Linux Distros Unpatched Vulnerability : CVE-2026-106555

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts. CVE-2026-106555 Note that...

CVE-2026-106555: Incorrect Resource Transfer Between Spheres

In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts...

Dulwich: Symlink directory traversal in filter-branch index_filter via cross-commit state persistence

Summary Dulwich's filterbranch.py CommitFilter.applyindexfilter is vulnerable to symlink directory traversal. When processing commit history, materialized tree entries including symlinks persist in the working directory between commits, allowing a symlink from an ancestor commit to redirect file...

SUSE CVE-2026-62146

A trust-boundary flaw in CRI-O's sandbox state persistence allows attacker-influenced pod metadata to overwrite CRI-O's own reserved sandbox bookkeeping; once reloaded as trusted after a restart, a later container recreate in that sandbox can expose a host-side runtime-management resource inside...

AZL-105348 CVE-2026-62146 affecting package cri-o 1.30.1-1

A trust-boundary flaw in CRI-O's sandbox state persistence allows attacker-influenced pod metadata to overwrite CRI-O's own reserved sandbox bookkeeping; once reloaded as trusted after a restart, a later container recreate in that sandbox can expose a host-side runtime-management resource inside...

CVE-2026-62146

A trust-boundary flaw in CRI-O's sandbox state persistence allows attacker-influenced pod metadata to overwrite CRI-O's own reserved sandbox bookkeeping; once reloaded as trusted after a restart, a later container recreate in that sandbox can expose a host-side runtime-management resource inside...

EUVD-2026-89789

A trust-boundary flaw in CRI-O's sandbox state persistence allows attacker-influenced pod metadata to overwrite CRI-O's own reserved sandbox bookkeeping; once reloaded as trusted after a restart, a later container recreate in that sandbox can expose a host-side runtime-management resource inside...

CVE-2026-62146

A trust-boundary flaw in CRI-O's sandbox state persistence allows attacker-influenced pod metadata to overwrite CRI-O's own reserved sandbox bookkeeping; once reloaded as trusted after a restart, a later container recreate in that sandbox can expose a host-side runtime-management resource inside...

CVE-2026-62146

A trust-boundary flaw in CRI-O's sandbox state persistence allows attacker-influenced pod metadata to overwrite CRI-O's own reserved sandbox bookkeeping; once reloaded as trusted after a restart, a later container recreate in that sandbox can expose a host-side runtime-management resource inside...

CVE-2026-62146: Trust Boundary Violation

A trust-boundary flaw in CRI-O's sandbox state persistence allows attacker-influenced pod metadata to overwrite CRI-O's own reserved sandbox bookkeeping; once reloaded as trusted after a restart, a later container recreate in that sandbox can expose a host-side runtime-management resource inside...

Red Hat OpenShift input validation error vulnerability

Red Hat OpenShift has an input validation error vulnerability stemming from a trust boundary flaw in sandbox state persistence. Attackers can manipulate pod metadata to overwrite sandbox logging data maintained by CRI-O itself; upon restart, this data is reloaded as trusted information...

PT-2026-109677

A trust-boundary flaw in CRI-O's sandbox state persistence allows attacker-influenced pod metadata to overwrite CRI-O's own reserved sandbox bookkeeping; once reloaded as trusted after a restart, a later container recreate in that sandbox can expose a host-side runtime-management resource inside...

CVE-2026-75945

A race condition may cause a supplicant to remain in an authorized state after a clear dot1x host all command is issued...

CVE-2026-56818

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, the RedisArrayAggregator Redis codec clears retained partial aggregate state when the maxNestedArrayDepth limit is exceeded, but it does not clear the same state when the sibling...

Malicious code in boxy-maker-sticky (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc3701b8f91a045a21b2a07ba76082afea03e4aea2c9a87a1c1e40e2de88c3b0 On require of boxy-maker-sticky, index.js loads runtime.js which reconstructs C2 hostnames from split string fragments...

CVE-2026-65911

In DOMPurify through 3.3.3, function predicates supplied via ADDATTR or ADDTAGS to DOMPurify.sanitize persist in internal state EXTRAELEMENTHANDLING across subsequent sanitize calls on the same instance. If a later call on the same instance provides ADDATTR or ADDTAGS as an array rather than a...

CVE-2026-65902

DOMPurify before 3.4.7 passes direct references to the module-level DEFAULTALLOWEDTAGS and DEFAULTALLOWEDATTR sets to the uponSanitizeElement and uponSanitizeAttribute hooks via data.allowedTags / data.allowedAttributes when sanitize is called without an explicit cfg.ALLOWEDTAGS / cfg.ALLOWEDATTR...

EUVD-2026-48274

In DOMPurify through 3.3.3, function predicates supplied via ADDATTR or ADDTAGS to DOMPurify.sanitize persist in internal state EXTRAELEMENTHANDLING across subsequent sanitize calls on the same instance. If a later call on the same instance provides ADDATTR or ADDTAGS as an array rather than a...

Security Attack and Defense Strategies for Autonomous Agent Frameworks: A Layered Review with OpenClaw As a Case Study

Autonomous agent frameworks built upon large language models LLMs are evolving into complex, tool-integrated, and continuously operating systems, introducing security risks beyond traditional prompt-level vulnerabilities. As this paradigm is still at an early stage of development, a timely and...

Cross-site Request Forgery (CSRF)

fastapi-sso is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is due to missing persistence and verification of the OAuth state parameter, which allows an attacker to supply a malicious callback URL and link their account to a victim’s session...