kernel: iommu/amd: Fix clone_alias() to use the original device's devid

A flaw was found in the Linux kernel's IOMMU Input/Output Memory Management Unit AMD driver. The clonealias function incorrectly uses the device ID devid when handling alias devices. This can lead to the propagation of wrong or stale Device Table Entry DTE entries to alias devices, potentially...

CVE-2026-28324 SolarWinds Observability Self-Hosted Remote Code Execution Vulnerability

SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability due to the insufficient integrity checks. Installations configured in a non-default and non-secure configuration are affected...

CVE-2026-28324

The SolarWinds Observability Self-Hosted platform is vulnerable to an unauthenticated remote code execution (RCE) vulnerability. The root cause is identified as insufficient integrity checks affecting installations configured in non-default and non-secure configurations . This vulnerability has a...

CVE-2026-28324 SolarWinds Observability Self-Hosted Remote Code Execution Vulnerability

SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability due to the insufficient integrity checks. Installations configured in a non-default and non-secure configuration are affected...

EUVD-2026-84807

SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability due to the insufficient integrity checks. Installations configured in a non-default and non-secure configuration are affected...

CVE-2026-93989

A flaw was found in vLLM. A remote attacker can exploit a vulnerability by providing malformed input related to 'bad words' token processing. This can lead to out-of-bounds memory access, corrupting the internal data logits memory used for generating responses for other concurrent requests. As a...

CVE-2026-95697

MISP contains an authorization flaw in the Organisation model's captureOrg method. When the $force parameter is set to true, the method unconditionally overwrites organization metadata fields without verifying that the invoking user holds sufficient privileges. A user with a sharing group SG edit...

jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified

A flaw was found in jackson-databind. This vulnerability occurs in the data-binding functionality where properties intended to be ignored are incorrectly restored and become writable again. An attacker could potentially exploit this by providing input that modifies data through these supposedly...

io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header

A flaw was found in Netty, a network application framework. A remote attacker can bypass security controls in the CorsHandler component by sending a specially crafted request with a null origin header. This bypasses the intended access restrictions, allowing unauthorized requests to reach the...

jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified

A flaw was found in jackson-databind. This vulnerability occurs in the data-binding functionality where properties intended to be ignored are incorrectly restored and become writable again. An attacker could potentially exploit this by providing input that modifies data through these supposedly...

io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header

A flaw was found in Netty, a network application framework. A remote attacker can bypass security controls in the CorsHandler component by sending a specially crafted request with a null origin header. This bypasses the intended access restrictions, allowing unauthorized requests to reach the...

jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified

A flaw was found in jackson-databind. This vulnerability occurs in the data-binding functionality where properties intended to be ignored are incorrectly restored and become writable again. An attacker could potentially exploit this by providing input that modifies data through these supposedly...

EUVD-2026-84371

MISP's WorkflowsController exposed the moduleStatelessExecution action in the Security component's unlockedActions list. In CakePHP, listing an action in unlockedActions disables both the CSRF token check and the field hash validation for that action. Because moduleStatelessExecution executes a...

CVE-2026-95658 MISP CSRF vulnerability in workflow moduleStatelessExecution allows cross-site execution of workflow modules

MISP's WorkflowsController exposed the moduleStatelessExecution action in the Security component's unlockedActions list. In CakePHP, listing an action in unlockedActions disables both the CSRF token check and the field hash validation for that action. Because moduleStatelessExecution executes a...

ROOT-APP-PYPI-GHSA-JM78-9FVV-MHGR GHSA-jm78-9fvv-mhgr in GitPython - Patched by Root

Root has patched GHSA-jm78-9fvv-mhgr in the GitPython package for Root:PyPI. Multiple fixed versions available...

EUVD-2026-84296

VeloCloud Orchestrator VCO on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by...

CVE-2026-93952: Improper Input Validation

VeloCloud Orchestrator VCO on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: emacs (UTSA-2024-002110)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2024-002110 advisory. In Emacs before 29.3, Gnus treats inline MIME contents as trusted. Tenable has extracted the preceding description block directly from the Unity Linux security...

ROS-20260922-73-0096

The vulnerability of the tbxdppropertiesrequest function in the drivers/thunderbolt/xdomain.c file of the general support driver for USB4 and Thunderbolt in the Linux operating system is related to the execution of operations outside of the buffer in memory. Exploiting this vulnerability could...

The vulnerability of the shell.openPath() function in the Electron application development software allows a attacker to compromise the confidentiality and integrity of the protected information.

The vulnerability of the shell.openPath function in the Electron application development platform is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to compromise the confidentiality and integrity of the protected information...