CVE-2026-58413

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, EnvironmentManager.restoreenv, backupId computes the backup path with joinenvDir, '.backups', backupId and only checks that this path exists. It does not resolve the result or verify that it remains under...

EUVD-2026-46039

Flask-Security-Too allows users to add security features to their Flask applicationa. Version 5.8.0's OAuth reauthentication flow can mark a session as fresh after verifying an OAuth account that belongs to a different user. If an attacker can operate an already-authenticated but stale victim...

CVE-2026-58484 Network-AI: Poisoned environment backup manifest allows arbitrary recursive deletion during backup pruning

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, EnvironmentManager.listBackups reads each backup's manifest.json and trusts the manifest's path field. EnvironmentManager.pruneBackups later passes that trusted entry.path directly to rmSyncentry.path, recursive...

CVE-2026-54538 xrdp: Pre-auth infinite loop via totalLength=0 in TS_SHARECONTROLHEADER

xrdp is an open source RDP server. In versions 0.10.6 and prior, a n issue was discovered where the software fails to properly validate the totalLength field within the RDP protocol control header during packet reception. An unauthenticated remote attacker can exploit this vulnerability by sendin...

CVE-2026-39879 SQL injection in syslog-ng SQL destionation driver

Due to a missing sanitization call in afsqlddrunquery, syslog-ng before 4.12 are vulnerable to SQL injection from an untrusted source. This is not part of the default configuration, the SQL driver has to be manually configured. Fixes are in syslog-ng 4.12, syslog-ng Premium Edition 8.2 and...

CVE-2026-58481 Network-AI: AgentRuntime sandbox path-prefix checks allow file access outside the configured base directory

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, AgentRuntime promises scoped file access under a configured sandbox basePath, but its path containment checks use raw string prefix tests. A sandbox base such as /tmp/network-ai-sandbox also matches a sibling pa...

CVE-2026-64207 net/sched: dualpi2: fix GSO backlog accounting

In the Linux kernel, the following vulnerability has been resolved: net/sched: dualpi2: fix GSO backlog accounting When DualPI2 splits a GSO skb into N segments, it propagates N additional packets to its parent before returning NETXMITSUCCESS. The parent then accounts for the original skb once...

CVE-2026-64207

The CVE-2026-64207 entry concerns the Linux kernel net/sched DualPI2 handling of GSO: when a GSO skb is split into N segments, the code previously propagated N extra packets to the parent, causing the parent’s qlen to exceed the number of queued packets. Under QFQ, after real packets dequeue, a l...

CVE-2026-64191

In the Linux kernel, the following vulnerability has been resolved: i2c: stub: Reject I2C block transfers with invalid length The I2CSMBUSI2CBLOCKDATA case in stubxfer uses data-block0 as the transfer length. The existing check only clamps it to avoid overrunning the chip-words256 register array,...

CVE-2026-64188

CVE-2026-64188 is a Linux kernel vulnerability in the Qualcomm rmnet path where rmnet_dellink() frees an endpoint with kfree() while RCU readers may still reference ep->egress_dev, causing use-after-free and potential kernel crash. The fix adds an rcu_head to struct rmnet_endpoint and replaces...

CVE-2026-64188 net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()

In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: fix endpoint use-after-free in rmnetdellink rmnetdellink removes the endpoint from the hash table with hlistdelinitrcu and then immediately frees it with kfree. However, RCU readers on the receive path...

CVE-2026-64187

CVE-2026-64187 affects the Linux kernel’s XFS log recovery. If the first operation of a transaction is a bare header (len == sizeof(struct xfs_trans_header)) and xlog_recover_add_to_trans() adds an item with no region (ri_buf is NULL), the item can stay on r_itemq with ri_cnt == 0. During recover...

CVE-2026-46671

Rust OneNote File Parser is a parser for Microsoft OneNote files implemented in Rust. Prior to version 1.1.1, a maliciously crafted .onetoc2 table-of-contents file can cause Parser::parsenotebook to open arbitrary files on the host filesystem outside the notebook's directory. The parser reads ent...

CVE-2026-45709

Mailpit is an email testing tool and API for developers. The fix for GHSA-6jxm-fv7w-rw5j CVE-2026-23845, "Server-Side Request Forgery SSRF via HTML Check API", shipped in mailpit v1.28.3, hardened internal/htmlcheck/css.go::downloadCSSToBytes with a 5MB size cap, a text/css content-type check,...

CVE-2026-32825

dataCycle-CORE (dataCycle data management system) before version 26.06.08 contains a password-guessing vulnerability: it enables Devise’s lockable module but disables lock/unlock strategies and lacks rate limiting, allowing unlimited login attempts on both the browser (/users/sign_in) and API (/a...

Important: Red Hat Security Advisory: Satellite 6.16.11 Async Update

An update is now available for Red Hat Satellite 6.16 for RHEL 8 and RHEL 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

CVE-2026-28220

CVE-2026-28220 concerns the Wazuh Cluster Distributed API (DAPI). Before version 4.14.5, the master node could be coerced to deserialize an attacker-controlled callable and run it under an attacker-controlled RBAC context due to a permissive as_wazuh_object() deserialization and client-supplied r...

Security Bulletin: IBM® Db2® federated server is affected by a vulnerability in log4j-core (CVE-2026-34479)

Summary IBM® Db2® federated server is affected by a vulnerability in log4j-core. Vulnerability Details CVEID:CVE-2026-34479 DESCRIPTION: The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output...

CVE-2026-63071

Apache Syncope suffers an RCE via Groovy Sandbox bypass (Improper Isolation). A privileged user can craft a malicious Groovy class that executes untrusted code, bypassing the Groovy sandbox. Affected versions: 3.0.0-M0–3.0.16; 4.0.0-M0–4.0.6; 4.1.0-M0–4.1.1. Fixes are available in versions 4.0.7 ...

SUSE-SU-2026:22879-1 Security update for the Linux Kernel (Live Patch 13 for SUSE Linux Enterprise 16)

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.34.1 fixes various security issues The following security issues were fixed: - CVE-2026-45970: bonding: alb: fix UAF in rlbarprecv during bond up/down bsc1267206. - CVE-2026-46120: ip6gre: Use cached t-net in ip6erspanchangelink...