Important: Red Hat Security Advisory: .NET 8.0 security update

An update for .NET 8.0 is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available f...

UBUNTU-CVE-2026-54265

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, an issue in the @angular/compiler package allows bypassing DOM property sanitization through the use of two-way property...

UBUNTU-CVE-2026-50557

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22 and 19.2.22, an issue in the @angular/compiler and @angular/core packages allows bypassing element and attribute...

OPENSUSE-SU-2026:11103-1 libxar-devel-1.8.0.0.503-1.1 on GA media

These are all security issues fixed in the libxar-devel-1.8.0.0.503-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-51388

Name of the Vulnerable Software and Affected Versions Filament versions prior to 4.11.5 Filament versions prior to 5.6.5 Description The ImageColumn and ImageEntry components render raw database values without escaping HTML. If the data passed to these components is not validated, an attacker can...

Adobe DNG Software Development Kit (SDK) Out-of-Bounds Vulnerability (CNVD-2026-26858)

The Adobe DNG Software Development Kit SDK is a software development toolkit launched by Adobe Inc. The Adobe DNG Software Development Kit SDK has a out-of-bounds vulnerability, allowing attackers to access sensitive memory information...

Adobe DNG Software Development Kit (SDK) Out-of-Bounds Vulnerability (CNVD-2026-26859)

The Adobe DNG Software Development Kit SDK is a software development toolkit launched by Adobe Inc. The Adobe DNG Software Development Kit SDK has a out-of-bounds vulnerability, allowing attackers to access sensitive memory information...

Understanding the (In)Security of Vibe-Coded Applications

Recent advances in large language models LLMs have enabled vibe coding, an emerging software development paradigm in which users create applications primarily through natural-language interactions with AI agents. Due to its low barrier to entry, vibe coding is rapidly gaining adoption in practice...

The vulnerability of the Content Credentials SDK library, related to uncontrolled resource consumption, allows a hacker to cause a service failure.

The vulnerability of Content Credentials SDK library functions is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures...

Amazon Linux 2023 : golang-github-burntsushi-toml, golang-github-burntsushi-toml-devel (ALAS2023-2026-1877)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1877 advisory. x509.Certificate.VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name SAN entries. This caused strings.Splithost, . to execute repeatedly on the same...

Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-1881)

"It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1881 advisory. In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: handle attrsetsize errors when truncating files CVE-2025-71289 In the Linux kernel, the following vulnerability h...

AI Toolchain Hijacked: IDE Plugin API Key Theft

Whitepaper called AI Toolchain Hijacked: IDE Plugin API Key Theft. The proliferation of AI-assisted development tools has substantially changed how developers configure and manage credentials in their working environment. Where a developer's IDE once contained little more than syntax highlighting...

explotability_analysis_ebpf

eBPF Verifier Exploit Research — s344024 Romano Simone Resear...

Insecure Default Initialization of Resource

Overview @kozou/api is a Kozou's own REST layer: serves table CRUD / VIEW reads / OpenAPI from a SchemaContext. Affected versions of this package are vulnerable to Insecure Default Initialization of Resource due to insufficient validation of the Host and Origin headers in the MCP HTTP server,...

Insecure Default Initialization of Resource

Overview @kozou/mcp is a Kozou MCP server for AI agents stdio + HTTP Affected versions of this package are vulnerable to Insecure Default Initialization of Resource due to insufficient validation of the Host and Origin headers in the MCP HTTP server, unbounded request-body buffering, improper...

cortex-plugin-hexstrike

Example Plugin Brief one-line description of what this plugin...

Colly-dev-cybersecurity-portfolio

No d...

GHSA-J8CV-X86Q-RJ85 Pipecat: Telephony WebSocket `/ws` Unauthenticated Call-Control Abuse via Attacker-Supplied Call SID

Development Runner Telephony WebSocket /ws Unauthenticated Call-Control Abuse via Attacker-Supplied Call SID Summary The pipecat development runner registers a /ws WebSocket endpoint for telephony testing that accepts connections without any authentication. An unauthenticated remote attacker who...

PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default

Summary The published A2U advisory GHSA-f292-66h9-fpmf says unauthenticated A2U event streaming was fixed in praisonai 4.5.115. Current head still exposes the same A2U subscription and event routes without authentication when the operator starts the documented CLI entrypoint: text praisonai serve...

PT-2026-50727

Name of the Vulnerable Software and Affected Versions Pipecat versions prior to 1.4.0 Description The pipecat development runner registers a /ws WebSocket endpoint for telephony testing that accepts connections without authentication. An unauthenticated remote attacker can connect to this endpoin...