CVE-2026-100890

A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarcspfipv6explode in the library libopendmarc/opendmarcspf.c of the component SPF Parser. This manipulation of the argument cp causes null pointer dereference. It is possibl...

CVE-2026-100890

A null pointer dereference vulnerability exists in the Trusted Domain Project OpenDMARC (up to version 1.4.2 ). The flaw is located in the opendmarc_spf_ipv6_explode function within the SPF Parser component (specifically libopendmarc/opendmarc_spf.c). Manipulation of the cp argument triggers the ...

EUVD-2026-88054

A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarcspfipv6explode in the library libopendmarc/opendmarcspf.c of the component SPF Parser. This manipulation of the argument cp causes null pointer dereference. It is possibl...

CVE-2026-100890 Trusted Domain Project OpenDMARC SPF Parser opendmarc_spf.c opendmarc_spf_ipv6_explode null pointer dereference

A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarcspfipv6explode in the library libopendmarc/opendmarcspf.c of the component SPF Parser. This manipulation of the argument cp causes null pointer dereference. It is possibl...

MMSkillRisk: Can Agents Stay Safe When Multimodal Skills Become Traps?

Agent skills are shareable packages of procedural instructions, tools, and examples. Multimodal skills additionally include visual references that agents retrieve and inspect during execution. Because these images guide actions, attackers can disguise malicious instructions as ordinary visual...

PT-2026-102384

A vulnerability was found in FastStone Image Viewer up to 8.3. This affects an unknown function of the file FSViewer.exe of the component TGA Image Handler. The manipulation results in out-of-bounds read. The attack can be launched remotely. The vendor was contacted early about this disclosure bu...

PT-2026-99905

Name of the Vulnerable Software and Affected Versions SUSE Rancher Fleet versions 0.16 through 0.16.1 Description The Git webhook receiver the gitjob webhook service fails to verify incoming requests when a webhook secret is not configured. This allows a remote caller with network access to the...

CVE-2024-42002

A code injection vulnerability has been discovered in the Robot Operating System 2 ROS 2 'ros2topic' command-line tool, affecting all ROS 2 distributions from Crystal Clemmys up to and including Lyrical Luth and Rolling Ridley. The vulnerability lies in the 'hz' verb, which reports the publishing...

Important: libvirt

Issue Overview: A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost function. The function uses a path-based chown on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing...

PT-2026-102333

Name of the Vulnerable Software and Affected Versions Eleveo Quality Management version 9.7.0 Description A remote information disclosure issue exists within the functionality of the file /qm/cz.zoom.scorecard.webui.Scorecard/cz.zoom.scorecard.webui.Scorecard/QMBODownload. An attacker can remotel...

Important: perl-Authen-SASL

Issue Overview: Authen::SASL::Perl::DIGESTMD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in serverstep. serverstart generates a fresh nonce and sends it in the challenge, and nothing later compares that value against the nonce the client returns...

PT-2026-99880

Name of the Vulnerable Software and Affected Versions Zscaler MCP Server versions 0.7.0 through 0.7.1 Description HMAC confirmation tokens are not bound to the target resource identifier. This allows an MCP client or agent to replay a token generated for one resource to affect another resource of...

PT-2026-99925

Name of the Vulnerable Software and Affected Versions SUSE Rancher versions prior to 2.15.2 Description Incorrect credential cleaning during the logout process allows remote attackers to retain access credentials after an account has been logged out. Recommendations Update to version 2.15.2...

Know the Normal, Track the Attack: Context-Grounded and Stateful LLM Investigation over System Provenance

Provenance-based intrusion detection systems PIDSs identify suspicious activity in audit streams, but their outputs remain difficult to turn into coherent attack narratives. Direct LLM analyses of local anomalous subgraphs lack deployment-specific normal-behavior knowledge and validated attack...

AI-Based Vulnerability Assessment Capability and Cyber Attack Graph Analysis

Cyber threats targeting mission-critical infrastructure are becoming more sophisticated while the barrier to launching attacks continues to fall. Traditional point solutions like antivirus and firewalls are reactive and fail to address the combinatorial complexity of modern attack surfaces. This...

ROS-20260928-73-0042

The vulnerability of the modules net/sctp/smmakechunk.c and net/sctp/smstatefuns.c in the Linux operating system is related to the disclosure of information due to timing mismatches. Exploiting this vulnerability can allow an attacker, working remotely, to gain unauthorized access to protected...

PT-2026-102371

Name of the Vulnerable Software and Affected Versions FastStone Image Viewer versions prior to 8.4 Description A flaw in the TGA Image Handler component allows a remote attacker to trigger an out-of-bounds write, which occurs when data is written outside the intended memory boundary of a buffer...

PT-2026-99757

Name of the Vulnerable Software and Affected Versions athlon1600 youtube-downloader versions prior to 4.0.2 Description Remote attackers can perform server-side request forgery SSRF by manipulating the url argument within the stream function located in the public/stream.php file. Server-side...

PT-2026-99763

Name of the Vulnerable Software and Affected Versions Eyeplus version 57.0.0.0308 Description A remote stack-based buffer overflow exists within the p2pcam HTTP Parser component. This issue occurs when an unknown function fails to properly handle input, allowing a remote attacker to trigger the...

ROS-20260928-73-0073

The vulnerability of the nfs4freeolstateid function in the fs/nfsd/nfs4state.c module, which is part of the network file system support in Linux kernels, relates to operations involving resources after their expiration. Exploiting this vulnerability could allow a remote attacker to cause service...