CVE-2026-59847 Libssh: libssh: integrity downgrade via openssl aes-gcm tag verification

A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection...

CVE-2026-59847

A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection...

CVE-2026-59847

CVE-2026-59847 affects the OpenSSH/libssh stack via an integrity downgrade caused by incorrect AES-GCM tag verification when using the OpenSSL backend. The provided connected documents indicate the issue in libssh before 0.11.5, with the vulnerability enabling an in-path attacker to compromise in...

CVE-2026-59847

A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection...

CVE-2026-16392

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153 and Thunderbird 153...

CVE-2026-16395

Integer overflow in the Audio/Video component. This vulnerability was fixed in Firefox 153 and Thunderbird 153...

SUSE CVE-2026-63988

In the Linux kernel, the following vulnerability has been resolved: bridge: Fix sleep in atomic context in sysfs path Since the start of the git history, brportstore always acquired the bridge lock. Back then this decision made sense: The bridge lock protects the STP state of the bridge and its...

SUSE CVE-2026-63989

In the Linux kernel, the following vulnerability has been resolved: bridge: Fix sleep in atomic context in netlink path Since the introduction of the netlink configuration path for bridge ports in commit 25c71c75ac87 "bridge: bridge port parameters over netlink", brsetport was always called with...

SUSE CVE-2026-64036

In the Linux kernel, the following vulnerability has been resolved: cgroup/rstat: validate cpu before cssrstatcpu access cssrstatupdated is exposed as a BPF kfunc and accepts a caller-provided cpu argument. The function uses cpu for per-cpu rstat lookups without checking whether it refers to a...

SUSE CVE-2026-64132

In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: refresh hdr pointer before ioam6event Reported by Sashiko: In ipv6hopioam, the hdr pointer is initialized to point into the skb's linear data buffer. Later, the code calls skbensurewritable, which might reallocate the...

EUVD-2026-46251

Memory safety bugs present in Firefox ESR 115.37, Firefox ESR 140.12 and Firefox 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153, Firefox...

EUVD-2026-46229

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153...

CVE-2026-16350

The Audio/Video: cubeb component in Mozilla Firefox and Mozilla Thunderbird is vulnerable to incorrect boundary conditions . This flaw impacts several versions including Firefox 153 , Firefox ESR 115.38 , Firefox ESR 140.13 , Thunderbird 153 , and Thunderbird 140.13 . The vulnerability is assigne...

USN-8577-1 openssh vulnerability

USN-8222-1 fixed a vulnerability in OpenSSH. This update provides the corresponding fix for Ubuntu 16.04 LTS. Original advisory details: Vladimir Tokarev discovered that OpenSSH incorrectly handled certificates with the principal name containing a comma character when using user-trusted CA keys i...

CVE-2026-54291

A flaw was found in pgjdbc, an open-source PostgreSQL JDBC Driver. A remote attacker who can intercept a TLS Transport Layer Security connection can silently downgrade connections configured to require channel binding from SCRAM-SHA-256-PLUS to plain SCRAM-SHA-256. This downgrade bypasses the...

CVE-2026-1617 SQLi in Turkmesh's Turkhotspot 5651 Loglama

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Turkmesh Communication Services Inc. Turkhotspot 5651 Loglama allows SQL Injection. This issue affects Turkhotspot 5651 Loglama: from 5.1.2 before 5.1.3...

Exploit for CVE-2026-30623

mcpshield !Python 3.10+https://img.shields.io/badge/python...

CLEANSTART-2026-FZ22182 Security fixes for CVE-2026-0636, CVE-2026-3260, CVE-2026-33558, CVE-2026-33870, CVE-2026-33871, CVE-2026-3505, CVE-2026-35554, CVE-2026-41417, CVE-2026-42402, CVE-2026-42403, CVE-2026-42404, CVE-2026-42578, CVE-2026-42579, CVE-2026-42580, CVE-2026-42581, CVE-2026-42583, CVE-2026-42584, CVE-2026-42585, CVE-2026-42587, CVE-2026-5588, CVE-2026-5598, ghsa-287c-fxr7-3w6c, ghsa-2hfh-9h53-qc24, ghsa-38f8-5428-x5cv, ghsa-45q3-82m4-75jr, ghsa-57rv-r2g8-2cj3, ghsa-5qcv-4rpc-jp93, ghsa-72hv-8253-57qq, ghsa-c3fc-8qff-9hwx, ghsa-cj8j-37rh-8475, ghsa-cm33-6792-r9fm, ghsa-f6hv-jmp6-3vwv, ghsa-g36m-9g3m-2vmp, ghsa-m4cv-j2px-7723, ghsa-mj4r-2hfc-f8p6, ghsa-p93r-85wp-75v3, ghsa-pwqr-wmgm-9rr8, ghsa-v8h7-rr48-vmmv, ghsa-w9fj-cfpg-grvv, ghsa-wf66-mphr-4c4r, ghsa-wg6q-6289-32hp, ghsa-xxqh-mfjm-7mv9 applied in versions: 39.0.1-r0

Multiple security vulnerabilities affect the wildfly package. These issues are resolved in later releases. See references for individual vulnerability details...

AI nudify apps spark legal scrutiny of Apple and Google’s profits

You expect all kinds of apps on Apple's App Store and Google's Play Store, from weather monitors to home automation apps and games. What you might not expect are apps that can create non-consensual nude imagery from ordinary photos. But they exist, and the City of San Francisco has had enough. On...

CLEANSTART-2026-KQ90880 Security fixes for CVE-2025-13281, CVE-2025-4563, CVE-2025-47912, CVE-2025-5187, CVE-2025-55190, CVE-2025-55191, CVE-2025-58183, CVE-2025-58185, CVE-2025-58186, CVE-2025-58187, CVE-2025-58188, CVE-2025-58189, CVE-2025-59537, CVE-2025-59538, CVE-2025-61723, CVE-2025-61724, CVE-2025-61725, CVE-2026-2303, CVE-2026-44740, CVE-2026-44973, CVE-2026-45022, CVE-2026-45570, CVE-2026-45571, ghsa-2v5j-vhc3-9cwm, ghsa-2vgg-9h3w-qbr4, ghsa-2xsj-vh29-9cwm, ghsa-37cx-329c-33x3, ghsa-389r-gv7p-r3rp, ghsa-3wgm-2mw2-vh5m, ghsa-4x4m-3c2p-qppc, ghsa-6v2p-p543-phr9, ghsa-92cp-5422-2m47, ghsa-93mq-9ffx-83m2, ghsa-cp6g-7hqx-qxhp, ghsa-crhj-59gh-8x96, ghsa-f6x5-jh6r-wrfv, ghsa-gxhx-2686-5h9g, ghsa-hj2p-8wj8-pfq4, ghsa-j5w8-q4qc-rx2x, ghsa-m3xc-h892-ggx6, ghsa-m7cr-m3pv-hgrp, ghsa-mh63-6h87-95cp, ghsa-mw99-9chc-xw7r, ghsa-qw64-3x98-g7q2, ghsa-w5pp-99ch-qj29 applied in versions: 2.13.9-r0, 2.14.20-r0, 3.0.16-r0, 3.0.19-r0, 3.1.12-r0, 3.1.4-r0, 3.1.8.-r0, 3.1.9-r4, 3.2.12-r0, 3.2.7-r0

Multiple security vulnerabilities affect the argo-cd package. These issues are resolved in later releases. See references for individual vulnerability details...