CAN Disabler: Hardware-Based Prevention Method of Unauthorized Transmission in CAN and CAN-FD Networks

There have been a quite number of security attack cases against Controller Area Network CAN reported in recent years, but in the meantime no security function is included in the ECU in the current in-vehicle control network. Thus, in-vehicle control networks particularly require cost-effective...

CVE-2026-16792: Improper Certificate Validation

An improper certificate validation vulnerability was reported in multiple Lenovo XClarity Orchestrator LXCO 2.2.0 microservices that could allow an adjacent network attacker to intercept sensitive communications by performing a machine-in-the-middle attack against HTTPS connections during TLS...

ROS-20260804-73-0026

The vulnerability of the gfs2dinodein function in the fs/gfs2/dir.c file of the GFS2 file system in the Linux operating system is related to insufficient input validation. Exploiting this vulnerability could allow an attacker to cause a service failure...

PT-2026-67824

Name of the Vulnerable Software and Affected Versions Lenovo XClarity Orchestrator LXCO version 2.2.0 Description Multiple microservices contain an improper certificate validation flaw. This allows an attacker on the same network to perform a machine-in-the-middle attack against HTTPS connections...

Important: nginx

Issue Overview: A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a...

Linux Distros Unpatched Vulnerability : CVE-2026-42169

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap-buffer-overflow vulnerability exists in the APNG Animated PNG file loader of GIMP. This flaw occurs when the fcTL width exceeds the IHDR width, leading t...

MiracleLinux 8 : openssh-8.0p1-30.el8_10 (AXSA:2026-1438:07)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1438:07 advisory. openssh: Local MITM of X11 forwarding via abstract UNIX socket pre-binding in Asianux Server OpenSSH client versions CVE-2026-55655 openssh: Double...

thrift: Apache Thrift Python bindings: Information disclosure due to improper certificate validation

A flaw was found in Apache Thrift Python bindings. This vulnerability, stemming from improper validation of certificates with host mismatch, could allow a remote attacker to intercept and access sensitive information. The issue occurs when the Python client fails to adequately verify the server's...

SUSE CVE-2026-53669

React Router is a router for React. Versions 6.0.0 through 7.17.0 are vulnerable to Open Redirtect through use of backslashes in and useNavigate. This issue is a follow up to CVE-2025-68470 and has been fixed in version 7.18.0...

UBUNTU-CVE-2026-69249

python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 42.0.0 through 48.0.0, when resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same...

UBUNTU-CVE-2026-69247

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 44.0.0 until 50.0.0, pkcs7decryptder, pkcs7decryptpem, and pkcs7decryptsmime reported the outcome of decrypting a RecipientInfo's encryptedKey in several distinguishable ways, one of which...

EUVD-2026-52451

Misskey is an open source, federated social media platform. Versions 2025.3.2 and later, but prior to 2026.5.4, contain a vulnerability where a lack of proper permission checks allows access to certain data points from the Direct Messages formerly Chat feature, regardless of account permissions...

CVE-2026-46712 Misskey: Lack of proper permission checks in Direct Messaging feature

Misskey is an open source, federated social media platform. Versions 2025.3.2 and later, but prior to 2026.5.4, contain a vulnerability where a lack of proper permission checks allows access to certain data points from the Direct Messages formerly Chat feature, regardless of account permissions...

CVE-2026-69249

CVE-2026-69249 affects python-cryptography prior to 49.0.0, where resolving invalid certificate chains with duplicate self-signed intermediates can explode in recursion, causing resource exhaustion DoS. The core issue is in the recursive build_chain_inner not de-duplicating previously analyzed ca...

EUVD-2026-52449

Misskey is an open source, federated social media platform. All Misskey servers running versions 2024.5.0 and later, but prior to 2026.5.4, contain a vulnerability in the Server Announcements API where insufficient permission checks allow attackers to access limited portions of data that they...

CVE-2026-48115

CVE-2026-48115 affects Misskey servers running versions 2024.5.0 and later, up to but not including 2026.5.4, where the Server Announcements API lacks sufficient permission checks, allowing attackers to access data they normally shouldn’t view. The issue exists regardless of federation being enab...

CVE-2026-48115 Misskey: Improper Authorization in the Announcements API

Misskey is an open source, federated social media platform. All Misskey servers running versions 2024.5.0 and later, but prior to 2026.5.4, contain a vulnerability in the Server Announcements API where insufficient permission checks allow attackers to access limited portions of data that they...

CVE-2026-69247 cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 44.0.0 until 50.0.0, pkcs7decryptder, pkcs7decryptpem, and pkcs7decryptsmime reported the outcome of decrypting a RecipientInfo's encryptedKey in several distinguishable ways, one of which...

CVE-2026-18654

Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 might allow man-in-the-middle attackers to intercept SSHsessions and file transfers via network positioning between the client and the EMR cluster endpoint. To...

CVE-2026-18654

This CVE (CVE-2026-18654) affects the EMR SSH helper commands in the Amazon AWS CLI. The issue is “Key exchange without entity authentication,” enabling potential MITM attackers to intercept SSH sessions and file transfers when connecting to an EMR cluster endpoint. Affected products are AWS CLI ...