CVE-2026-89774

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: hold sk properly in scoconnready sk deref in scoconnready must be done either under conn-lock, or holding a refcount, to avoid concurrent close. conn-sk and parent sk is currently accessed without either, and...

GHSA-V245-V573-V5VM vulnerabilities

Vulnerabilities for packages: argo-workflows...

Exploit for Out-of-bounds Write in Apple Ipados

CVE-2024-27815 XNU kernel heap buffer overflow in sbconcatm...

CVE-2026-79994

The guest-to-host Unix-domain socket relay in Docker Sandboxes validates that a socket path is inside an authorized workspace, but later reconnects using the pathname. A malicious guest can replace an intermediate directory with a symlink between validation and connection, causing the host to...

UBUNTU-CVE-2026-79994

The guest-to-host Unix-domain socket relay in Docker Sandboxes validates that a socket path is inside an authorized workspace, but later reconnects using the pathname. A malicious guest can replace an intermediate directory with a symlink between validation and connection, causing the host to...

CVE-2026-79994

The guest-to-host Unix-domain socket relay in Docker Sandboxes validates that a socket path is inside an authorized workspace, but later reconnects using the pathname. A malicious guest can replace an intermediate directory with a symlink between validation and connection, causing the host to...

CVE-2026-79994 Docker Sandboxes UDS forwarder can reach arbitrary host Unix sockets through a symlink race

The guest-to-host Unix-domain socket relay in Docker Sandboxes validates that a socket path is inside an authorized workspace, but later reconnects using the pathname. A malicious guest can replace an intermediate directory with a symlink between validation and connection, causing the host to...

CVE-2026-79994

CVE-2026-79994 affects the guest-to-host Unix-domain socket (UDS) forwarder in Docker Sandboxes . The relay validates that a socket path resides inside an authorized workspace but later reconnects using the raw pathname. A malicious guest can exploit a symlink race by replacing an intermediate di...

CVE-2026-79994 Docker Sandboxes UDS forwarder can reach arbitrary host Unix sockets through a symlink race

The guest-to-host Unix-domain socket relay in Docker Sandboxes validates that a socket path is inside an authorized workspace, but later reconnects using the pathname. A malicious guest can replace an intermediate directory with a symlink between validation and connection, causing the host to...

CVE-2026-79994 Docker Sandboxes UDS forwarder can reach arbitrary host Unix sockets through a symlink race

The guest-to-host Unix-domain socket relay in Docker Sandboxes validates that a socket path is inside an authorized workspace, but later reconnects using the pathname. A malicious guest can replace an intermediate directory with a symlink between validation and connection, causing the host to...

EUVD-2026-79951

The guest-to-host Unix-domain socket relay in Docker Sandboxes validates that a socket path is inside an authorized workspace, but later reconnects using the pathname. A malicious guest can replace an intermediate directory with a symlink between validation and connection, causing the host to...

CVE-2026-55887

MCP Gateway allows easy and secure running and deployment of MCP servers. From 0.21.0 until 0.42.2, Docker MCP Gateway YAML-unmarshalled the attacker-controlled io.docker.server.metadata OCI image label into the broad catalog.Server structure for direct docker:// references and catalog snapshot...

EUVD-2026-78684

MCP Gateway allows easy and secure running and deployment of MCP servers. From 0.21.0 until 0.42.2, Docker MCP Gateway YAML-unmarshalled the attacker-controlled io.docker.server.metadata OCI image label into the broad catalog.Server structure for direct docker:// references and catalog snapshot...

Security Bulletin: Multiple Security Vulnerabilities in Log4j Affect IBM Sterling B2B Integrator and IBM Sterling File Gateway

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the security vulnerabilities Vulnerability Details CVEID:CVE-2025-68161 DESCRIPTION: The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer...

CVE-2026-57135 PraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clients

PraisonAI is a multi-agent teams system. From 1.2.3 until 1.7.2, SandboxExecutor network-isolated mode in src/praisonai-ts/src/cli/features/sandbox-executor.ts uses buildEnv only to inject invalid httpproxy and httpsproxy environment variables and does not establish an operating-system network...

CVE-2026-90711

proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of t...

EUVD-2026-78164

IBM Langflow OSS 1.0.0 through 1.10.0 can allow attackers to execute arbitrary Python code with root privileges UID=0 on the Langflow server by submitting components containing socket or urllib imports. This enables: 1 AWS credential theft via IMDSv1 SSRF with full IAM role permissions, 2 arbitra...

PT-2026-93122

Name of the Vulnerable Software and Affected Versions Docker Sandboxes affected versions not specified Description The guest-to-host Unix-domain socket relay in Docker Sandboxes contains a flaw where it validates that a socket path is within an authorized workspace but subsequently reconnects usi...

CVE-2026-79994: Time-of-check Time-of-use (TOCTOU) Race Condition

The guest-to-host Unix-domain socket relay in Docker Sandboxes validates that a socket path is inside an authorized workspace, but later reconnects using the pathname. A malicious guest can replace an intermediate directory with a symlink between validation and connection, causing the host to...

Security Bulletin: Incomplete Security Scanner Blocklist Enables Network-Based Code Execution

Summary A security vulnerability was identified in the code security scanner where the DANGEROUSIMPORTS blocklist incompletely addressed network-based code execution risks. While subprocess module imports were correctly blocked, socket and urllib standard library modules were omitted from the...