SUSE CVE-2026-70452

rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows remote attackers to circumvent hosts deny rules by inducing DNS resolution failures during hostname-based access control evaluation. When a DNS lookup for a hostname-based deny rule fails, the daemon skips the ru...

CVE-2026-19869: Authorization Bypass Through User-Controlled Key

@neo4j/graphql from 5.2.0 until the patched versions fails to enforce field-level @authentication rules on root custom-resolver fields when a type-level @authentication rule is also present on the same operation type. When both a type-level @authentication on Query/Mutation and a...

Linux Distros Unpatched Vulnerability : CVE-2026-72312

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - octeontx2-af: fix VF bringup affecting PF promiscuous state Mbox handling of nixsetrxmode for a VF with promiscuous and allmulti flags set to false causes...

ANT-2026-DD4RKCBA · OpenSC · Stack Buffer Overflow

stack-buffer-overflow medium Severity Claude medium · Security research firm medium · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits. ANT-2026-DD4RKCBA: Stack buffer overflow in...

CVE-2026-19986

The CVE-2026-19986 case concerns Adblock for Youtube Extension (Chrome) up to 7.2.1. The vulnerability lies in the updateDynamicRules function in contentscript.js of the Event Listener, where manipulation of the yt-anti-adblock-detected argument leads to improper authorization. The issue enables ...

PT-2026-76725

Astro is a web framework for content-driven websites. From 10.0.3 until 11.0.3, the Astro Vercel adapter in packages/integrations/vercel/src/serverless/entrypoint.ts accepts x astro path for the public / isr function based only on the x-vercel-isr header, allowing unauthenticated GET requests to...

fail2ban v1.1.1

root@kitploit: / | | | | / | | |/ /| ' / | ' \ || ,||/|./,|||| v1.1.0.dev1 20??/??/?? Fail2Ban: ban hosts that cause multiple authentication errors Fail2Ban scans log files like /var/log/auth.log and bans IP addresses conducting too many failed login attempts. It does this by updating system...

CVE-2026-72312

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: fix VF bringup affecting PF promiscuous state Mbox handling of nixsetrxmode for a VF with promiscuous and allmulti flags set to false causes deletion of the PF's promiscuous and allmulti MCAM rules. This occurs...

CVE-2026-72312

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: fix VF bringup affecting PF promiscuous state Mbox handling of nixsetrxmode for a VF with promiscuous and allmulti flags set to false causes deletion of the PF's promiscuous and allmulti MCAM rules. This occurs...

CVE-2026-72312 octeontx2-af: fix VF bringup affecting PF promiscuous state

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: fix VF bringup affecting PF promiscuous state Mbox handling of nixsetrxmode for a VF with promiscuous and allmulti flags set to false causes deletion of the PF's promiscuous and allmulti MCAM rules. This occurs...

CVE-2026-72312 octeontx2-af: fix VF bringup affecting PF promiscuous state

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: fix VF bringup affecting PF promiscuous state Mbox handling of nixsetrxmode for a VF with promiscuous and allmulti flags set to false causes deletion of the PF's promiscuous and allmulti MCAM rules. This occurs...

CVE-2026-72312

CVE-2026-72312 affects the Linux kernel component octeontx2-af and fixes an issue where VF bringup could erroneously modify the PF’s promiscuous/allmulti MCAM rules. The root cause was that mbox handling of nix_set_rx_mode (and related APIs) acted only on the PF, not the VF, potentially clearing ...

PT-2026-72724

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the fib rules component where the fib rules dump function may attempt to dump a dying fib rule. This occurs because rocker router fib event calls fib rule get during a...

CVE-2026-72312: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: fix VF bringup affecting PF promiscuous state Mbox handling of nixsetrxmode for a VF with promiscuous and allmulti flags set to false causes deletion of the PF's promiscuous and allmulti MCAM rules. This occurs...

PT-2026-72500

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the octeontx2-af driver where the Mbox handling of nix set rx mode for a Virtual Function VF with promiscuous and all multi flags set to false leads to the deletion of...

rustinel v1.3.0

Rustinel Open-source endpoint detection for Windows, Linux, and macOS. Native telemetry to Sigma, YARA, IOC detection, and SIEM-ready alerts. Written in Rust. Website | Docs | Download | SIEM demos Quick Start Rustinel ships release archives with a binary, default config, demo rules, and a logs/...

Wordfence Intelligence Weekly WordPress Vulnerability Report (August 3, 2026 to August 9, 2026)

Last week, there were 294 vulnerabilities disclosed in 233 WordPress Plugins and 14 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 149 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabiliti...

CVE-2026-72835: Improper Resolution of Path Equivalence

filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allowing authenticated users to bypass administrator-defined deny rules using case-variant or backslash-separated paths. Attackers can request files with alternate path representations that match no ru...

CVE-2026-73481

phpList before 3.7.0-RC5 fail to enforce CSRF token validation on the bounce rule deletion endpoint bouncerules.php / bouncerule.php. The deletion is performed via a GET request ?page=bouncerules&del=N, and the central CSRF check verifyCsrfGetToken is invoked with enforce=false, so it only...

CVE-2026-72650 Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user who is authorized to read alerting rules in a single Kibana space could retrieve alerting rule executio...