SUSE CVE-2026-98247

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicodec: validate vendor codec count length The Read Local Supported Codecs parsers consume the variable-sized standard codec array before parsing the vendor codec count. Although the initial reply-size check includes...

EUVD-2026-42898

PraisonAI: FastContext path resolution permits absolute and traversal reads outside the workspace...

GHSA-4XXV-6WMF-XF45 PraisonAI: FastContext path resolution permits absolute and traversal reads outside the workspace

FastContext path resolution permits absolute and traversal reads outside the workspace Summary PraisonAI's praisonaiagents.context.fast FastContext feature treats workspacepath as the root directory for code search, but its model-facing search tools and high-level readcontext helper accept absolu...

SUSE CVE-2026-98287

In the Linux kernel, the following vulnerability has been resolved: pppoatm: ensure a writable skb header and linear data In pppoatmsend, LLC encapsulation checks whether there is sufficient headroom for the 4-byte LLC header, but does not ensure that the skb header is writable. Normal transmit...

SUSE CVE-2026-98292

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access btmtksdio.c and btmtkuart.c cast a received WMT event straight to struct btmtkhciwmtevt and read its op/flag fields without checking the event is lon...

SUSE CVE-2026-98298

In the Linux kernel, the following vulnerability has been resolved: dmaengine: mmppdma: fix wrong sg length in mmppdmaprepslavesg In mmppdmaprepslavesg, foreachsg iterates the scatterlist putting each entry into 'sg', but the entry length is read from 'sgl' the list head instead of 'sg' the curre...

SUSE CVE-2026-98348

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject too-short association responses libipwhandleassocresp reads the capability, status and aid fields of the 30-byte association response prefix and then computes the information element length as stats-len -...

SUSE CVE-2026-98349

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject too-short beacon and probe responses libipwprocessproberesponse and the libipwnetworkinit call it makes assume the frame contains the full 36-byte beacon and probe response prefix, but the ipw2100 and ipw2200...

kernel: netfilter: nf_log: validate MAC header was set before dumping it

A flaw was found in the Linux kernel's netfilter logging component. This vulnerability occurs because the system does not properly check if a network packet's Media Access Control MAC header is valid before attempting to log it. A local attacker could send a specially crafted network packet,...

kernel: ipv6: validate extension header length before copying to cmsg

A flaw was found in the Linux kernel's IPv6 networking stack. An unprivileged local user could exploit a vulnerability in how IPv6 extension header lengths are handled. By manipulating these headers using nftables, an attacker can trigger an out-of-bounds read, leading to information disclosure...

SUSE CVE-2026-98362

In the Linux kernel, the following vulnerability has been resolved: clk: scpi: bound-check DVFS index in scpidvfsrecalcrate dvfsgetidx may return an out-of-range index if the SCP firmware is buggy or returns a stale value. Only negative indexes were rejected, so a large index walked past info-opp...

SUSE CVE-2026-98363

In the Linux kernel, the following vulnerability has been resolved: firmware: armscpi: reject DVFS OPP count above MAXDVFSOPPS scpidvfsgetinfo already rejected a zero oppcount, but still trusted any larger value from the SCP firmware. The shared-memory reply only holds MAXDVFSOPPS entries in...

SUSE CVE-2026-106580

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing security-policy check in the CUT encoder allows a crafted local encoding operation to read data that policy should deny and can also cause a crash. This issue ...

MGASA-2026-0471 Updated libxfont2 package fixes security vulnerabilities

fsreadglyphs heap buffer overflow via cumulative glyph data overflow in libXfont2. CVE-2026-44950 fsreadglyphs heap OOB read/write via encoding array index mismatch in libXfont2. CVE-2026-59679...

Updated libxfont2 package fixes security vulnerabilities

fsreadglyphs heap buffer overflow via cumulative glyph data overflow in libXfont2. CVE-2026-44950 fsreadglyphs heap OOB read/write via encoding array index mismatch in libXfont2. CVE-2026-59679...

awesome-jenkins-rce-2019

awesome-jenkins-rce-2019 Non c'è una RCE pre-autenticazione in Jenkins dal maggio 2017, ma questa è quella giusta! Combina CVE-2018-1000861, CVE-2019-1003005 e CVE-2019-1003029 per un'esecuzione remota di codice pre-autenticazione più affidabile ed elegante! Elenco delle versioni interessate...

mod_auth_openidc: mod_auth_openidc: Denial of Service via malformed state cookie parsing

A flaw was found in modauthopenidc, an OpenID Connect Relying Party module for Apache HTTP servers. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP request with a malformed state cookie. This can lead to an out-of-bounds read and a one-byte out-of-bounds write...

Security Bulletin: IBM® Db2® is vulnerable to arbitrary library loading via the CREATE WRAPPER command, allowing a privileged database user to read sensitive files from the host filesystem (CVE-2026-18166)

Summary IBM® Db2® is vulnerable to arbitrary library loading via the CREATE WRAPPER command, allowing a privileged database user to read sensitive files from the host filesystem. Vulnerability Details CVEID:CVE-2026-18166 DESCRIPTION: DB2 for Linux, UNIX and Windows includes DB2 Connect Server...

Security Bulletin: Multiple vulnerabilities affect the Windows S-TAP component as part of IBM Guardium Data Protection (CVE-2026-82344, CVE-2026-82334)

Summary Multiple vulnerabilities have been addressed in the Windows S-TAP component as part of IBM Guardium Data Protection Vulnerability Details CVEID:CVE-2026-82344 DESCRIPTION: IBM Security Guardium is vulnerable to a heap-based buffer overflow in the S-TAP TrafficTap TDS login reassembly...

php_filter_chains_oracle_exploit

PHP filter chains: lettura di file da oracolo basato su errori Una CLI per sfruttare parametri affetti dalla lettura di file causata dall'oracolo basato su errori delle catene di filtri PHP. Può essere usata per esfiltrare il contenuto di un file locale quando viene passato a funzioni vulnerabili...