SUSE CVE-2026-54563

Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1, a Cloudreve WebDAV account rooted at a configured folder can send paths such as /dav/%2e%2e/outside.txt because stripPrefix in pkg/webdav/webdav.go joins the decoded request suffix to the account root with...

SUSE CVE-2026-55495

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the WOPI PUTRELATIVE handler passes X-WOPI-SuggestedTarget to URI.JoinRaw as a path rather than a filename, allowing slash and dot-dot segments to escape the source file directory and create or conditionally overwrite...

SUSE CVE-2026-71313

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From v1.51.0 until v1.75.0, the local backend in backend/local/local.go relies on the configurable filename encoder to prevent remote filename data from becoming operating-system path...

SUSE CVE-2026-73506

Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, writes rune in src/terminal/writer.go emitted attacker-controlled current directory names and Git metadata, including Commit.Subject, Commit.Author.Name, Commit.Author.Email, and...

SUSE CVE-2026-85047

Improper input validation in Transactions Platform in Google Chrome on on iOS prior to 152.0.7977.82 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-85048

Use after free in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

AZL-99945 CVE-2026-86098 affecting package ntopng 5.2.1-6

ntop nDPI versions before 6.0 contain a heap buffer overflow vulnerability in the ndpijsonstringescape function that writes beyond caller-supplied buffer boundaries. Attackers can trigger the overflow by supplying crafted network packet data including TLS SNI, HTTP headers, or DNS names that reac...

DEBIAN-CVE-2026-86098

ntop nDPI versions before 6.0 contain a heap buffer overflow vulnerability in the ndpijsonstringescape function that writes beyond caller-supplied buffer boundaries. Attackers can trigger the overflow by supplying crafted network packet data including TLS SNI, HTTP headers, or DNS names that reac...

CVE-2026-86098 ntop nDPI before 6.0 Heap Buffer Overflow via ndpi_json_string_escape

ntop nDPI versions before 6.0 contain a heap buffer overflow vulnerability in the ndpijsonstringescape function that writes beyond caller-supplied buffer boundaries. Attackers can trigger the overflow by supplying crafted network packet data including TLS SNI, HTTP headers, or DNS names that reac...

CVE-2026-81939

A Zip Slip vulnerability in the SonicWall Network Security Manager NSM On-Prem file upload and archive processing functionality allows an attacker to extract files outside the intended destination directory using a specially crafted archive...

Using a VM to Contain an AI Agent

It won't work: My suspicion was that GPT 5.6-Cyber would succeed, but the frequency and manner of its success removed all doubt. We have to reassess sandboxing quality for capable AI agents, and in general the software stack with which they interact. An off-the-shelf VM is not enough to contain a...

vulnerabilities present in Google Chrome

Google has identified several vulnerabilities in Google Chrome, particularly in versions for 152.0.7977.82. These vulnerabilities reside in various components of Google Chrome, including DevTools, Network, V8 JavaScript engine, and Transactions Platform on iOS. Attackers can exploit these...

[SECURITY] [DLA 4770-1] firefox-esr security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4770-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort September 04, 2026 https://wiki.debian.org/LTS -...

CVE-2026-45197

Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a read and/or write data outside the Guest's virtualised GPU memory. The firmware uses data provided by the Guest VM to set up accesses to memory. It validated this before use, but a...

CVE-2026-45197 GPU DDK - TOCTOU affecting psFWMemContext->uiPageCatBaseRegSet

Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a read and/or write data outside the Guest's virtualised GPU memory. The firmware uses data provided by the Guest VM to set up accesses to memory. It validated this before use, but a...

Linux Distros Unpatched Vulnerability : CVE-2026-85048

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the renderer process to execute arbitrary co...

PT-2026-86268

Name of the Vulnerable Software and Affected Versions ntop nDPI versions prior to 6.0 Description An out-of-bounds heap write exists in the ndpi json string escape function. This occurs because the function lacks an enforceable maximum length for the destination buffer when escaping characters fo...

Linux Distros Unpatched Vulnerability : CVE-2026-85047

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in Transactions Platform in Google Chrome on on iOS prior to 152.0.7977.82 allowed a remote attacker to potentially execute arbitrary...

Linux Distros Unpatched Vulnerability : CVE-2026-85042

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in DevTools in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML...

PT-2026-91808

ntop nDPI versions before 6.0 contain a heap buffer overflow vulnerability in the ndpi json string escape function that writes beyond caller-supplied buffer boundaries. Attackers can trigger the overflow by supplying crafted network packet data including TLS SNI, HTTP headers, or DNS names that...