CVE-2026-18773

The vulnerability CVE-2026-18773 affects the NousResearch Hermes-Agent up to version 2026.6.5. The flaw resides in the Quick Command Handler’s file gateway/run.py, within the function _check_slash_access, leading to incorrect authorization. This enables a remote attacker to exploit the issue (exp...

CLSA-2026-1784596325 TuxCare security update for ua-parser-js (2 CVEs)

TuxCare rebuilt ua-parser-js to address 2 CVEs. Fixed in 0.7.22-tuxcare.1...

CLSA-2026-1776904630 TuxCare security update for https-proxy-agent (19 CVEs)

TuxCare rebuilt https-proxy-agent to address 19 CVEs. Fixed in 1.0.0-tuxcare.1...

CLSA-2026-1773274561 TuxCare security update for tunnel-agent (17 CVEs)

TuxCare rebuilt tunnel-agent to address 17 CVEs. Fixed in 0.3.0-tuxcare.1...

MAL-2026-11613 Malicious code in @onereach/or-sdk-agent-cli (npm)

npm/@onereach/or-sdk-agent-cli is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in @onereach/or-sdk-agent-cli (npm)

npm/@onereach/or-sdk-agent-cli is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

CVE-2026-66883

Improper Handling of Case Sensitivity vulnerability in Erlang Ecosystem Foundation oidccplug Oidcc.Plug.Authorize module renders the user agent session binding inert, removing a defense in depth control against replay of a stolen session. This vulnerability is associated with program files...

EEF-CVE-2026-66883 Oidcc.Plug.Authorize user agent session binding inert due to case-sensitive header lookup

Summary Improper Handling of Case Sensitivity vulnerability in Erlang Ecosystem Foundation oidcc\plug Oidcc.Plug.Authorize module renders the user agent session binding inert, removing a defense in depth control against replay of a stolen session. This vulnerability is associated with program fil...

CVE-2026-66883 Oidcc.Plug.Authorize user agent session binding inert due to case-sensitive header lookup

Improper Handling of Case Sensitivity vulnerability in Erlang Ecosystem Foundation oidccplug Oidcc.Plug.Authorize module renders the user agent session binding inert, removing a defense in depth control against replay of a stolen session. This vulnerability is associated with program files...

CVE-2026-66883 Oidcc.Plug.Authorize user agent session binding inert due to case-sensitive header lookup

Improper Handling of Case Sensitivity vulnerability in Erlang Ecosystem Foundation oidccplug Oidcc.Plug.Authorize module renders the user agent session binding inert, removing a defense in depth control against replay of a stolen session. This vulnerability is associated with program files...

CVE-2026-66883

OIDCC_Plugin: The vulnerability CVE-2026-66883 affects oidcc_plug (Oidcc.Plug.Authorize) where get_req_header(conn, "User-Agent") is matched case-sensitively, causing the user-agent binding to be inert and bypassable across requests. As a result, the binding check can pass unconditionally, even w...

golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions

A flaw was found in golang.org/x/crypto/ssh/agent. When a key was added to a remote agent, security restrictions, known as constraint extensions, were not properly processed during the request. This allowed these restrictions to be silently removed when keys were forwarded, leading to the...

Amazon Linux 2 : amazon-cloudwatch-agent, --advisory ALAS2-2026-3844 (ALAS-2026-3844)

The version of amazon-cloudwatch-agent installed on the remote host is prior to 1.300069.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3844 advisory. x509.Certificate.VerifyHostname previously called matchHostnames in a loop over all DNS Subject...

RHEL 9 : Satellite 6.17.10 Async Update (Important) (RHSA-2026:50222)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:50222 advisory. Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity t...

SUSE SLES12 Security Update : google-guest-agent (SUSE-SU-2026:3439-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3439-1 advisory. This update for google-guest-agent fixes the following issues - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only...

SUSE-SU-2026:23051-1 Security update for google-guest-agent

This update for google-guest-agent fixes the following issues - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266603. - CVE-2026-56852: golang.org/x/text/unicode/norm: improper handling of inpu...

Security update for google-cloud-sap-agent

This update for google-cloud-sap-agent fixes the following issue: CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266604. Changes for google-cloud-sap-agent: Update golang.org/x/net to v0.57.0...

SUSE-SU-2026:3472-1 Security update for google-cloud-sap-agent

This update for google-cloud-sap-agent fixes the following issue: - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266604. Changes for google-cloud-sap-agent: - Update golang.org/x/net to v0.57....

Security update for google-cloud-sap-agent

This update for google-cloud-sap-agent fixes the following issue: CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266604. Changes for google-cloud-sap-agent: Update golang.org/x/net to v0.57.0...

SUSE-SU-2026:3471-1 Security update for google-cloud-sap-agent

This update for google-cloud-sap-agent fixes the following issue: - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266604. Changes for google-cloud-sap-agent: - Update golang.org/x/net to v0.57....