CVE-2026-86746 Snipe-IT before 8.7.0 Authorization Bypass via Livewire Snapshot Replay

Snipe-IT before 8.7.0 contains an authorization bypass vulnerability in Livewire components that enforce authorization only at the route level, not within component lifecycle methods. Attackers with a valid authenticated session can replay signed component snapshots via POST /livewire/update to...

EUVD-2026-74923

Snipe-IT before 8.7.0 contains an authorization bypass vulnerability in Livewire components that enforce authorization only at the route level, not within component lifecycle methods. Attackers with a valid authenticated session can replay signed component snapshots via POST /livewire/update to...

EUVD-2026-74907

VLC media player copies an RTSP response line into a fixed buffer without guaranteeing termination and then treats that buffer as a C string. RtspReadLine in modules/access/rtsp/access.c calls strncpy with the full buffer length, which writes no terminator when the source line is at least as long...

EUVD-2026-74906

VLC media player computes the size of a picture buffer with 32-bit arithmetic and allocates from the wrapped result. In AllocatePicture in src/misc/picture.c the running total is accumulated as ibytes += p-ipitch p-ilines, and both planet fields are declared int in include/vlcpicture.h, so the...

Exploit for CVE-2026-74586

CVE-2026-74586 — SCTP ASCONF newtransport use-after-free trig...

Security Bulletin: Vulnerabilities in Spring, Tomcat, Netty, PostCSS might affect IBM Storage Protect Plus

Summary IBM Spectrum Protect Plus can be affected by vulnerabilities in PostCSS, Spring, HttpClient, Netty, Tomcat, Jackson-Core, RabbitMQ, urllib3, and Node.js. Vulnerabilities include exposure of sensitive information to an unauthorized actor, authentication bypass by primary weakness, improper...

Regular Expression Denial of Service (ReDoS)

Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the Actor.fromstring parsing in git/util.py. An attacker can exhaust CPU and stall commit metadata access by supplying a...

CVE-2026-80172

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insufficient Verification of Data Authenticity vulnerability. An unauthenticated attacker with remote access could exploit this, leading to unauthorized access. This...

SUSE-SU-2026:3595-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP5 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2022-4994: KVM: x86: wean fast IN from emulatorpioin bsc1273097. - CVE-2023-53995: net: ipv4: fix one memleak in inetdelifa bsc1255616. - CVE-2024-38542: RDMA/manaib...

kernel security, bug fix, and enhancement update

An update is available for kernel. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The kernel packages contain the Linux kernel, the core of any Linux operating...

RLSA-2026:64775 Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: can: bcm: add locking for bcmop runtime updates CVE-2025-38004 kernel: ipv6: add NULL checks for idev in SRv6 paths CVE-2026-23442 kernel: udp: Fix wildcard bind conflict check when using...

RUSTSEC-2026-0282 Double free in `AlignedBox<[T]>::realloc_with_default` when an element's `Drop` panics

Shrinking an AlignedBox takes ownership of the buffer out of self.container with ManuallyDrop::take, destroys the elements past the new length, and only then commits the new Box back into self.container. ManuallyDrop::take moves ownership but not the bits, so until that commit self.container stil...

Double free in `AlignedBox<[T]>::realloc_with_default` when an element's `Drop` panics

Shrinking an AlignedBox takes ownership of the buffer out of self.container with ManuallyDrop::take, destroys the elements past the new length, and only then commits the new Box back into self.container. ManuallyDrop::take moves ownership but not the bits, so until that commit self.container stil...

CVE-2026-80172

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insufficient Verification of Data Authenticity vulnerability. An unauthenticated attacker with remote access could exploit this, leading to unauthorized access. This...

CVE-2026-80172

Dell Secure Connect Gateway (SCG) 5.0 Appliance and Application versions contain an Insufficient Verification of Data Authenticity vulnerability. An unauthenticated remote attacker can repeatedly reuse a captured request to generate ADMIN access and refresh tokens , since there is no nonce valida...

EUVD-2026-74853

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insufficient Verification of Data Authenticity vulnerability. An unauthenticated attacker with remote access could exploit this, leading to unauthorized access. This...

CVE-2026-80172

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insufficient Verification of Data Authenticity vulnerability. An unauthenticated attacker with remote access could exploit this, leading to unauthorized access. This...

DeepSeek Harness Flaw Let AI Agents Disable Their Own File Sandbox Without Approval

A flaw in DeepSeek Harness , DeepSeek's open-source tool for running AI coding agents on a developer's machine, let a sandboxed agent turn off its own sandbox with a single command. The tool runs an agent's commands inside an operating-system sandbox, so that an agent working on untrusted files...

postgis: PostGIS: Memory Disclosure and Denial of Service via Malformed FlatGeobuf Buffer

A flaw was found in PostGIS. This out-of-bounds read vulnerability allows a remote attacker to cause memory disclosure or a server crash. This occurs when a malformed FlatGeobuf buffer is supplied, as the FlatGeobuf property metadata decoder fails to verify that the string body is contained withi...

Claude Fable Solves a Historical Cipher

Claude Fable 5.1 solved a 370-year-old cipher in forty-four minutes. This tracks with what I wrote about AIs doing mathematics: It's good at things that involve lots of searching and testing. EDITED TO ADD 9/14: I'm not sure if this result is correct. The blog comments have more discussion...