OESA-2026-3417 policycoreutils security update

It contains the selinux policy core utilities Security Fixes: A Missing Authorization vulnerability in selinux policycoreutils seunshares allows a user that is running in unconfined context to kill e.g. root-owned processes running also in unconfined context This issue affects policycoreutils...

CVE-2026-18271: Heap-based Buffer Overflow

Kenwood DNR1007XR vCardParser Heap-based Buffer Overflow Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DNR1007XR devices. Authentication is not required to exploit this vulnerability. The specifi...

AEGIS: Preventing Cross-Domain Resource Abuse in MCP

The Model Context Protocol MCP is an open source JSON-RPC protocol that standardizes how large language models LLMs interact with external systems through programmatic functions known as tools. Attackers or malicious agents can exploit certain modalities of these MCP tools to degrade the overall...

CVE-2026-18274: Improper Limitation of a Pathname to a Restricted Directory

Heimdall Data Database Proxy uploadJar Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Heimdall Data Database Proxy. Authentication is required to exploit this vulnerability. The specific fl...

CVE-2026-18263: Exposed Dangerous Method or Function

Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels RAS Client. An attacker must first obtain the ability to execute low-privileged cod...

CVE-2026-18262: Exposed Dangerous Method or Function

Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels RAS Client. An attacker must first obtain the ability to execute low-privileged cod...

CVE-2026-13121: Exposed Dangerous Method or Function

Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels RAS Client. An attacker must first obtain the ability to execute low-privileged cod...

PT-2026-79115

A malicious builder peer may be able to request an in-context file by name from the host and receive the contents of whatever the name resolves to, even when it resolves outside the build context. This vulnerability is addressed in container version 1.2.0...

The Claws in Plain Sight: Unauthorized Context Disclosure through LLM Agent Tool Calls

LLM agents routinely construct tool-call arguments from user profiles, conversation history, retrieved documents, and prior tool results. However, legitimate access to contextual information does not imply authorization to transmit that information for every purpose or destination. We present Cla...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' through the composition lookup. An attacker can manipulate the base function by injecting malicious components during the lookup process,...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the env actuator endpoint when no allow list is enforced for property keys. An attacker can modify arbitrary environment properties by sending crafted requests to the writable endpoint. Note: This is only...

CVE-2026-76350

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedulesearch capability could configure Portable Document Format PDF attachments in the email alert action workflow. When the email alert action runs, it could execute arbitrary Search...

CVE-2026-76350

CVE-2026-76350 is an improper privilege management vulnerability in Splunk Enterprise affecting versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 . A user holding the schedule_search role capability can configure PDF attachments in the email alert action workflow. When the alert fires, the search...

UBUNTU-CVE-2026-75595

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandlerdecode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause...

CVE-2026-12522

The HL7800 cellular modem driver's +CGCONTRDP: response handler oncmdatcmdinfoipaddr in drivers/modem/vendorstandalone/hl7800.c parses the PDP-context dynamic parameters local address, subnet mask, gateway, and DNS servers that the cellular network assigns to the device. The response is linearize...

CVE-2026-12633

The IPv6 neighbor-discovery code in subsys/net/ip/ipv6nbr.c processes the 6LoWPAN Context Option 6CO, RFC 6775 carried inside ICMPv6 Router Advertisements. In handlera6co the 8-bit contextlen field is taken directly from the packet and was never bounded to the RFC maximum of 128. The function...

CVE-2026-12522

Zephyr RTOS's on_cmd_atcmdinfo_ipaddr() in drivers/modem/vendor_standalone/hl7800.c uses attacker-controlled delimiter positions as strncpy() length into fixed 64/16-byte buffers, causing stack overflow in supervisor context. A rogue base station can trigger crashes or control-flow hijacking. Fix...

EUVD-2026-63075

The HL7800 cellular modem driver's +CGCONTRDP: response handler oncmdatcmdinfoipaddr in drivers/modem/vendorstandalone/hl7800.c parses the PDP-context dynamic parameters local address, subnet mask, gateway, and DNS servers that the cellular network assigns to the device. The response is linearize...

CVE-2026-12633

CVE-2026-12633 is an out-of-bounds write in the Zephyr RTOS IPv6 neighbor-discovery code (subsys/net/ip/ipv6_nbr.c). The function handle_ra_6co() processes the 6LoWPAN Context Option (RFC 6775) from ICMPv6 Router Advertisements without bounding the 8-bit context_len field to the RFC maximum of 12...

CVE-2026-12633 Out-of-bounds write in IPv6 6LoWPAN Context Option handling via unauthenticated Router Advertisement

The IPv6 neighbor-discovery code in subsys/net/ip/ipv6nbr.c processes the 6LoWPAN Context Option 6CO, RFC 6775 carried inside ICMPv6 Router Advertisements. In handlera6co the 8-bit contextlen field is taken directly from the packet and was never bounded to the RFC maximum of 128. The function...