RLSA-2026:57451 Moderate: cups-filters security update

The cups-filters package contains back ends, filters, and other software that was once part of the core Common UNIX Printing System CUPS distribution but is now maintained independently. Security Fixes: libcupsfilters: cups-filters: libcupsfilters: CUPS image filter process abort via malformed PN...

cups-filters security update

An update is available for cups-filters. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The cups-filters package contains back ends, filters, and other software...

Exploit for Eval Injection in Langflow

CVE-2026-33017 Langflow RCE ★ CVE-2026-33017 Langflow Remote...

rustnet v1.6.0

RustNet Per-process network monitoring for your terminal: live TCP, UDP, and QUIC connections with deep packet inspection, sandboxed by default. English | 简体中文 | 日本語 Real-time visibility into every connection your machine makes, who owns it, and what protocol it's speaking. No tcpdump, X11...

Malicious code in @js-lib-team/env-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae761b7dd660e94dd99388dedf8c2227fa6a683e314468e7a482cd649c2e1a47 Package @js-lib-team/env-parser is advertised as an environment-variable parser but on require/import executes a top-level IIFE in index.js that read...

MAL-2026-14344 Malicious code in @js-lib-team/env-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae761b7dd660e94dd99388dedf8c2227fa6a683e314468e7a482cd649c2e1a47 Package @js-lib-team/env-parser is advertised as an environment-variable parser but on require/import executes a top-level IIFE in index.js that read...

CVE-2026-74970

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Site isolation issue in the Graphics component...

SUSE CVE-2026-64787

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to an unexpected...

SUSE CVE-2026-76033

Inappropriate implementation in CORS in Google Chrome prior to 151.0.7922.169 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-76042

Use of uninitialized resource in GPU in Google Chrome prior to 151.0.7922.169 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-76044

Race condition in USB in Google Chrome prior to 151.0.7922.169 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

Oracle Linux 10 : kbd (ELSA-2026-57597)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-57597 advisory. 2.6.4-8 - Fix openvt -u process matching to be more conservative CVE-2026-72693 Resolves: RHEL-235987 Tenable has extracted the preceding description block...

RockyLinux 9 : kbd (RLSA-2026:57610)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:57610 advisory. kbd: Local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login CVE-2026-72693 Tenable has extracted the...

CVE-2026-63462: Uncontrolled Recursion

Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the shared OpenAPI validation error path in src/lib/error/bad-data-error.ts passes a raw request value from lodash.get to JSON.stringify in genericErrorMessage and fromOpenApiValidationErrors without guarding...

Kibana 8.x < 8.19.20 / 9.0.x < 9.3.8 / 9.4.x < 9.4.5 Denial of Service (ESA-2026-101)

The version of Kibana installed on the remote host is 8.x prior to 8.19.20, 9.0.x prior to 9.3.8, or 9.4.x prior to 9.4.5. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-101 advisory. - Uncaught Exception CWE-248, resulting from Improper Input Validation CWE-20, in...

openSUSE 16 Security Update : gitea-tea (openSUSE-SU-2026:21603-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21603-1 advisory. Changes in gitea-tea: - Update to 0.15.1, bringing in the 0.14.2/0.15.0/0.15.1 upstream changes below bsc1253576: CVE-2025-47913:...

AlmaLinux 10 : kbd (ALSA-2026:57597)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:57597 advisory. kbd: Local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login CVE-2026-72693 Tenable has extracted the...

Linux Distros Unpatched Vulnerability : CVE-2026-63381

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a use-after-free in buffer.c when evbufferaddbufferreference processes ...

PT-2026-80322

Vulnerability Details File: src/lib/addons/feature-event-formatter-md.ts Line: 355 in v8.0.1; format method Root Cause FeatureEventFormatterMd.format does: ts Mustache.escape = text = text; const text = Mustache.renderaction, context; mustache pinned ^4.2.0, confirmed installed 4.2.0 keeps escape...

CVE-2026-77087: Missing Authorization

Paperclip before 0.3.1 in default localtrusted mode fails to validate Host headers, allowing attackers to execute arbitrary commands via DNS rebinding. An attacker can craft a malicious webpage that, when visited by a developer running Paperclip locally, uses DNS rebinding to make authenticated A...