10702 matches found
BIT-COSIGN-2026-22703 Cosign verification accepts any valid Rekor entry under certain conditions
Cosign provides code signing and transparency for containers and binaries. Prior to versions 2.6.2 and 3.0.4, Cosign bundle can be crafted to successfully verify an artifact even if the embedded Rekor entry does not reference the artifact's digest, signature or public key. When verifying a Rekor...
CVE-2026-66109
creationtimestamp| type| source ---|---|--- 2026-08-24 08:45:26+00:00| seen| https://jvn.jp/en/jp/JVN33423625 2026-08-25 09:46:37+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mtvjxd7dnh2i 2026-09-24 22:24:10+00:00| seen|...
rsync 3.0.0 < 3.5.0 Daemon Crash via Malformed File List Entry
...
ROOT-OS-DEBIAN-11-CVE-2026-46245 CVE-2026-46245 in linux - Patched by Root
Root has patched CVE-2026-46245 in the linux package for Root:Debian:11. Multiple fixed versions available...
ROOT-OS-DEBIAN-11-CVE-2026-23071 CVE-2026-23071 in linux - Patched by Root
Root has patched CVE-2026-23071 in the linux package for Root:Debian:11. Multiple fixed versions available...
Malicious code in @syncraft-labs/react (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3986bd05347035d9263c22b871840f19dc42187d3e1719311cb67c6e1ef5cb9 dist/index.js the ESM entry resolved by default by modern bundlers such as Vite, Next.js, and Webpack contains a heavily obfuscated block using...
MAL-2026-14368 Malicious code in @syncraft-labs/react (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3986bd05347035d9263c22b871840f19dc42187d3e1719311cb67c6e1ef5cb9 dist/index.js the ESM entry resolved by default by modern bundlers such as Vite, Next.js, and Webpack contains a heavily obfuscated block using...
CVE-2026-74631
CVE-2026-74631 affects the Linux kernel net: smc subsystem, specifically the smc_rx_splice() function. The root cause is a splice entry lifetime imbalance : pages are passed to splice_to_pipe() before the references covering each entry's lifetime are taken. In the VM-backed RMB path, unqueued ent...
CVE-2026-74624
A deadlock vulnerability exists in the Linux kernel's netfilter nf_conntrack component. When TCP or SCTP conntrack paths emit invalid-packet logs while ct->lock is held, and logging is routed to nfnetlink_log with conntrack export enabled, the log path can re-enter conntrack netlink glue that ...
Linux Distros Unpatched Vulnerability : CVE-2026-74624
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: nfconntrack: defer invalid log until after unlock TCP and SCTP conntrack paths can emit invalid-packet logs while ct-lock is still held. When invalid...
CGA-5R5P-W88W-R282
Bulletin has no description...
CVE-2026-76131
creationtimestamp| type| source ---|---|--- 2026-08-21 04:19:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/j3ybqejm7xu3h 2026-08-21 04:45:06+00:00| seen| https://jvn.jp/en/vu/JVNVU90210212...
SUSE CVE-2026-72201
In the Linux kernel, the following vulnerability has been resolved: ntfs: validate index entries on reading Validate index entries immediately after reading an index root or index block from disk. This eliminates repeated checks in lookup and readdir, and reduce the risk of missing checks in thos...
Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102094)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102094 advisory. In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad KVM: x86:...
CVE-2026-72848
SitemapLoader.parsesitemap in langchaincommunity/documentloaders/sitemap.py applies the documented restricttosamedomain control only to leaf url entries. The loop over url elements filters cross-domain locations, but the loop over nested sitemap elements passes the child loc straight to...
CVE-2026-70461
A flaw was found in rsync. Remote unauthenticated attackers can exploit a heap out-of-bounds write vulnerability by supplying a crafted files-from entry. This entry, containing both an interior and trailing backslash, causes the addimpliedinclude function to under-count the trailing backslash whe...
MiracleLinux 9 : perl-Archive-Tar-2.38-6.el9_8.2 (AXSA:2026-1589:04)
The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1589:04 advisory. perl-Archive-Tar: perl-Archive-Tar: Denial of Service via crafted tar header with large entry size CVE-2026-9538 Tenable has extracted the preceding...
CVE-2026-55194
creationtimestamp| type| source ---|---|--- 2026-08-19 23:40:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mthvq3m66v2p 2026-08-22 05:00:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtnik6j7pn2c...
MINI-HP7Q-24QH-M8GG
Bulletin has no description...
CVE-2026-76614
OpenEMR before 8.3.0 contains a path traversal vulnerability in the EDI archive restore function. The archrestoresel POST parameter is passed to the archive restore handler without sanitization for path traversal sequences. The handler checks whether the supplied path exists on the filesystem, an...