CVE-2026-53131

In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using ethhdr ip6teui64, xtmac, the bitmap:ip,mac, hash:ip,mac, and hash:mac ipset types, and nflogsyslog access ethhdrskb after either assuming that the skb is associated with an...

Important: Red Hat Security Advisory: Red Hat OpenShift API for Data Protection

A new version of OpenShift API for Data Protection OADP is now available. OpenShift API for Data Protection OADP enables you to back up and restore application resources, persistent volume data, and internal container images to external backup storage. OADP enables both file system-based and...

CVE-2026-12245

NSD from version 4.13.0 has a heap use-after-free bug in logging errors on TLS connections, causing a crash of the server process, which can be triggered trivially by sending a DNS query over a DoT connection, and closing the connection without reading the response...

MAL-2026-6442 Malicious code in easy-time-format (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20b7b165f80957e2b2c8484fe6a51c4c4354727dadd36a51c39265f58e916935 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Improper Authorization

Apache DolphinScheduler is vulnerable to Improper Authorization. The vulnerability is due to incorrect authorization checks when deleting task definitions, where users with valid system login privileges can delete task definitions in projects they are not authorized to manage...

CVE-2026-8658

OS Command Injection vulnerability in Rapid7 InsightConnect Tcpdump Plugin on Linux allows authenticated attackers to execute arbitrary OS commands via the options or filter parameters due to insufficient input sanitization in shell command construction...

postgresql: PostgreSQL: Arbitrary code execution vulnerability in 'refint' module

A flaw was found in PostgreSQL. A stack buffer overflow in the 'refint' module allows an unprivileged database user to execute arbitrary code as the operating system user running the database. Additionally, a separate vulnerability exists where, if an application uses a user-controlled column as ...

postgresql: PostgreSQL: Operating system account hijack via symlink following in pg_basebackup and pg_rewind

A flaw was found in PostgreSQL. This vulnerability, related to symlink following in pgbasebackup plain format and pgrewind, allows an origin superuser to overwrite local files. By exploiting this, an attacker could potentially hijack the operating system account. This attack has practical...

SUSE CVE-2026-52923

In the Linux kernel, the following vulnerability has been resolved: ipc: limit nextid allocation to the valid ID range The checkpoint/restore sysctl path can request the next SysV IPC id through ids-nextid. ipcidralloc currently forwards that request to idralloc with an open-ended upper bound. If...

SUSE CVE-2026-53614

unknown...

CVE-2026-55388 vulnerabilities

Vulnerabilities for packages: kubeflow-katib, kibana, drupal...

GHSA-J3RV-43J4-C7QM vulnerabilities

Vulnerabilities for packages: spark-kubernetes-operator, zipkin, geoserver, spark-kubernetes-operator-fips, scala, ruby3.3-jrjackson, apache-pulsar-fips, trino, s3proxy-fips, keycloak-fips, elasticsearch-fips, confluent-common-docker, hadoop-client-modules, zookeeper,...

CVE-2026-8660

OS Command Injection vulnerability in the ping action of Rapid7 InsightConnect Ping Plugin on Linux allows remote attackers to execute arbitrary OS commands via the host parameter due to insufficient input validation when constructing shell commands...

CVE-2026-8664

OS Command Injection vulnerability in Rapid7 InsightConnect Finger Plugin on Linux allows authenticated attackers to execute arbitrary OS commands via the user or host parameters due to insufficient input validation in shell command construction...

CVE-2026-54512 vulnerabilities

Vulnerabilities for packages: apache-tika, trino, airflow, jenkins-plugin-manager, kserve-modelmesh, thingsboard, zookeeper, wavefront-proxy, confluent-common-docker, infinispan, kafka, ruby3.3-jrjackson, druid, zipkin, opensearch, apicurio-registry, logstash, spark, neo4j, keycloak, jenkins,...

GHSA-J3RV-43J4-C7QM vulnerabilities

Vulnerabilities for packages: apache-tika, trino, airflow, jenkins-plugin-manager, kserve-modelmesh, thingsboard, zookeeper, wavefront-proxy, confluent-common-docker, infinispan, kafka, ruby3.3-jrjackson, druid, zipkin, opensearch, apicurio-registry, logstash, spark, neo4j, keycloak, jenkins,...

Malicious code in @su-doughnym/loginui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5768349705baa7b448fddb22d17412ce7befdaedd68b2e91a452eb6521e0bc66 Package self-identifies as a HubSpot dependency-confusion proof-of-concept and is published at version 99.99.99 — a typical high-version-pin used to...

Malicious code in two-factor-prompt-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95ebb96758f051c0a5a1c8fe97fb05c898f2489f4567fb64fbd271eb103dcadc Package self-identifies as a dependency-confusion proof-of-concept aimed at an internal/private package name. The postinstall script postinstall.js...

CVE-2026-44168

A flaw was found in MariaDB. During a State Snapshot Transfer SST, the donor node improperly validates parameters sent by a joiner node. This vulnerability allows a malicious joiner to execute arbitrary shell commands on the donor server through the mariabackup SST method. This could lead to a...

CVE-2026-8658

CVE-2026-8658 describes an OS Command Injection in the Rapid7 InsightConnect Tcpdump Plugin running on Linux, caused by insufficient input sanitization during shell command construction. The vulnerability affects the plugin’s handling of options and filter parameters, allowing an authenticated at...