RHSA-2026:6191 Red Hat Security Advisory: container-tools:rhel8 security update

Bulletin has no description...

Ransomware in 2025: Blending in is the strategy

Ransomware attacks aren't smash-and-grab anymore. They're built on access that already looks legitimate -- closer to positioning chess pieces than breaking the door down. That's the big trend that comes through in the ransomware data from the Talos 2025 Year in Review. Once attackers have initial...

CVE-2026-33762 vulnerabilities

Vulnerabilities for packages: kargo, trivy-operator, grafana-alloy, argo-workflows, kubevela, tfsec, kyverno, flux, pulumi, kaniko, bom, teleport, witness, src-fingerprint, gitlab-runner, osv-scanner, skaffold, chezmoi, argo-events, zot, kubescape, steampipe, syft, kots, cerbos, k9s, rancher-flee...

image-builder (>=0.1.1rc0, <=0.2.0), shortesttrack-sdk (>=1.2.0rc1, <=1.4.1) +1 more potentially affected by CVE-2026-34073 via cryptography (2.2.1)

cryptography PYPI version 2.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - image-builder =0.1.1rc0, =1.2.0rc1, =0.0.3a0, =0.1.10 Source cves: CVE-2026-34073 Source advisory: OSV:PYSEC-2026-35...

a-beta-scalekit (>=2.3.0, <=4.0.2), agixt (>=1.7.3, <=1.7.11) +119 more potentially affected by CVE-2026-34073 via cryptography (44.0.1)

cryptography PYPI version 44.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - a-beta-scalekit =2.3.0, =1.7.3, =1.1.3, =0.7.1, =0.0.85, =0.0.1.1, =1.0.754, =0.1.0, =1.3.0, =0.24.0, =0.27.0 and more Source cves:...

agent-api-server (>=2.1.7, <=2.1.13), agentc-langchain (1.0.0) +5 more potentially affected by CVE-2026-34070 via langchain-core (0.3.76)

langchain-core PYPI version 0.3.76 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - agent-api-server =2.1.7, =0.0.2, =0.3.0, =1.0.0rc1, =0.0.91, =0.0.118 Source cves: CVE-2026-34070 Source advisory: OSV:PYSEC-2026-2...

codemie-tools (>=0.1.13.8, <=0.1.14.0), opendsstar (>=1.0.0, <=1.0.17) potentially affected by CVE-2026-34070 via langchain-core (0.3.83)

langchain-core PYPI version 0.3.83 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - codemie-tools =0.1.13.8, =1.0.0, =1.0.17 Source cves: CVE-2026-34070 Source advisory: OSV:PYSEC-2026-2193...

codemie-tools (>=0.0.405, <=0.1.13.7), knowai (>=0.3.0, <=0.6.0) +2 more potentially affected by CVE-2026-34070 via langchain-core (0.3.67)

langchain-core PYPI version 0.3.67 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - codemie-tools =0.0.405, =0.3.0, =0.6.0 - mcp-validator 0.1.1 - trim-sdk 0.2.2 Source cves: CVE-2026-34070 Source advisory:...

codemie-tools (>=0.0.352, <=0.0.404), syntera-ai (0.1.3) +1 more potentially affected by CVE-2026-34070 via langchain-core (0.3.60)

langchain-core PYPI version 0.3.60 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - codemie-tools =0.0.352, =0.2.8, =0.4.3 Source cves: CVE-2026-34070 Source advisory: OSV:PYSEC-2026-2193...

[SECURITY] Fedora 44 Update: xen-4.21.1-1.fc44

This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor...

[SECURITY] Fedora 44 Update: bind-9.18.47-1.fc44

BIND Berkeley Internet Name Domain is an implementation of the DNS Domain Name System protocols. BIND includes a DNS server named, which resolves host names to IP addresses; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server ...

Claude SDK for Python security vulnerabilities

Claude SDK for Python is an open-source Python software development toolkit developed by Anthropic for calling the Claude API. Versions of Claude SDK for Python prior to 0.87.0 contained a security vulnerability. This vulnerability stemmed from improper file permission settings created by memory...

PT-2026-29398

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, there is a defect in LUT dump/iteration logic affecting CIccCLUT::Iterate and output produced by CIccMBB::Describe via CLUT dumping. This issue has been patched in version 2.3.1....

CVE-2026-34163: Server-Side Request Forgery (SSRF)

FastGPT is an AI Agent building platform. Prior to version 4.14.9.5, FastGPT's MCP Model Context Protocol tools endpoints /api/core/app/mcpTools/getTools and /api/core/app/mcpTools/runTool accept a user-supplied URL parameter and make server-side HTTP requests to it without validating whether the...

CVE-2026-34200: Missing Authentication for Critical Function

Nhost is an open source Firebase alternative with GraphQL. Prior to version 1.41.0, The Nhost CLI MCP server, when explicitly configured to listen on a network port, applies no inbound authentication and does not enforce strict CORS. This allows a malicious website visited on the same machine to...

Linux Distros Unpatched Vulnerability : CVE-2025-66037

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, feeding a crafted input to the fuzzpkcs15reader harness causes OpenSC to...

CVE-2025-49010

OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, an attacker with physical access to the computer at the time user or administrator uses a token can cause a stack-buffer-overflow write in GET RESPONSE. The attack requires crafted USB device or smart card that wou...

CVE-2025-66215

OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, an attacker with physical access to the computer at the time user or administrator uses a token can cause a stack-buffer-overflow WRITE in card-oberthur. The attack requires crafted USB device or smart card that...

Wave Browser Brings Gaming Tools and Ocean Cleanup into the Same Tab

Wave Browser for gaming: built for multitasking, streaming, and tabs, with tools for gamers plus ocean cleanup support tied to everyday browsing activity...

Server-side Request Forgery (SSRF)

Overview crewai-tools is a Set of tools for the crewAI framework Affected versions of this package are vulnerable to Server-side Request Forgery SSRF due to the RAG search tools not properly validating user-supplied URLs at runtime. An attacker can access internal or cloud resources by supplying...