During Web Page Generation

Paessler PRTG Network Monitor before version 26.2.120.1449 is affected by a reflected Cross-Site Scripting XSS vulnerability. When a request is made for a non-existent resource ending in ".htm", the web interface returns an HTTP 403 "Forbidden Path" error page that echoes the requested URL path...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: git-lfs (UTSA-2026-124473)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-124473 advisory. Parsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion. Tenable has extracted the preceding description block...

CVE-2026-54280

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. A remote attacker could exploit this vulnerability by disconnecting during a payload write, leading to improper closure of resources. This can cause temporary resource starvation, resulting in a Denial of Service DoS...

Compromised MemTensor Packages Deliver sckit Credential Stealer via npm and PyPI

Unknown threat actors have managed to compromise two legitimate MemTensor packages across the npm and Python Package Index PyPI repositories to push a platform-specific Go-based implant dubbed sckit designed for Windows, Linux, and macOS. According to reports from Aikido, SafeDep, Socket, and...

Linux Distros Unpatched Vulnerability : CVE-2026-55701

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The OpenTelemetry Collector Contrib repository contains components for the OpenTelemetry Collector. Prior to 0.151.0, the githubreceiver validates the...

Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 Dispatcher

Summary The V1 DurableTask stream handler registers worker-supplied durable task external IDs in an in-memory callback routing map before verifying that the authenticated tenant owns the task. If the tenant-scoped ownership check fails, the handler logs the error and continues, but the map entry...

GHSA-9Q4H-F4X5-FFQ8 Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 Dispatcher

Summary The V1 DurableTask stream handler registers worker-supplied durable task external IDs in an in-memory callback routing map before verifying that the authenticated tenant owns the task. If the tenant-scoped ownership check fails, the handler logs the error and continues, but the map entry...

CVE-2026-76805

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST/fuzz payload path in pkg/fuzz/parts.go can evaluate substituted runtime data more than once, creating a second evaluation pass that allows response content captured by an internal: true extractor...

EUVD-2026-84557

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST/fuzz payload path in pkg/fuzz/parts.go can evaluate substituted runtime data more than once, creating a second evaluation pass that allows response content captured by an internal: true extractor...

CVE-2026-76805

The vulnerability scanner Nuclei (versions 3.0.0 through 3.10.0 ) is vulnerable to environment variable disclosure due to an incomplete fix for CVE-2026-41645. The flaw exists in the DAST/fuzz payload evaluation path (pkg/fuzz/parts.go), where substituted runtime data can be evaluated more than o...

org.wildfly.security/wildfly-elytron-asn1: Unbounded Memory Allocation in WildFly Elytron ASN.1 DERDecoder via Crafted DER Payload

A flaw was found in the DERDecoder class within wildfly-elytron-asn1. A remote attacker can exploit this resource exhaustion vulnerability by sending a specially crafted DER Distinguished Encoding Rules payload. The decoder attempts to allocate excessive memory based on an inflated length value...