EUVD-2026-108888

In the Linux kernel, the following vulnerability has been resolved: fs: avoid repeated scans in evictinodes We observed hung tasks when users attempted to unmount a filesystem after its disk had been removed while still in use. During device removal, fsbdevmarkdead calls evictinodes while holding...

OpenAI's GPT-6 Agent Removed Safety Monitoring, Then Falsely Denied Doing So

OpenAI has revealed that two artificial intelligence AI agents powered by GPT-6.1 Sol and GPT-6 Astra weakened misalignment monitoring while making requested software changes during two internal coding tasks. The AI company said the incident took place on October 3 and 6, 2026, for Sol and Astra,...

CVE-2026-104355

A flaw was found in Temporal Server. In a multi-cluster deployment, the server fails to verify whether inbound replication tasks apply only to global namespaces. An attacker controlling a connected peer cluster can exploit this vulnerability by sending replication updates that overwrite...

pupy

Pupy Simple Installation pip3 install pipx pipx ensurepath pipx install git+https://github.com/n1nj4sec/pupy@nextgen pupysh If you want more detailed informationRefer to the wiki Development Install git clone https://github.com/n1nj4sec/pupy cd pupy git checkout nextgen git submodule init git...

CVE-2026-114066

Trigger.dev before 4.7.0 contains a missing authorization vulnerability that allows holders of unrestricted environment API keys to block runs they do not own by supplying a foreign parentRunId to batch-creation endpoints. Attackers can send requests to POST /api/v3/batches or POST...

EUVD-2026-107017

Trigger.dev before 4.7.0 contains a missing authorization vulnerability that allows holders of unrestricted environment API keys to block runs they do not own by supplying a foreign parentRunId to batch-creation endpoints. Attackers can send requests to POST /api/v3/batches or POST...

Linux Distros Unpatched Vulnerability : CVE-2026-81856

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in hexpm hex allows a malicious package publisher or a hostile repository server to...

CVE-2026-111767 MCP TypeScript SDK: Experimental tasks were not tied to the session that created them

MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.24.0 to before version 1.32.0, the experimental tasks feature taskStore did not check which session created a task. Clients sharing one InMemoryTaskStore could list, read and cancel ea...

CVE-2026-111767 MCP TypeScript SDK: Experimental tasks were not tied to the session that created them

MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.24.0 to before version 1.32.0, the experimental tasks feature taskStore did not check which session created a task. Clients sharing one InMemoryTaskStore could list, read and cancel ea...

CVE-2026-111767

The MCP TypeScript SDK (@modelcontextprotocol/sdk) versions 1.24.0 through 1.31.0 are vulnerable due to a flaw in the experimental taskStore feature. The root cause is that tasks were not tied to specific sessions, allowing clients sharing a single InMemoryTaskStore to unauthorizedly list, read, ...

EUVD-2026-105256

MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.24.0 to before version 1.32.0, the experimental tasks feature taskStore did not check which session created a task. Clients sharing one InMemoryTaskStore could list, read and cancel ea...

MCP TypeScript SDK: Experimental tasks were not tied to the session that created them

Summary In affected versions, the experimental tasks feature taskStore did not check which session created a task. Clients sharing one InMemoryTaskStore could list, read and cancel each other's tasks. Experimental tasks are deprecated. The 2026-07-28 specification replaced them with a redesigned...

GHSA-22JM-H49P-29QW MCP TypeScript SDK: Experimental tasks were not tied to the session that created them

Summary In affected versions, the experimental tasks feature taskStore did not check which session created a task. Clients sharing one InMemoryTaskStore could list, read and cancel each other's tasks. Experimental tasks are deprecated. The 2026-07-28 specification replaced them with a redesigned...

PT-2026-118611

Name of the Vulnerable Software and Affected Versions @modelcontextprotocol/sdk versions 1.24.0 through 1.31.0 Description The experimental tasks feature taskStore fails to verify which session created a specific task. Consequently, clients sharing a single InMemoryTaskStore can list, read, and...

CVE-2026-112291

Flarum Extension Manager 2.0.0-beta.1 before 2.0.0-beta.8 lacks authentication and admin checks on the TaskResource index endpoint, allowing unauthenticated information disclosure. Remote attackers can send GET requests to /api/extension-manager-tasks to read task output revealing filesystem path...

EUVD-2026-104282

Flarum Extension Manager 2.0.0-beta.1 before 2.0.0-beta.8 lacks authentication and admin checks on the TaskResource index endpoint, allowing unauthenticated information disclosure. Remote attackers can send GET requests to /api/extension-manager-tasks to read task output revealing filesystem path...

UBUNTU-CVE-2026-98800

In the Linux kernel, the following vulnerability has been resolved: bpf: Wait for an RCU tasks grace period before freeing trampoline progs When a prog is detached from a trampoline, it is freed after an RCU grace period, or an RCU tasks trace one if it is sleepable. This covers the tasks that ar...

UBUNTU-CVE-2026-98536

In the Linux kernel, the following vulnerability has been resolved: writeback: report a Tasks-RCU quiescent state per cgwb drain pass cleanupofflinecgwbsworkfn drains a dying cgwb by calling cleanupofflinecgwb until it returns false, with a condresched between passes. On a CONFIGPREEMPTION kernel...

CVE-2026-112291: Missing Authorization

Flarum Extension Manager 2.0.0-beta.1 before 2.0.0-beta.8 lacks authentication and admin checks on the TaskResource index endpoint, allowing unauthenticated information disclosure. Remote attackers can send GET requests to /api/extension-manager-tasks to read task output revealing filesystem path...

CVE-2026-98536

In the Linux kernel, the following vulnerability has been resolved: writeback: report a Tasks-RCU quiescent state per cgwb drain pass cleanupofflinecgwbsworkfn drains a dying cgwb by calling cleanupofflinecgwb until it returns false, with a condresched between passes. On a CONFIGPREEMPTION kernel...