Malicious code in @servicetitan/examples (npm)

npm/@servicetitan/examples is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

CLSA-2026-1779670115 TuxCare security update for apache-airflow-providers-http (1 CVE)

TuxCare rebuilt apache-airflow-providers-http to address 1 CVE. Fixed in 4.13.3.post1+tuxcare...

CVE-2026-66884

Cross-Site Request Forgery vulnerability in Erlang Ecosystem Foundation oidccplug Oidcc.Plug.AuthorizationCallback module allows an attacker to make a victim's browser complete an authorization flow the victim never initiated. This vulnerability is associated with program file...

Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation

Title: Scheduled automations continue after pending-user deactivation and stored model ACL revocation SummaryOpen WebUI documents pending as a zero-access role used for new sign-ups and deactivated users, and normal HTTP routes enforce that with getverifieduser which rejects pending, while...

CVE-2026-67243

freo2 provided by refirio contains an unrestricted upload of file with dangerous type vulnerability. A user with the highest-level administrative privileges for the product may upload an executable file and execute arbitrary OS commands...

CVE-2026-18569 Keycloak-services: keycloak-services: oidc backchannel logout accepts unsigned forged logout tokens

A flaw was found in the backchannel logout endpoint of the keycloak-services component, which is part of the Red Hat Build of Keycloak. This component handles authentication and session management for applications. The issue occurs when an OIDC identity provider is configured to skip signature...

EUVD-2026-52575

A flaw was found in the backchannel logout endpoint of the keycloak-services component, which is part of the Red Hat Build of Keycloak. This component handles authentication and session management for applications. The issue occurs when an OIDC identity provider is configured to skip signature...

sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation

A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo...

sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation

A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo...

Important: Red Hat Security Advisory: sssd security update

An update for sssd is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System...

CVE-2026-18774: Server-Side Request Forgery (SSRF)

A flaw has been found in NousResearch hermes-agent up to 0.16.0. This affects the function saveurlimage of the file agent/imagegenprovider.py of the component xAI Image Generation Provider. This manipulation causes server-side request forgery. The attack may be initiated remotely. The exploit has...

Vulnerabilities Resolved in Veeam Service Provider Console 9.3

All vulnerabilities documented in this article were resolved in Veeam Service Provider Console 9.3.0.35057. Veeam Software Security Commitment Veeam® is committed to ensuring its products protect customers from potential risks. As part of that commitment, we operate a Vulnerability Disclosure...

RHEL 9 : sssd (RHSA-2026:49839)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:49839 advisory. The System Security Services Daemon SSSD service provides a set of daemons to manage access to remote directories and authentication...

PT-2026-67756

Name of the Vulnerable Software and Affected Versions Veeam Service Provider Console affected versions not specified Description An unauthenticated attacker can exhaust host memory, leading to a denial of service. Denial of service is a condition where a system becomes unavailable to its intended...

CVE-2026-58071: Missing Authentication for Critical Function

A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to access the proxied appliance API asPortal Administrator during a short window after an administrator session begins...

PT-2026-67758

Name of the Vulnerable Software and Affected Versions Veeam Service Provider Console affected versions not specified Description A flaw allows an attacker to perform an arbitrary file write on the management server, which can potentially lead to remote code execution RCE, a situation where an...

PT-2026-67759

Name of the Vulnerable Software and Affected Versions Veeam Service Provider Console affected versions not specified Description An unauthenticated attacker can impersonate a managed agent to obtain the credentials of that agent. Recommendations At the moment, there is no information about a newe...

CVE-2026-58067: Memory Allocation with Excessive Size Value

A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to exhaust host memory and cause adenial of service...

CVE-2026-58073: Authentication Bypass Using an Alternate Path or Channel

A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to impersonate a managed agent andobtain that agent's credentials...

RHEL 7 : sssd (RHSA-2026:50109)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:50109 advisory. The System Security Services Daemon SSSD service provides a set of daemons to manage access to remote directories and authentication...