CVE-2026-102106: Improper Authentication

Improper authentication in a Kiteworks Email Protection Gateway administrative service. An administrative service in Kiteworks Email Protection Gateway did not consistently enforce administrator authentication, so the required password check could be bypassed. An attacker who referenced a valid...

PT-2026-103596

Name of the Vulnerable Software and Affected Versions Kiteworks Email Protection Gateway affected versions not specified Description An administrative service in Kiteworks Email Protection Gateway fails to consistently enforce administrator authentication, allowing the password check to be...

freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes

A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied...

ipa security, bug fix, and enhancement update

4.13.4-1.0.1 - Set IPAPLATFORM=rhel when build on Oracle Linux Orabug: 29516674 - Add bind to ipa-server-common Requires Orabug: 36518596 4.13.4-1 - Resolves: RHEL-248199 CVE-2026-79678 ipa: freeipa: idp-add eval reachable before authorization check allows environment disclosure and denial of...

Placeholder Domains Used by 349 AI Agent Skills Found Redirecting to Scams

Manifold Security found placeholder domains cited in 359,000 GitHub files and 349 AI agent skills serving cloaked scam…...

Information Exposure

Overview froxlor/froxlor is a server administration software. Affected versions of this package are vulnerable to Information Exposure via the Domains::get, Domains::listing, SubDomains::get, and SubDomains::listing API functions. An attacker can access DKIM private signing keys belonging to othe...

PT-2026-99389

Name of the Vulnerable Software and Affected Versions Froxlor versions prior to 2.3.12 Description The software fails to enforce the mail.allow external domains policy within the 'EmailSender.add' API endpoint. When an administrator enables the allowed-sender feature but disables external...

PT-2026-99381

Name of the Vulnerable Software and Affected Versions Froxlor versions prior to 2.3.12 Description Certain API responses fail to filter sensitive columns, allowing an authenticated non-superadmin admin with the customers see all flag to access the panel domains.dkim privkey field. This occurs whe...

PT-2026-98818

Name of the Vulnerable Software and Affected Versions Linux kernel versions 6.8 and 6.18 LTS Description An issue exists in the drm/virtio component where the virtio-gpu driver fails to correctly use the DMA API for resource backing on Xen PV domains. In these domains, page addresses do not...

freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes

A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied...

COBRA: A Content-Agnostic Framework for Zero-Day Detection of Suspicious Domains

The use of malicious domains is central to cyberattacks such as phishing, malware distribution, impersonation, and fraudulent transactions. Because domains are inexpensive to register and easy to deploy at scale, they remain one of the most common and damaging tools used in cybercrime across...

Antiphishing v35456910988

Antiphishing — Predictive Phishing Intelligence for Suricata DONATE · DASHBOARD VECTORS · CONTRIBUTING · SUBMIT A VECTOR · REST API CTI · WIKI Predictive Phishing Intelligence for Suricata — Preemptive Defense from Day Zero Antiphishing is an open-source GPLv3 Cyber Threat Intelligence CTI...

CVE-2026-92359 ag-ui-protocol ag-ui CORSMiddleware utils.py create_strands_app cross-domain policy

A security flaw has been discovered in ag-ui-protocol ag-ui 0.3.0. The affected element is the function createstrandsapp of the file integrations/aws-strands/python/src/aguistrands/utils.py of the component CORSMiddleware. The manipulation results in permissive cross-domain policy with untrusted...

EUVD-2026-80694

A security flaw has been discovered in ag-ui-protocol ag-ui 0.3.0. The affected element is the function createstrandsapp of the file integrations/aws-strands/python/src/aguistrands/utils.py of the component CORSMiddleware. The manipulation results in permissive cross-domain policy with untrusted...

CVE-2026-92359

CVE-2026-92359 affects ag-ui-protocol ag-ui 0.3.0 , specifically the CORSMiddleware component in the create_strands_app function within integrations/aws-strands/python/src/ag_ui_strands/utils.py. The root cause is a permissive cross-domain policy that allows untrusted domains, potentially enablin...

numa v0.23.1

Numa DNS you own. Everywhere you go. — numa.rs A portable DNS resolver in a single binary. Block ads on any network, name your local services frontend.numa, override any hostname with auto-revert, and seal every outbound query with ODoH RFC 9230 so no single party sees both who you are and what y...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Firmware: armscmi: Hardened access to reset domains. Accessing reset domain descriptors via indexes in SCMI driver requests, through the SCMI reset operation interface, may potentially lead to out-of-bound violations if the SCMI...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: pmdomain: imx8m-blk-ctrl: Fixed out-of-range access to bc-domains. Out-of-range access to bc-domains in imx8mblkctrlremove has been fixed...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek – A race condition with genpd has been fixed. If the power domains are first registered with genpd, and then the driver attempts to power them on during the probe sequence, it is possible for a race condition t...

Astra Linux – Vulnerability in Firefox

When Multi-Account Containers was enabled, DNS requests could bypass a SOCKS proxy when the domain name was invalid or the SOCKS proxy was not responding. This vulnerability was fixed in Firefox 140 and Thunderbird 140...