8646 matches found
Linux Distros Unpatched Vulnerability : CVE-2026-43894
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - jq is a command-line JSON processor. In 1.8.1 and earlier, when decNumberFromString is given a number literal of INTMAX-1 2147483646 digits, the D2U macro...
openSUSE 16 Security Update : distribution (openSUSE-SU-2026:20686-1)
The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20686-1 advisory. This update for distribution fixes the following issues Security issues: - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to...
GHSA-H74G-238J-357M vulnerabilities
Vulnerabilities for packages: argo-cd, cert-manager, karpenter, kaf, aws-flb-cloudwatch, dask-gateway, grafana, karma, zarf, containerd, cilium-cli, aws-flb-firehose, go, falco-no-driver, minio, grafana-alloy, kube-fluentd-operator, datadog-agent, kubernetes-dashboard, kubevela, hubble,...
GHSA-V8VW-GW5J-W7M6 MCP Registry has open redirect via protocol-relative path in trailing-slash middleware
Summary The TrailingSlashMiddleware in internal/api/server.go is vulnerable to an open redirect attack. An attacker can craft a URL with a protocol-relative path e.g., //evil.com/ that, after trailing slash removal, results in a Location header of //evil.com — which browsers interpret as an...
[SECURITY] [DSA 6253-1] linux security update
------------------------------------------------------------------------- Debian Security Advisory DSA-6253-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 08, 2026 https://www.debian.org/security/faq -...
EUVD-2026-28657
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Eagerly init vgic dist/redist on vgic creation If vgicallocateprivateirqslocked fails for any odd reason, we exit kvmvgiccreate early, leaving dist-rdregions uninitialised. kvmvgicdistdestroy then comes along and walk...
CVE-2026-43351 KVM: arm64: Eagerly init vgic dist/redist on vgic creation
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Eagerly init vgic dist/redist on vgic creation If vgicallocateprivateirqslocked fails for any odd reason, we exit kvmvgiccreate early, leaving dist-rdregions uninitialised. kvmvgicdistdestroy then comes along and walk...
PT-2026-39301
Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.4.1 Description An open redirect issue in Snipe-IT allows attackers to redirect users to malicious websites. This occurs because the application uses an unvalidated HTTP Referer header stored in a session variable...
SUSE-SU-2026:21560-1 Security update for distribution
This update for distribution fixes the following issues Security issues: - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2: path pseudo- header bsc1260283. - CVE-2026-33540: information disclosure via improper validation of authentication real...
OPENSUSE-SU-2026:20686-1 Security update for distribution
This update for distribution fixes the following issues Security issues: - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2: path pseudo- header bsc1260283. - CVE-2026-33540: information disclosure via improper validation of authentication real...
Firmware Distribution As Attack Surface: A Security Study of ASIC Cryptocurrency Miners
ASIC cryptocurrency miners are a core component of blockchain infrastructures, directly converting computation and energy into monetary value. Despite their economic im- portance, their security is rarely evaluated in a structured manner. In this paper, we show that the firmware distribution...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization through the DeleteManifest process. An attacker can remove tags from repositories by sending a DELETE request to the relevant API endpoint, even when deletion has been explicitly disabled in the configuration. Th...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization through the DeleteManifest process. An attacker can remove tags from repositories by sending a DELETE request to the relevant API endpoint, even when deletion has been explicitly disabled in the configuration. Th...
GHSA-6PJF-3R9X-M592 Distribution's tag deletion bypasses `storage.delete.enabled` configuration
Summary Tag deletion via the DELETE /v2//manifests/ endpoint bypasses the storage.delete.enabled: false configuration, allowing any API client to remove tags from repositories even when the operator has explicitly disabled deletion. Details When storage.delete.enabled is configured to false,...
HackerSignal: A Large-Scale Multi-Source Dataset Linking Hacker Community Discourse to the CVE Vulnerability Lifecycle
We introduce HackerSignal, a benchmark for temporal out-of-distribution cyber threat intelligence CTI and cross-source CVE linkage. HackerSignal aggregates 7.45 million exact-deduplicated documents from 64 public forum/source identifiers spanning eight source layers and a 36-year window 1990-2026...
The vulnerability of the fetchWithGuard() function in the AI agent OpenClaw (formerly ClawdBot or MoltBot) allows a violator to trigger a service failure.
The vulnerability of the fetchWithGuard function in the AI agent OpenClaw formerly ClawdBot or MoltBot is related to the unlimited distribution of resources. Exploiting this vulnerability could allow a remote attacker to cause service failures...
PT-2026-41221
Impact All versions of mckenziearts/livewire-markdown-editor prior to v1.3 contain a critical arbitrary file upload vulnerability in the MarkdownEditor::updatedAttachments Livewire handler. The handler calls $file-store with no server-side validation of MIME type, extension, or file content. Any...
CLSA-2026-1777541445 bluez: Fix of 3 CVEs
CVE-2022-0204: fix heap overflow when appending prepare writes in gatt-server - CVE-2022-39176: fix not checking paramslen in AVRCP vendordep PDU handling - CVE-2022-39177: fix accepting invalid/malformed capabilities in AVDTP...
Fedora 45 : docker-distribution (2026-d7d99f08ff)
The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-d7d99f08ff advisory. Automatic update for docker-distribution-3.1.1-1.fc45. Changelog Fri May 1 2026 Bradley G Smith - 3.1.1-1 - Update to release v3.1.1 - Resolves:...
