[SECURITY] Fedora 43 Update: coturn-4.15.0-1.fc43

The Coturn TURN Server is a VoIP media traffic NAT traversal server and gatew ay. It can be used as a general-purpose network traffic TURN server/gateway, too. This implementation also includes some extra features. Supported RFCs: TURN specs: - RFC 5766 - base TURN specs - RFC 6062 - TCP relaying...

[SECURITY] Fedora 44 Update: curl-8.18.0-8.fc44

curl is a command line tool for transferring data with URL syntax, supporting FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, IMA P, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection

Provenance-based intrusion detection systems PIDS frequently report strong performance, but the conclusions drawn from these results can be highly sensitive to benchmarking choices and evaluation protocols. We investigate this dependency by re-evaluating representative PIDS on public datasets tha...

CVE-2026-67338 JupyterLab before 4.5.9 Stored XSS via Extension Manager

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...

Oracle WebCenter Content Full Control

Vulnerability of the Core component of the Oracle WebCenter Content application: The Oracle WebCenter Content imaging platform for user interaction involves a lack of authentication for critical functions. Exploiting this vulnerability can allow an attacker to gain full control over the applicati...

PT-2026-66744

The security fix for CVE-2025-66518 is incomplete. Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allowlist via unprefixed Spark config aliases. This issue affects Apache Kyuubi: from 1.6.0 before 1.12.0. User...

Erlang/OTP 23.2 < 27.3.4.15 / 28.0 < 28.5.0.4 / 29.0 < 29.0.4 Certificate Chain Cycle DoS (CVE-2026-58227)

The version of Erlang/OTP installed on the remote host is 23.2 prior to 27.3.4.15, 28.0 prior to 28.5.0.4, or 29.0 prior to 29.0.4. It is, therefore, affected by a vulnerability: - The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain durin...

[SECURITY] Fedora 43 Update: nginx-1.30.4-1.fc43

Nginx is a web server and a reverse proxy server for HTTP, SMTP, POP3 and IMAP protocols, with a strong focus on high concurrency, performance and low memory usage...

Security of World-Model-Based Embodied AI: A Lifecycle of Threats, Defenses, and Evaluation

World models give embodied AI a predictive core: they compress observations into states, simulate action-conditioned futures, and enable planning beyond reactive control. This predictive layer, however, opens a new security boundary-compromise can propagate from data, sensors, prompts, or feedbac...

Oracle WebCenter Enterprise Capture Client Bundle Full Control

The vulnerability of the Client Bundle component of the Oracle WebCenter Enterprise Capture software platform for automatic scanning, recognition, and digitization of documents is related to access control errors. Exploiting this vulnerability could allow a malicious actor to gain full control ov...

pysap v0.2.0

pysap - Python library for crafting SAP's network protocols packets Version 0.2.1.dev0 in dev Overview SAP Netweaver and SAP HANA are technology platforms for building and integrating SAP business applications. Communication between components uses different network protocols and some services an...

Linux Distros Unpatched Vulnerability : CVE-2026-65324

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Apache Traffic Server drops the per-stream buffer cap when dechunking HTTP/2 or HTTP/3 responses, letting a slow client exhaust server memory. This issue affect...

OPENSUSE-SU-2026:21470-1 Security update for java-21-openjdk

This update for java-21-openjdk fixes the following issues: - CVE-2026-41254: Information disclosure or denial of service via integer overflow in CubeSize bsc1264994. - CVE-2026-46917: partial denial of service via TLS bsc1272223. - CVE-2026-46968: unauthorized creation, deletion or modification...

UBUNTU-CVE-2026-54605

OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers. From 0.5.5 to 1.1.5, OAuth::Consumertokenrequest parses the raw Location header of a 300 to 399 redirect returned by the OAuth server and follows the redirect recursively, which can mutate the consumer's...

OPENSUSE-SU-2026:21467-1 Security update for java-25-openjdk

This update for java-25-openjdk fixes the following issues: - CVE-2026-41254: Information disclosure or denial of service via integer overflow in CubeSize bsc1264994. - CVE-2026-46917: partial denial of service via TLS bsc1272223. - CVE-2026-46968: unauthorized creation, deletion or modification...

EUVD-2026-49846

Pivotick did not validate the URL scheme of node imagePath values derived from graph data before assigning them to SVG image resources. An attacker able to supply crafted graph data could set an image path to a malicious URI. When a victim rendered the affected graph, the browser could resolve th...

CVE-2026-59248 Unbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoS

Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on the vulnerable server or client and cause a denial of service. The HPACK and QPACK prefixed-integer decoder cowhpackcommon:decbigint/3 in...

Oracle MySQL J Connector (July 2026 CPU)

The 9.7.x versions of MySQL Connector/J installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory. - Vulnerability in the MySQL Connectors product of Oracle MySQL component: Connector/J. Supported versions that are affected are 9.7.0-9.7.1...

Security update for java-11-openjdk

This update for java-11-openjdk fixes the following issues Upgrade to upstream tag jdk-11.0.32+9 July 2026 CPU. Security issues fixed: CVE-2026-41254: lcms: information disclosure and denial of service via integer overflow in CubeSize bsc1264994. CVE-2026-46917: unauthenticated attacker with...

CVE-2026-60187

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Replication. Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1...