RHSA-2026:16701 Red Hat Security Advisory: container-tools:rhel8 security update

Bulletin has no description...

Important: Red Hat Security Advisory: container-tools:rhel8 security update

An update for the container-tools:rhel8 module is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common...

RHEL 8 : container-tools:rhel8 (RHSA-2026:16701)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:16701 advisory. The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fixes:...

DEBIAN-CVE-2026-44301

Hugo is a static site generator. From 0.43 to before 0.161.0, when building a Hugo site that uses Node-based asset pipelines PostCSS, Babel, TailwindCSS, Hugo invoked the configured Node tools without restrictions on file system access. As a result, executing hugo against an untrusted site could...

CVE-2026-44301

Hugo is a static site generator. From 0.43 to before 0.161.0, when building a Hugo site that uses Node-based asset pipelines PostCSS, Babel, TailwindCSS, Hugo invoked the configured Node tools without restrictions on file system access. As a result, executing hugo against an untrusted site could...

CVE-2026-44301

Hugo is a static site generator. From 0.43 to before 0.161.0, when building a Hugo site that uses Node-based asset pipelines PostCSS, Babel, TailwindCSS, Hugo invoked the configured Node tools without restrictions on file system access. As a result, executing hugo against an untrusted site could...

CVE-2026-44301 Hugo: Node tool execution allows file system access outside the project directory

Hugo is a static site generator. From 0.43 to before 0.161.0, when building a Hugo site that uses Node-based asset pipelines PostCSS, Babel, TailwindCSS, Hugo invoked the configured Node tools without restrictions on file system access. As a result, executing hugo against an untrusted site could...

CVE-2026-44301 Hugo: Node tool execution allows file system access outside the project directory

Hugo is a static site generator. From 0.43 to before 0.161.0, when building a Hugo site that uses Node-based asset pipelines PostCSS, Babel, TailwindCSS, Hugo invoked the configured Node tools without restrictions on file system access. As a result, executing hugo against an untrusted site could...

CVE-2026-44301

Hugo (static site generator) versions 0.43 through 0.160.x are vulnerable when building a site that uses Node-based asset pipelines (PostCSS, Babel, TailwindCSS). The vulnerability arises because Hugo invoked the configured Node tools without restrictions on file system access, potentially allowi...

CVE-2026-44301

Hugo is a static site generator. From 0.43 to before 0.161.0, when building a Hugo site that uses Node-based asset pipelines PostCSS, Babel, TailwindCSS, Hugo invoked the configured Node tools without restrictions on file system access. As a result, executing hugo against an untrusted site could...

CVE-2026-44301

Hugo is a static site generator. From 0.43 to before 0.161.0, when building a Hugo site that uses Node-based asset pipelines PostCSS, Babel, TailwindCSS, Hugo invoked the configured Node tools without restrictions on file system access. As a result, executing hugo against an untrusted site could...

com.gantzgulch.tools:gantzgulch-tools-http (>=1.0.4, <=1.0.27), org.apache.geode:geode-modules-tomcat8 (>=1.0.0-incubating, <=1.1.1) +6 more potentially affected by CVE-2026-43512 via org.apache.tomcat:tomcat-catalina (8.5.4)

org.apache.tomcat:tomcat-catalina MAVEN version 8.5.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - com.gantzgulch.tools:gantzgulch-tools-http =1.0.4, =1.0.0-incubating, =3.2-rc1, =3.2-rc1,...

com.gantzgulch.tools:gantzgulch-tools-http (>=1.0.4, <=1.0.27), org.apache.geode:geode-modules-tomcat8 (>=1.0.0-incubating, <=1.1.1) +6 more potentially affected by CVE-2026-42498 via org.apache.tomcat:tomcat-catalina (8.5.4)

org.apache.tomcat:tomcat-catalina MAVEN version 8.5.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - com.gantzgulch.tools:gantzgulch-tools-http =1.0.4, =1.0.0-incubating, =3.2-rc1, =3.2-rc1,...

harmonai-tools (0.0.5), neuralprophet (>=0.5.0rc1, <=0.5.1) +1 more potentially affected by CVE-2026-31221 via pytorch-lightning (1.7.4)

pytorch-lightning PYPI version 1.7.4 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - harmonai-tools 0.0.5 - neuralprophet =0.5.0rc1, =1.0.2, =1.0.4 Source cves: CVE-2026-31221 Source advisory:...

com.gantzgulch.tools:gantzgulch-tools-http (>=1.0.28, <=1.0.31), org.apache.kylin:kylin-spark-classloader (4.0.4) +3 more potentially affected by CVE-2026-43514 via org.apache.tomcat:tomcat-catalina (8.5.86)

org.apache.tomcat:tomcat-catalina MAVEN version 8.5.86 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - com.gantzgulch.tools:gantzgulch-tools-http =1.0.28, =1.0.31 -...

CVE-2026-43992 JunoClaw: MCP write tools exposed raw BIP-39 mnemonic as a tool-call parameter

JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, every MCP write tool sendtokens, executecontract, instantiatecontract, uploadwasm, ibctransfer, etc. accepted 'mnemonic: string' as an explicit tool-call parameter. The BIP-39 seed was consequently embedded in th...

CVE-2026-43992 JunoClaw: MCP write tools exposed raw BIP-39 mnemonic as a tool-call parameter

JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, every MCP write tool sendtokens, executecontract, instantiatecontract, uploadwasm, ibctransfer, etc. accepted 'mnemonic: string' as an explicit tool-call parameter. The BIP-39 seed was consequently embedded in th...

CVE-2026-43992

The CVE describes a vulnerability in JunoClaw where, prior to version 0.x.y-security-1, MCP write tools (send_tokens, execute_contract, instantiate_contract, upload_wasm, ibc_transfer, etc.) accepted a mnemonic: string parameter, causing the BIP-39 seed to be embedded in the LLM tool-call JSON. T...

Undermining the trust boundary: Investigating a stealthy intrusion through third-party compromise

In this article 1. Abuse of trusted relationships as an attack delivery mechanism 2. Methods, tools, and access strategies 3. Campaign conclusion 4. Microsoft Defender detection and hunting guidance In recent years, many sophisticated intrusions have increasingly avoided using noisy exploits,...

State-sponsored actors, better known as the friends you don’t want

State-sponsored actors don't break in. They log in, and they use your own tools to stay invisible for months. Responding to a state-sponsored threat is nothing like responding to ransomware, and the differences can make or break the outcome. From logging and baselines to OT segmentation and suppl...