Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-007502)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007502 advisory. In the Linux kernel, the following vulnerability has been resolved: mm: hugetlb: avoid soft lockup when mprotect to large memory area When calling mprotect to a larg...

langchain-openai: Image token counting SSRF protection can be bypassed via DNS rebinding

Summary langchain-openai's urltosize helper used by getnumtokensfrommessages for image token counting validated URLs for SSRF protection and then fetched them in a separate network operation with independent DNS resolution. This left a TOCTOU / DNS rebinding window: an attacker-controlled hostnam...

Cross-site Request Forgery (CSRF)

Overview authlib is a library in building OAuth and OpenID Connect servers. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF in the Client integrations due to the lack of CSRF protection for cash parameters. An attacker can perform unauthorized actions on behalf...

GHSA-JJ8C-MMJ3-MMGV Authlib: Cross-site request forging when using cache

Summary There is no CSRF protection on the cache feature on most integrations clients. Details In authlib.integrations.starletteclient.OAuth, no CSRF protection is set up when using the cache parameter. When not using the cache parameter, the use of SessionMiddleware ties the client to the auth...

UBUNTU-CVE-2023-20585

Insufficient checks of the RMP on host buffer access in IOMMU may allow an attacker with privileges and a compromised hypervisor to trigger an out of bounds condition without RMP checks, resulting in a potential loss of confidential guest integrity...

CVE-2023-20585

Insufficient checks of the RMP on host buffer access in IOMMU may allow an attacker with privileges and a compromised hypervisor to trigger an out of bounds condition without RMP checks, resulting in a potential loss of confidential guest integrity...

CVE-2024-4867

The CVE-2024-4867 entry describes a cross-site scripting (XSS) vulnerability in the WSO2 API Manager developer portal. User-supplied input is not properly validated or output-encoded, enabling injection of script content executed in the user’s browser. Exploitation can cause the UI to redirect to...

CVE-2026-1880

An Incorrect Permission Assignment for Critical Resource vulnerability in the ASUS DriverHub update process allows privilege escalation due to improper protection of required execution resources during the validation phase, permitting a local user to make unprivileged modifications. This allows t...

Adobe Connect Code Execution

The vulnerability of Adobe Connect and Adobe Connect Desktop Application messaging services is related to the lack of security measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Azure Logic Apps Privilege Escalation

The vulnerability of the cloud platform used for creating and launching automated work processes in Azure Logic Apps, when operating on Windows operating systems, is related to insufficient protection of registration data. Exploiting this vulnerability could allow a malicious actor to gain elevat...

Windows Kernel Disclosure

The vulnerability of the Windows operating system’s kernel is related to insufficient protection of registration data. Exploiting this vulnerability can allow an attacker to disclose the protected information...

Windows Kernel Disclosure

The vulnerability of the Windows operating system’s kernel is related to insufficient protection of registration data. Exploiting this vulnerability can allow an attacker to disclose the protected information...

Remote Procedure Call Disclosure Information

The vulnerability of the Remote Procedure Call component in the Windows operating system is related to insufficient protection of service data. Exploiting this vulnerability can allow an attacker to disclose protected information...

PT-2026-35068

Name of the Vulnerable Software and Affected Versions Authlib versions prior to 1.6.11 Description Authlib is a Python library used to build OAuth and OpenID Connect servers. A lack of Cross-Site Request Forgery CSRF protection exists in the cache feature of the 'authlib.integrations.starlette...

Windows Kernel Information Disclosure

The vulnerability of the Windows Kernel component of the Windows operating system is related to insufficient protection of registration data. Exploiting this vulnerability can allow an attacker to disclose protected information...

Shell command Privilege Escalation

The vulnerability of the Shell command shell of the Windows operating system is related to a breach of data protection mechanisms. Exploiting this vulnerability can allow an attacker, operating remotely, to increase their privileges...

Windows Admin Center Spear Phishing

The vulnerability of the Windows Admin Center management tool is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform spear-phishing attacks remotely...

PT-2026-33305

The authentication endpoint fails to encode user-supplied input before rendering it in the web page, allowing for script injection. An attacker can leverage this by injecting malicious scripts into the authentication endpoint. This can result in the user's browser being redirected to a malicious...

Release Information for Veeam Backup for Microsoft 365 8.4

More Recent Version Available Please find the latest version of Veeam Backup for Microsoft 365 here: Veeam Downloads - Latest Version Build Numbers and Versions of Veeam Backup for Microsoft 365 Requirements This release can be used to: upgrade an existing v7, v8, v8.1, v8.2, or v8.3 deployment o...

PT-2026-33302

The authentication endpoint fails to adequately validate user-supplied input before reflecting it back in the response. This allows an attacker to inject malicious script payloads into the input parameters, which are then executed by the victim's browser. Successful exploitation can enable an...