GHSA-CRHJ-59GH-8X96 vulnerabilities

Vulnerabilities for packages: k9s, tfsec, teleport, argocd-image-updater, argo-cd, crossplane, gitea, pulumi, kots, goreleaser, scorecard, guac, osv-scanner, cerbos, argo-workflows, zarf, gptscript, pulumi-language-dotnet, argo-events, snyk-cli, pulumi-language-java, rancher-fleet, kubescape, apk...

CVE-2026-45571 vulnerabilities

Vulnerabilities for packages: k9s, tfsec, teleport, argocd-image-updater, argo-cd, crossplane, gitea, pulumi, kots, goreleaser, scorecard, guac, osv-scanner, cerbos, argo-workflows, zarf, gptscript, pulumi-language-dotnet, argo-events, snyk-cli, pulumi-language-java, rancher-fleet, kubescape, apk...

CVE-2026-45570 vulnerabilities

Vulnerabilities for packages: k9s, tfsec, teleport, argocd-image-updater, argo-cd, crossplane, gitea, pulumi, kots, goreleaser, scorecard, guac, osv-scanner, cerbos, argo-workflows, zarf, gptscript, pulumi-language-dotnet, argo-events, snyk-cli, pulumi-language-java, rancher-fleet, kubescape, apk...

GHSA-M7CR-M3PV-HGRP vulnerabilities

Vulnerabilities for packages: gitaly, dagger, xeol-fips, kyverno-fips, redpanda-console, argocd-image-updater, grafana-alloy, act, rancher-fleet, apko-fips, argo-cd, flux-fips, nuclei, kaniko, zot, packer-fips, external-secrets-operator, wolfictl, argo-events-fips, cerbos, xeol, trivy, gitea-fips...

GHSA-CRHJ-59GH-8X96 vulnerabilities

Vulnerabilities for packages: gitaly, dagger, xeol-fips, kyverno-fips, redpanda-console, argocd-image-updater, grafana-alloy, act, rancher-fleet, apko-fips, argo-cd, flux-fips, nuclei, kaniko, zot, packer-fips, external-secrets-operator, wolfictl, argo-events-fips, cerbos, xeol, trivy, gitea-fips...

kernel: Linux kernel: Use-after-free in traffic control (act_ct) may lead to denial of service or privilege escalation

A flaw was found in the Linux kernel. A use-after-free vulnerability exists in the traffic control actct path when it is incorrectly configured with non-ingress egress qdiscs queueing disciplines. This can allow a local user with specific privileges to trigger a kernel crash, leading to a denial ...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

In the Linux kernel, the following vulnerability has been resolved: net/usb: kalmia: Do not pass actlen in the usbbulkmsg error path. syzbot reported that actlen in kalmiasendinitpacket is uninitialized when it is passed to the first usbbulkmsg error path. Jiri Pirko noted that it’s pointless to...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: net/sched: actapi: avoid dereferencing ERRPTR in tcfidrinfodestroy. The syzbot reported a crash in tcactinHW during the netns teardown process. In this case, tcfidrinfodestroy passed a value of ERRPTR-EBUSY as a pointer to...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fixed the internal port memory leak. The flow rule can be split, and additional postact rules are added to the postact table. It’s possible to trigger a memory leak when the rule forwards packets from an internal port...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: veth: Ensure that the eth header is in the linear part of the skb structure. After feeding a decapsulated packet to a veth device using actmirred, skbheadlen might be set to 0. However, vethxmit calls devforwardskb, which expects...

Not What You Asked For: Typographic Attacks in Household Robot Manipulation

Open-vocabulary embodied AI agents increasingly rely on vision-language models such as CLIP for object perception and task grounding. However, the shared embedding space that enables this flexibility introduces a structural vulnerability to typographic attacks, where printed text in a physical...

DORA Compliance Cybersecurity Guide for Finance

DORA Compliance Cybersecurity: A Practical Guide for Financial Services Teams DORA compliance cybersecurity is now a board-level priority for banks, insurers, investment firms, payment providers, and the ICT providers that support them. The Digital Operational Resilience Act shifts the conversati...

CVE-2026-43577

OpenClaw before 2026.4.9 contains a file read vulnerability allowing attackers to bypass navigation guards through browser act/evaluate interactions. Attackers can pivot into the local CDP origin and create or read disallowed file:// pages despite direct navigation policy restrictions...

If a fake moustache can fool age checks, is the Online Safety Act working?

A report based on a survey by the UK’s Internet Matters shows that much of the responsibility for managing the online safety of children still falls on families. The Online Safety Act came into effect in July, 2025, and the report explores what has changed in the online lives of UK families since...

LuxSci Launches Enterprise-Grade HIPAA-Compliant Email Security for Mid-Sized Healthcare Organizations

Cambridge, MA, 5th May 2026, CyberNewswire...

kernel: Linux kernel: Use-after-free in traffic control (act_ct) may lead to denial of service or privilege escalation

A flaw was found in the Linux kernel. A use-after-free vulnerability exists in the traffic control actct path when it is incorrectly configured with non-ingress egress qdiscs queueing disciplines. This can allow a local user with specific privileges to trigger a kernel crash, leading to a denial ...

kernel: Linux kernel: Use-after-free in traffic control (act_ct) may lead to denial of service or privilege escalation

A flaw was found in the Linux kernel. A use-after-free vulnerability exists in the traffic control actct path when it is incorrectly configured with non-ingress egress qdiscs queueing disciplines. This can allow a local user with specific privileges to trigger a kernel crash, leading to a denial ...

CERTFR-2026-ACT-020

creationtimestamp| type| source ---|---|--- 2026-05-04 15:41:45+00:00| seen| https://bsky.app/profile/infosecfr.skyfleet.blue/post/3mkzz4cqpnu2p 2026-05-04 15:42:42+00:00| seen| https://bsky.app/profile/cert-fr.bsky.social/post/3mkzz5za2nx23 2026-05-04 15:42:46+00:00| seen|...

2026: The Year of AI-Assisted Attacks

On December 4, 2025, a 17-year-old was arrested in Osaka under Japan’s Unauthorized Access Prohibition Act. The young man had run malicious code to extract the personal data of over 7 million users of Kaikatsu Club, Japan's largest internet cafe chain. When asked, the young man shared his...

CVE-2026-31684

The CVE-2026-31684 issue is in the Linux kernel’s net/sched pathology (act_csum) where tcf_csum_act() reads nested VLAN headers directly from skb->data if the payload contains VLAN tags, and may read VLAN_HLEN bytes before guaranteeing the full header is present. The root cause is that the cod...