CVE-2026-108266 Privasys rustls fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session

Privasys rustls is a maintained fork of the rustls TLS library that adds RA-TLS challenge and channel-binding support. Prior to privasys-v0.8.1, the fork emitted RA-TLS challenge certificates whose quote ReportData was bound to the certificate public key and client nonce but not to the active TLS...

EUVD-2026-95997

Privasys rustls is a maintained fork of the rustls TLS library that adds RA-TLS challenge and channel-binding support. Prior to privasys-v0.8.1, the fork emitted RA-TLS challenge certificates whose quote ReportData was bound to the certificate public key and client nonce but not to the active TLS...

CVE-2026-108266

The Privasys rustls library, a fork of rustls providing RA-TLS challenge and channel-binding support, is vulnerable in versions prior to privasys-v0.8.1 . The root cause is that RA-TLS challenge certificates emitted by the library bound quote ReportData to the certificate public key and client no...

CVE-2026-108265

The Enclave OS Mini Rust-based runtime for Intel SGX enclaves contains a vulnerability in the RA-TLS challenge certificate path (prior to wasm-v0.40.0 ). The issue stems from the runtime placing the certificate public-key hash and client nonce in the quote ReportData while failing to include a va...

EUVD-2026-78648

Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited...

Security Bulletin: Vulnerability in Apache Log4j affects IBM Cloud Pak for Watson AIOps (CVE-2021-44228)

Summary A vulnerability was identified within the Apache Log4j library that is used by IBM Cloud Pak for Watson AIOps. This vulnerability has been addressed. Vulnerability Details CVEID:CVE-2021-44228 DESCRIPTION: Apache Log4j could allow a remote attacker to execute arbitrary code on the system,...

Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories

Cybersecurity researchers have disclosed details of an ongoing credential-theft campaign that has compromised two high-profile open-source maintainer accounts to push a malicious workflow into over 340 repositories. "Using the account of Takashi Kitao, author of the 18,400-star game engine pyxel,...

UBUNTU-CVE-2026-107818

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv...

CVE-2026-108160

AstronRPA through 1.1.6 contains a download of code without integrity check vulnerability that allows network attackers to deliver malicious updates by abusing the desktop client's auto-update mechanism. Attackers positioned between the client and server can serve a malicious update manifest and...

CVE-2025-61560

A race condition vulnerability in the SessionManager of CNCF: Cloud Native Computing Foundation Argo CD v3.0.6 allows attackers to bypass rate limiting and perform a brute force attack via repeated crafted requests...

CVE-2026-106555

A flaw was found in OpenSSH's SSH daemon sshd. When Generic Security Service Application Program Interface GSSAPI authentication is enabled, authentication state can improperly persist across separate authentication attempts. A local user could exploit this condition during sequential...

CVE-2026-98235

A flaw was found in the Linux kernel's network traffic control subsystem. When processing a batched request to delete traffic actions, a failure encountered on an action bound to a filter causes the cleanup process to terminate prematurely without releasing references on subsequent actions. A loc...

CVE-2026-107888

A flaw was found in CUPS. An attacker with access to the local print service can cause a Denial of Service DoS by submitting a held print job targeted at a temporary printer that is subsequently deleted. Because the print scheduler fails to verify that the printer destination still exists before...

CVE-2026-107937

A flaw was found in Apache CXF. A remote, unauthenticated attacker can cause a Denial of Service DoS by sending a crafted multipart request containing excessively large or repeated attachment headers. Because the parser fails to properly enforce size and count limits on multi-line and repeated...

CVE-2026-98223

A flaw was found in the Linux kernel's memory management component. When dropbehind memory pages are mapped during read-ahead fault operations, the kernel can mistakenly attempt to execute a sleepable operation while running in an atomic, non-preemptible context upon writeback completion. A local...

CVE-2026-98226

A flaw was found in the Linux kernel's swap subsystem. An internal tracking bit overlaps with the active page counter when swap utilization reaches very large capacities, causing the kernel to miscalculate active swap space. A local user capable of allocating enough memory to reach this threshold...

CVE-2026-97791

A flaw was found in Apache CXF. This vulnerability allows an authentication bypass when validating Security Assertion Markup Language SAML tokens. Because the token validator shares validation state across concurrent requests, a remote, unauthenticated attacker can submit a forged assertion signe...

CVE-2026-108160

The AstronRPA desktop client (versions through 1.1.6 ) is vulnerable to a download of code without integrity check (CWE-494). The electron-updater component fails to perform signature verification when fetching updates via a plain-HTTP feed . A network attacker positioned between the client and t...

Security update for flatpak

This update for flatpak fixes the following issues: CVE-2026-90616: missing symlink protection allows a malicious sandboxed app to obtain arbitrary read and write access to files on the host bsc1280236. CVE-2026-92162: path traversal via unvalidated arch parameter in DeployAppstream bsc1282514...

SUSE-SU-2026:4610-1 Security update for flatpak

This update for flatpak fixes the following issues: - CVE-2026-90616: missing symlink protection allows a malicious sandboxed app to obtain arbitrary read and write access to files on the host bsc1280236. - CVE-2026-92162: path traversal via unvalidated arch parameter in DeployAppstream bsc128251...