CVE-2026-15074: Improper Limitation of a Pathname to a Restricted Directory

@fastify/static up to and including version 10.1.0 fails to reject dot-dot path segments in request pathnames before the file-resolution stage. This is a bypass of the earlier fix for CVE-2026-6414, which only covered encoded forward slashes. Because the underlying send library normalizes dot...

Security update for gpg2 (low)

openSUSE security update: security update for gpg2 ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21385-1 Rating: low References: bsc1269279 Cross-References: CVE-2026-57062 CVSS scores: CVE-2026-57062 SUSE : 2.9...

PT-2026-64108

Summary The multiedit tool in src/praisonai/praisonai/tools/multiedit.py allows LLM-controlled arbitrary file read and write without any path validation, workspace boundary check, or protected path guard. This enables an attacker who can influence agent tool arguments via crafted prompts, user...

PT-2026-64121

PraisonAI Slack app mention bypasses configured user/channel authorization Summary PraisonAI's Slack bot applies its configured allowed users, allowed channels, and unknown-user pairing policy in the normal Slack message event handler, but not in the adjacent Slack app mention event handler. A...

TencentOS Server 2: gnupg2 (TSSA-2026:0750)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0750 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:...

K000162379: Linux Kernel vulnerabilities CVE-2026-23310, CVE-2026-23336, CVE-2026-23340, and CVE-2026-23343

Security Advisory Description CVE-2026-23310 In the Linux kernel, the following vulnerability has been resolved: bpf/bonding: reject vlan+srcmac xmithashpolicy change when XDP is loaded bondoptionmodeset already rejects mode changes that would make a loaded XDP program incompatible via...

GO-2026-6052 Gitea: Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard) in gitea.dev

Gitea: Fork-PR Actions task can read a third private repository via the collaborative-owner branch missing fork-PR guard in gitea.dev...

SUSE CVE-2017-1000377

An issue was discovered in the size of the default stack guard page on PAX Linux originally from GRSecurity but shipped by other Linux vendors, specifically the default stack guard page is not sufficiently large and can be "jumped" over the stack guard page is bypassed, this affects PAX Linux...

EUVD-2026-44506

jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization...

CVE-2026-47708 MCP-for-Stata: Command injection via log_file_name parameter in Stata command wrapper

MCP-for-Stata is an MCP server for Stata to integrate Stata into an agent. Prior to version 1.17.3, the logfilename parameter in the statado API and CLI is directly interpolated into a Stata command string without sanitization. The security guard GuardValidator only scans the do-file content but...

CVE-2026-63764 LMDeploy Server-Side Request Forgery via HTTP Redirect Bypass

LMDeploy through 0.14.0, fixed in commit 03c3130, contains a server-side request forgery SSRF vulnerability in the loadhttpurl function within the connection.py media handler, where the private-IP guard validates only the original URL without re-validating hosts after HTTP redirects. An...

SUSE CVE-2026-63978

In the Linux kernel, the following vulnerability has been resolved: net/handshake: Drain pending requests at net namespace exit The arguments to listspliceinit in handshakenetexit are reversed. The call moves the local empty "requests" list onto hn-hnrequests, leaving the local list empty, so the...

SUSE CVE-2026-64073

In the Linux kernel, the following vulnerability has been resolved: irqwork: Fix use-after-free in irqworksingle on PREEMPTRT On PREEMPTRT, non-HARD irqwork runs in per-CPU kthreads via runirqworkd, so irqworksync uses rcuwait to wait for BUSY==0. After irqworksingle clears BUSY via atomiccmpxchg...

SUSE CVE-2026-64111

In the Linux kernel, the following vulnerability has been resolved: lsm: hold credguardmutex for lsmsetselfattr Just as procpidattrwrite already does before calling the LSM hook. This only matters for SELinux and AppArmor which check whether the process is being ptraced and if so, whether to allo...

SUSE CVE-2026-64175

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: stop TX during firmware restart When iwlwifi firmware crashes e.g., NMIINTERRUPTUNKNOWN on Intel BE201/Wi-Fi 7, iwlmldnicerror sets mld-fwstatus.inhwrestart to true. However, iwlmldtxfromtxq does not check thi...

CVE-2026-64111

A flaw was found in the Linux kernel's Security Module LSM. A local attacker could exploit this vulnerability by leveraging an improper handling of a credential guard mutex in the lsmsetselfattr function. This oversight may allow the attacker to bypass security restrictions enforced by modules su...

PT-2026-63283

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description A privilege escalation issue exists in the API endpoint POST /users/username/tokens used for creating Personal Access Tokens. The endpoint is protected by the reqBasicOrRevProxyAuth middleware,...

Gitea: Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)

GetActionsUserRepoPermission models/perm/access/repopermission.go decides whether an Actions task token may access a target repo. Its cross-repo branches each enforce a fork-PR discriminator — except the collaborative-owner branch, which is missing the !task.IsForkPullRequest guard that its sibli...

File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scope

Summary ScopedFs confines every File Browser user to a scope directory. Its within guard is meant to reject any operation that follows a symbolic link out of that scope. When the link target does not exist yet, the guard walks up to the nearest existing ancestor and validates that instead. For a...

GHSA-FMM7-X4GX-8JHR File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanup

Summary A scoped, non-admin File Browser user holding only the Create permission can delete arbitrary files outside their scope other tenants' data, and the application's own database via the upload failure-cleanup path. This is an incomplete fix of CVE-2026-54094: the v2.63.14 ScopedFs containme...