EUVD-2026-43177

PraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofing...

clawk

コーディングエージェントに、あなたのマシンではなく、専用の使い捨てLinuxマシンを与えましょう。 -lightgrey インストール · クイックスタート · なぜVMなのか？ · 仕組み · 比較 · FAQ · ドキュメント コーディングエージェントは、実際に 何かを実行させる...

CVE-2026-79960 Gitea deploy key pushes acting as the repository owner

When a push was authenticated with a deploy key, Gitea recorded the repository owner as the pusher, so permission checks in the push hook pipeline evaluated the owner instead of the deploy key. A holder of a writable deploy key could create protected tags without being on the tag allow list and...

Important: Red Hat Security Advisory: grafana security update

An update for grafana is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default

A flaw in Grafana's Auth Proxy IPv6 allow-list incorrectly defaults to a broad /32 subnet mask instead of a strict /128. This misconfiguration allows remote attackers to bypass access restrictions, potentially leading to unauthorized access and data manipulation...

grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default

A flaw in Grafana's Auth Proxy IPv6 allow-list incorrectly defaults to a broad /32 subnet mask instead of a strict /128. This misconfiguration allows remote attackers to bypass access restrictions, potentially leading to unauthorized access and data manipulation...

cve-2026-22874-gitea-ssrf-allowlist

CVE-2026-22874 — Gitea Webhook 和迁移白名单中不完整的 SSRF 防护 CVE-2026-22874 GHSA-2r5c-gw76-rh3w 的技术说明和参考资料：Gitea 的 Webhook 投递和仓库迁移中存在不完整的 SSRF 白名单，已在 Gitea 1.26.3 中修复。 我独立向 Gitea 维护者报告了这一 SSRF 类别，并在已发布的公告中被列为贡献者 other；公告的主要报告者是 J. Leitschuh。本仓库是公开公告的防御性、教育性说明——该问题已修复。...

Rocky Linux 9 [CIQ] Security Update: grafana / grafana-debuginfo / grafana-debugsource / grafana-selinux Multiple Vulnerabilities (crlsa-2026_58982)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202658982 advisory. grafana: Grafana: Privilege escalation via dashboard overwrite CVE-2026-33377 grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6...

Internationalized Domain Name Validation

Nodemailer is vulnerable to an internationalized domain name validation/bypass. The vulnerability is due to inconsistent Punycode A-label generation, which allows an attacker to craft recipient addresses containing invisible characters or compatibility mappings to bypass domain allow-list checks...

pki-core security update

11.7.1-2.0.1 - Replaced upstream graphical references Orabug: 33952704 11.7.0-2 - RHEL-245465 CVE-2026-76561 pki-core: ExternalProcessConstraint executable allow-list - RHEL-248586 CVE-2026-80110 pki-core: ACLFilter sort order fix...

AlmaLinux 9.2 [TuxCare] Security Update: grafana Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1781093705)

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1781093705 advisory. - When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are...

dogtag-pki security update

11.9.0-5.0.1 - Treat Oracle Linux the same as RHEL when selecting the Tomcat app server version. 11.9.0-5 - RHEL-245469 CVE-2026-76561 dogtag-pki: ExternalProcessConstraint executable allow-list - RHEL-248585 CVE-2026-80110 dogtag-pki: ACLFilter sort order fix...

Rocky Linux 9.6 [TuxCare] Security Update: grafana / grafana-selinux Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1781253433)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1781253433 advisory. - When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly a...

AlmaLinux 9.6 [TuxCare] Security Update: grafana / grafana-selinux Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1781253433)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1781253433 advisory. - When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are...

Oracle Linux 9 : pki-core (ELSA-2026-73766)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-73766 advisory. - RHEL-245465 CVE-2026-76561 pki-core: ExternalProcessConstraint executable allow-list Tenable has extracted the preceding description block directly...

Linux Distros Unpatched Vulnerability : CVE-2026-100663

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty's HTTP/3 codec io.netty:netty-codec-http3 from 4.2.2.Final through 4.2.17.Final does not special- case HTTP/1 CONNECT authority-form request-targets when...

CVE-2026-100663

Netty's HTTP/3 codec io.netty:netty-codec-http3 from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1 CONNECT authority-form request-targets when converting HTTP/1 messages to HTTP/3 in HttpConversionUtil.toHttp3Headers. The authority-form target e.g., "CONNECT trusted.example:443" i...

CVE-2026-100663

Netty's HTTP/3 codec (io.netty:netty-codec-http3 ) versions 4.2.2.Final through 4.2.17.Final are vulnerable to a request smuggling or bypass issue in HttpConversionUtil.toHttp3Headers. The root cause is the failure to special-case HTTP/1 CONNECT authority-form request-targets during HTTP/1-to-HTT...

CVE-2026-100663: Improper Input Validation

Netty's HTTP/3 codec io.netty:netty-codec-http3 from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1 CONNECT authority-form request-targets when converting HTTP/1 messages to HTTP/3 in HttpConversionUtil.toHttp3Headers. The authority-form target e.g., "CONNECT trusted.example:443" i...

Linux Distros Unpatched Vulnerability : CVE-2026-94301

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The fix for CVE-2026-47065/ZDRES-232 resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy, released on 2026-06-02 and...