CVE-2026-10849

The CVE concerns the hawkBit OTA client in Zephyr (subsys/mgmt/hawkbit/hawkbit.c). A heap-based out-of-bounds write occurs when terminating the received HTTP body: the buffer holds the body but no space for a NUL, so response_data[downloaded_size] = '\0' writes past the allocation. This is trigge...

JLSEC-2026-1158 GNU Wget through 1.25.0, fixed in commit 37a40fc, contains a heap buffer underread vulnerability...

GNU Wget through 1.25.0, fixed in commit 37a40fc, contains a heap buffer underread vulnerability in the cleanmetalinkstring function within src/metalink.c that allows a malicious server to trigger memory corruption by serving a Metalink document containing a whitespace-only URL. Attackers can cau...

CVE-2026-56158

creationtimestamp| type| source ---|---|--- 2026-08-03 21:00:03+00:00| seen| https://t.me/GithubRedTeam/96489 2026-08-04 00:00:09+00:00| published-proof-of-concept| Telegram/C7mZW8YEibhjuVQ7-UjPpcsJfq8AEPUYczTR6mXKULyoi4s 2026-08-04 00:00:12+00:00| published-proof-of-concept|...

CVE-2026-38446

creationtimestamp| type| source ---|---|--- 2026-08-03 20:41:22+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3ms7ebtfrsn2j...

CVE-2026-68980

Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Contexts through the REST API. The framework authorizes asset deletion against the owning Parameter Context using the supplied Parameter Context Identifier and Asset Identifier. The framework...

External Control of File Name or Path

Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to External Control of File Name or Path in the Repo.archive. An attacker can access arbitrary files on the filesystem by supplying specially crafted options that are not...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @activepieces/piece-apify (0.2.1) +126 more potentially affected by CVE-2026-69192 via ip-address (>=10.0.1, <=10.2.0)

ip-address NPM version =10.0.1, =0.3.1, =0.0.2, =9.9.0-ruixiang.1, =1.1.0-dev-0d04f54.1, =1.78.0-rc.0, =3.3.0, =1.0.0, =0.2.0-beta.4, =0.3.0-beta.1, =1.0.35, =1.0.31, =1.0.119 and more Source cves: CVE-2026-69192 Source advisory: SNYK:JS-IPADDRESS-18516623...

CVE-2026-18654 Disabled SSH host key verification in Amazon AWS CLI EMR helper commands

Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 might allow man-in-the-middle attackers to intercept SSHsessions and file transfers via network positioning between the client and the EMR cluster endpoint. To...

3xhaustpi (>=0.1.3, <=0.2.1), @0x0.bug/pi-coding-agent (1.0.0) +1081 more potentially affected by CVE-2026-14643 via undici (>=8.0.0, <=8.8.0)

undici NPM version =8.0.0, =0.1.3, =0.1.0, =1.0.0, =0.2.0, =5.0.1-staging.19033314d476, =5.0.1-staging.19033314d476, =5.1.1-staging.00ceebd28cf2, =5.1.1-staging.00ceebd28cf2, =5.0.1-staging.19033314d476, =5.0.1-staging.3abdf9534c25, =0.1.0, =0.5.1 and more Source cves: CVE-2026-14643 Source...

CVE-2026-51785

creationtimestamp| type| source ---|---|--- 2026-08-03 18:52:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms766fxfxh2m...

CVE-2026-12965

creationtimestamp| type| source ---|---|--- 2026-08-03 17:54:10+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms72wozp2t2o...

CVE-2026-69152

creationtimestamp| type| source ---|---|--- 2026-08-03 17:31:36+00:00| seen| https://gist.github.com/alon710/d80e5d80b7549449b84a63552411d4ec 2026-08-03 18:26:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/hlxnpa6jl7kfg 2026-08-04 12:00:52+00:00| seen|...

DEBIAN-CVE-2026-18477

A TOCTOU Time-of-Check Time-of-Use vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During...

SUSE CVE-2026-67291

FreeRDP before 3.29.0 affected versions = 3.28.0 contains a heap out-of-bounds read in updateprocessglyphfragments/glyphcachefragmentput in libfreerdp/cache/glyph.c. When handling a GLYPHFRAGMENTADD update, the code reads a one-byte server-controlled declared fragment size but does not verify it...

SUSE-SU-2026:3475-1 Security update for s390-tools

This update for s390-tools fixes the following issue - CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 bsc1270185...

Security update for google-cloud-sap-agent

This update for google-cloud-sap-agent fixes the following issue: CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266604. Changes for google-cloud-sap-agent: Update golang.org/x/net to v0.57.0...

Security update for rrdtool

This update for rrdtool fixes the following issue: CVE-2026-43958: stack buffer overflow in rrdcached handlerequestcreate can lead to local privilege escalation via unbounded DS/RRA arguments bsc1267243. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods...

CVE-2026-15430

Improper access control in the IRPMJWRITE command interface in Wellbia XIGNCODE3 xhunter2.sys, version 2026.6.1.192, allows a local, unprivileged attacker to achieve local privilege escalation to NT AUTHORITY\SYSTEM, extract credentials from PPL-protected lsass.exe, and terminate PPL-protected...

CVE-2026-64827

creationtimestamp| type| source ---|---|--- 2026-08-03 14:16:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/355ijrasd4dlj...

CVE-2026-68587 SiYuan before v3.7.3 Information Disclosure via getHeading*Transaction

SiYuan versions before v3.7.3 contain an information disclosure vulnerability in the getHeadingDeleteTransaction, getHeadingLevelTransaction, and getHeadingInsertTransaction endpoints that return rendered block DOM without publish-access checks. Anonymous readers or publish RoleReader tokens can...