EUVD-2026-79949

The affected products are missing authentication for a critical function, which could allow an attacker to run as root and pass received bytes directly to a system command...

Astra Linux – Vulnerability in Firefox and Thunderbird

An attacker could cause the memory manager to improperly free a pointer that points to attacker-controlled memory, resulting in an assertion error, memory corruption, or a potentially exploitable crash. This vulnerability affects Firefox 112, Focus for Android 112, Firefox ESR 102.10, Firefox for...

Astra Linux – Vulnerability in Golang 1.19, Golang 1.23

Creating a malicious file using cmd/go can result in writing to a file controlled by an attacker, with partial control over the file’s content. The cgo pkg-config: directive in a Go source file provides command-line arguments that are passed to the Go pkg-config command. An attacker can provide a...

CVE-2026-89648

In the Linux kernel, the following vulnerability has been resolved: ceph: cap delegated inode count in cephparsedeleginos cephparsedeleginos decodes interval sets of delegated inode numbers from an MDS create-with-delegation reply. For each set it reads a 64-bit start and a 64-bit len with...

CVE-2026-78571

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to an unguarded eval call on attacker-controlled input...

EUVD-2026-42936

Excelize: Streaming GetRows row-bound bypass causes attacker-controlled allocation...

CVE-2026-44950

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice position, length lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the...

EUVD-2026-75269

A code execution vulnerability in Palo Alto Networks Checkov by Prisma® Cloud can allow arbitrary code execution when Checkov scans a directory that contains an attacker-controlled configuration file...

PT-2026-89612

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.11.5 Description A remote authenticated attacker can execute arbitrary code because of an unguarded eval function call that processes input controlled by the attacker. Recommendations Update IBM Langfl...

Cross-Site Request Forgery (CSRF)

Spring for GraphQL is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is due to the GraphiQL page allowing attacker-controlled URLs to trigger requests to application GraphQL endpoints, potentially causing confidential information to be leaked to the attacker's website...

SUSE CVE-2026-54725

vault-secrets-webhook is a Kubernetes mutating webhook that makes direct secret injection into Pods possible. Prior to 1.23.1, parseVaultConfig in pkg/webhook/config.go accepts the vault.security.banzaicloud.io/vault-addr annotation, MutateConfigMap and MutateSecret call newVaultClient in...

[SECURITY] [DLA 4772-1] pcre2 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4772-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort September 04, 2026 https://wiki.debian.org/LTS -...

Debian dla-4772 : libpcre2-16-0 - security update

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dla-4772 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4772-1 [email protected] https://www.debian.org/lts/security/...

Malicious code in orbitron-cli (npm)

The npm package orbitron-cli is malicious. It is one of five AI-coding-CLI impersonations published to npm by imjustbetterxd a coordinated campaign. On use, the CLI reads the developer's LLM/provider API key - from environment variables e.g. EXAAPIKEY, NVIDIAAPIKEY and its own config - and routes...

GHSA-63MC-HW7G-86RR Phoenix: Presence keys colliding with `Object.prototype` members break existence checks

Summary The Phoenix JavaScript presence client assets/js/phoenix/presence.js tests whether a presence already exists using a bare truthiness check statekey rather than an own-property check. Because applications commonly track presences under a client-supplied username or id, the presence key can...

CVE-2026-84662

The Jenkins LDAP Plugin (version 807.809.vd3a_4e5e4ec98 and earlier) is vulnerable to Server-Side Request Forgery (SSRF) due to improper access control in the Stapler web framework data-binding mechanism. The plugin uses the @DataBoundConstructor annotation on a constructor that connects to a spe...

CVE-2026-81267

A malicious webpage could stall a popup's cross-origin navigation after commit, causing the address bar to display the destination origin while continuing to render attacker-controlled content. This vulnerability was fixed in Firefox for iOS 155.0...

CVE-2026-82468

Rodauth before 2.47.0 contains a cross-site request forgery protection bypass vulnerability in the JSON request content type validation. Attackers can craft cross-origin form posts with content types containing application/json substrings to bypass CSRF token validation and force victims to...

openSUSE 16: pyenv / pyenv-bash-completion / pyenv-fish-completion / etc (openSUSE-SU-2026:21664-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21664-1 advisory. Changes in pyenv: - CVE-2026-68939: a matching attacker-controlled file can silently select a different installed interpreter or version bsc1275661...

UBUNTU-CVE-2026-59683

The OpenRGB network protocol allows to write attacker controlled strings into arbitrary file system paths extension of CVE-2026-59682. This allows either a full system compromise from local or remote if the daemon is running as root or a full account takeover if the daemon is running in user...