SUSE CVE-2026-74281

In the Linux kernel, the following vulnerability has been resolved: tipc: reject inverted service ranges from peer bindings tipcupdatenametbl inserts a binding advertised by a peer node using the lower and upper service-range bounds taken directly from the wire, without checking that lower upper ...

CVE-2026-75329: Missing Authentication for Critical Function

The Netty configuration distribution service port 8283 of super-diamond-server = 1.3.3 has no authentication mechanism. Attackers can directly obtain the full configuration of any project including database passwords, API keys, etc. by sending a TCP request without any credential...

CVE-2026-75329

The Netty configuration distribution service port 8283 of super-diamond-server = 1.3.3 has no authentication mechanism. Attackers can directly obtain the full configuration of any project including database passwords, API keys, etc. by sending a TCP request without any credential...

OPENSUSE-SU-2026:11606-1 cadvisor-0.60.5-2.1 on GA media

These are all security issues fixed in the cadvisor-0.60.5-2.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11609-1 distribution-registry-3.1.1-5.1 on GA media

These are all security issues fixed in the distribution-registry-3.1.1-5.1 package on the GA media of openSUSE Tumbleweed...

Security update for distribution

This update for distribution rebuilds it against the current go security release. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the command listed for your product: SUSE Linux...

SUSE-SU-2026:3786-1 Security update for distribution

This update for distribution rebuilds it against the current go security release...

AI Grinding for Fun and Cryptanalysis

We present an autonomous cryptanalysis workflow in which agents generate, test, and refine hypotheses before human review. The autonomous stage returns reproducible candidates with exact witnesses, controls, code, and run records. A researcher then decides whether the evidence establishes a break...

CVE-2026-77710

misp-stix (the MISP STIX import library) is vulnerable to STIX2 parser confusion and mass assignment (CWE-915, CWE-807). The import logic selected between the internal MISP parser and the external STIX parser based on untrusted metadata—MISP-specific tool labels (STIX2) or document title (STIX1)—...

CVE-2026-77710 STIX2 Parser Confusion and Mass Assignment Allow Unauthorized MISP Attribute Metadata Injection in misp-stix library

A vulnerability in misp-stix could allow a crafted STIX document to influence security-sensitive MISP attribute metadata during import. The STIX import logic automatically selected between the internal MISP parser and the external STIX parser based on metadata contained in the STIX document itsel...

CVE-2026-77710 STIX2 Parser Confusion and Mass Assignment Allow Unauthorized MISP Attribute Metadata Injection in misp-stix library

A vulnerability in misp-stix could allow a crafted STIX document to influence security-sensitive MISP attribute metadata during import. The STIX import logic automatically selected between the internal MISP parser and the external STIX parser based on metadata contained in the STIX document itsel...

ROS-20260821-73-0061

The vulnerability of the copyparams function in the Linux operating system’s kernel involves unlimited distribution of resources. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260821-73-0041

The vulnerability of the devfreqdevrelease function in the Linux operating system’s kernel is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a perpetrator to cause a service failure...

41 deceptive download sites show a real link, then send you somewhere else

We identified a network of 41 websites impersonating popular games and Windows software, all designed to push visitors towards the same Download Studio installer. The sites advertise everything from Counter-Strike, Half-Life, Fallout, Roblox, PUBG, and The Witcher to VLC, 7-Zip, Paint.NET, VMware...

CVE-2026-70782

Vulnerability in the Oracle Labor Distribution product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Labor...

EUVD-2026-61733

Vulnerability in the Oracle Labor Distribution product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Labor...

securix v0.18

SécurixOS: Secure OS Workstation Base !NOTE This project is in alpha , no support is offered at this time. Objectives SécurixOS is a NixOS distribution developed by DINUM to equip secure computers for system administration, office work and development in order to handle Unprotected information...

GO-2026-4942 Stale blob descriptor cache invalidation in github.com/distribution/distribution

In github.com/distribution/distribution and github.com/distribution/distribution/v3 before 3.1.0, when storage.cache.blobdescriptor is configured with redis and storage.delete.enabled is true, deleting a blob in one repository clears the shared digest descriptor in Redis but leaves stale...

EUVD-2026-61139

Kraken agents fail to verify peer-to-peer downloaded blobs against their requested SHA-256 digest before committing to the content-addressable cache, relying only on CRC32 checksums for piece validation. Attackers on the agent-to-agent path or malicious peers can supply substituted content with...

BIT-DISTRIBUTION-2026-41888 Distribution: Tag deletion bypasses `storage.delete.enabled` configuration

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.1, tag deletion via the DELETE /v2//manifests/ endpoint bypasses the storage.delete.enabled: false configuration, allowing any API client to remove tags from repositories even when the operator has...