CVE-2026-74338

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF subsystem. A local attacker could bypass security checks by directly using the bpf2 system call to load a sleepable BPFLSMCGROUP program. This could lead to a kernel crash, resulting in a Denial of Service DoS on the affected syste...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.18.53 security and extras update

Red Hat OpenShift Container Platform release 4.18.53 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.18. Red Hat Product Security has rated this update as having a security impact of...

SilkParasite Espionage Campaign Targets Central Asian Governments with Five New RATs

A previously unreported cyber espionage operation dubbed SilkParasite has been observed targeting government bodies in Central Asia. The intrusion set makes use of seven remote access tool RAT families, five of which have never been previously documented: DriveSilkRAT, CookiETagRAT, NomadRAT,...

popt-devel: popt-static: Off-by-one in poptStuffArgs

A flaw was found in popt, a command-line option parsing library. An off-by-one error in the poptStuffArgs function, when repeatedly called by a host application or through deep alias nesting, can lead to corruption of internal program data. This corruption could potentially enable a local attacke...

CVE-2026-74305

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF subsystem. This vulnerability allows a program without cgroup storage to bypass compatibility checks when bridging tail call chains. This could enable unintended interactions between programs with and without cgroup storage,...

OASAS

OASAS - Offensive Automation & Scope-Aware Suite Very p...

Exploit for Deserialization of Untrusted Data in Apache Activemq

CVE-2023-46604 – Apache ActiveMQ Remote Code Execution Ove...

NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19489 and CVE-2026-19490

Multiple vulnerabilities have been discovered in NetScaler ADC formerly Citrix ADC and NetScaler Gateway formerly Citrix Gateway. Refer below for further details. The information on this page is being provided to you on an "AS IS" and "AS-AVAILABLE" basis. The issues described on this page may or...

PYSEC-2026-3680 Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs

Summary The ACME client used to issue certificates from Let's Encrypt / Google Public CA / private ACME CAs connects to an acmeurl, then issues requests to URLs that the ACME server returns in its directory/order/authorization/finalize responses - this is the classic ACME-client SSRF RFC 8555...

PYSEC-2026-3678 Lemur: Any user can revoke arbitrary certificates at the CA by uploading a duplicate record and revoking it

Summary Repo under test: https://github.com/Netflix/lemur PUT /api/1/certificates//revoke authorizes the caller against the Lemur database row creator == current user, or CertificatePermission over the row's roles rather than the underlying CA-side certificate identity. Separately, POST...

PYSEC-2026-3682 linuxfabrik-lib: Arbitrary root file read via live --test argument (lib.lftest) across sudoers-whitelisted plugins (LPE)

Summary Every Linuxfabrik check plugin that supports the shared --test argument routed through lib.lftest.test will, when --test is supplied, treat the first CSV element as a filesystem path and read its full contents as the plugin's simulated STDOUT — running as root when the plugin is invoked...

devpi-server may leak database contents

ImpactIf the replication protocol is enabled by using the primary or deprecated master role for a server instance, then the +changelog URL route can be used to read the complete database content including password hashes, and the ids and salts of tokens from devpi-tokens by using a trivially...

linuxfabrik-lib: Arbitrary root file read via live --test argument (lib.lftest) across sudoers-whitelisted plugins (LPE)

SummaryEvery Linuxfabrik check plugin that supports the shared --test argument routed through lib.lftest.test will, when --test is supplied, treat the first CSV element as a filesystem path and read its full contents as the plugin's simulated STDOUT — running as root when the plugin is invoked...

Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for GHSA-54vg-pfh7-jq95)

SummaryThe SSRF mitigation added for GHSA-54vg-pfh7-jq95 validaterevocationurl in lemur/certificates/verify.py can be bypassed. An operator-role user who uploads a certificate with attacker-controlled CRL/OCSP extensions can still make Lemur reach internal destinations RFC1918, loopback, link-loc...

Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs

SummaryThe ACME client used to issue certificates from Let's Encrypt / Google Public CA / private ACME CAs connects to an acmeurl, then issues requests to URLs that the ACME server returns in its directory/order/authorization/finalize responses - this is the classic ACME-client SSRF RFC 8555...

PYSEC-2026-3676 Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for GHSA-54vg-pfh7-jq95)

Summary The SSRF mitigation added for GHSA-54vg-pfh7-jq95 validaterevocationurl in lemur /certificates/verify.py can be bypassed. An operator-role user who uploads a certificate with attacker-controlled CRL/OCSP extensions can still make Lemur reach internal destinations RFC1918, loopback,...

PYSEC-2026-3679 Lemur: Incomplete fix for GHSA-v2wp-frmc-5q3v -- ACME authority update endpoint allows non-admin to replace `acme_url` with internal IP, bypassing allowlist

Summary The fix for GHSA-v2wp-frmc-5q3v added validateacmeurl to reject acmeurl values not in ACMEDIRECTORYHOSTALLOWLIST, but the validation is only called at authority creation time POST. The authority update endpoint PUT /api/1/authorities/ accepts and stores arbitrary options -- including a...

Lemur: Any user can revoke arbitrary certificates at the CA by uploading a duplicate record and revoking it

SummaryRepo under test: https://github.com/Netflix/lemurPUT /api/1/certificates//revoke authorizes the caller against the Lemur database row creator == current user, or CertificatePermission over the row's roles rather than the underlying CA-side certificate identity. Separately, POST...

Lemur: Incomplete fix for GHSA-v2wp-frmc-5q3v -- ACME authority update endpoint allows non-admin to replace `acme_url` with internal IP, bypassing allowlist

SummaryThe fix for GHSA-v2wp-frmc-5q3v added validateacmeurl to reject acmeurl values not in ACMEDIRECTORYHOSTALLOWLIST, but the validation is only called at authority creation time POST. The authority update endpoint PUT /api/1/authorities/ accepts and stores arbitrary options -- including a...

PYSEC-2026-3661 devpi-server may leak database contents

Impact If the replication protocol is enabled by using the primary or deprecated master role for a server instance, then the +changelog URL route can be used to read the complete database content including password hashes, and the ids and salts of tokens from devpi-tokens by using a trivially...