Unity Linux 20.1070e Security Update: kernel (UTSA-2026-013233)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013233 advisory. In the Linux kernel, the following vulnerability has been resolved: audit: fix possible soft lockup in auditinodechild Tracefs or debugfs maybe cause hundreds to...

OPENSUSE-SU-2026:20572-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues The following security issues were fixed: - CVE-2025-39998: scsi: target: targetcoreconfigfs: Add length check to avoid buffer overflow bsc1252073. - CVE-2025-40253: s390/ctcm: Fix double-kfree bsc1255084. -...

SUSE-SU-2026:21237-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues The following security issues were fixed: - CVE-2025-39998: scsi: target: targetcoreconfigfs: Add length check to avoid buffer overflow bsc1252073. - CVE-2025-40253: s390/ctcm: Fix double-kfree bsc1255084. -...

SUSE-SU-2026:21361-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues The following security issues were fixed: - CVE-2025-39998: scsi: target: targetcoreconfigfs: Add length check to avoid buffer overflow bsc1252073. - CVE-2025-40253: s390/ctcm: Fix double-kfree bsc1255084. -...

SUSE-SU-2026:21352-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues The following security issues were fixed: - CVE-2025-39998: scsi: target: targetcoreconfigfs: Add length check to avoid buffer overflow bsc1252073. - CVE-2025-40253: s390/ctcm: Fix double-kfree bsc1255084. -...

Owner-Harm: A Missing Threat Model for AI Agent Safety

Existing AI agent safety benchmarks focus on generic criminal harm cybercrime, harassment, weapon synthesis, leaving a systematic blind spot for a distinct and commercially consequential threat category: agents harming their own deployers. Real-world incidents illustrate the gap: Slack AI...

PT-2026-33646

5/8 Action 4: Apply Critical Patches 24-Hour Priority • Okta Identity Cloud CVE-2026-51287: Critical authentication bypass actively exploited April 18–19, 2026; affects workforce and customer identity flows. Patch all tenants per CISA directive issued April 19. • Elastic Stack Elasticsearch +...

Enclawed: A Configurable, Sector-Neutral Hardening Framework for Single-User AI Assistant Gateways

We present enclawed, a hard-fork hardening framework built on top of the OpenClaw single-user personal artificial intelligence AI assistant gateway. enclawed targets deployments that need attestable peer trust, deny-by-default external connectivity, signed-module loading, and a tamper-evident aud...

GHSA-XGP8-3HG3-C2MH vulnerabilities

Vulnerabilities for packages: parseable, linkerd2-proxy, wasm-pack, atuin, samply, xh, zizmor, linkerd2, deno, sqlx, lychee, buck2, sccache, linkerd-extension-init, ntpd-rs, wasmcloud, qdrant, rustup, ztunnel, wasmtime, zola, py3-xet-core, kdash, uv, cargo-audit, shadowsocks-rust, zellij, rye,...

GHSA-965H-392X-2MH5 vulnerabilities

Vulnerabilities for packages: parseable, linkerd2-proxy, wasm-pack, atuin, samply, xh, zizmor, linkerd2, deno, sqlx, lychee, buck2, sccache, linkerd-extension-init, ntpd-rs, wasmcloud, qdrant, rustup, ztunnel, wasmtime, zola, py3-xet-core, kdash, uv, cargo-audit, shadowsocks-rust, zellij, rye,...

GHSA-965H-392X-2MH5 vulnerabilities

Vulnerabilities for packages: atuin, fnm, lychee, py3-xet-core, buck2, mise, linkerd2-cni-plugin, wasm-pack, shadowsocks-rust, tealdeer, zizmor, linkerd2, zola, samply, garage, lakekeeper, deno, rustup, parseable, linkerd2-proxy, cargo-audit, ztunnel-fips, zellij, ztunnel, sccache, ntpd-rs,...

GHSA-XGP8-3HG3-C2MH vulnerabilities

Vulnerabilities for packages: atuin, fnm, lychee, py3-xet-core, buck2, mise, linkerd2-cni-plugin, wasm-pack, shadowsocks-rust, tealdeer, zizmor, linkerd2, zola, samply, garage, lakekeeper, deno, rustup, parseable, linkerd2-proxy, cargo-audit, ztunnel-fips, zellij, ztunnel, sccache, ntpd-rs,...

cpython: CPython: Logging Bypass in Legacy .pyc File Handling

A flaw was found in CPython. This vulnerability allows a local user with low privileges to bypass security auditing mechanisms. The issue occurs because the SourcelessFileLoader component, responsible for handling older Python compiled files .pyc, does not properly trigger system audit events. Th...

Revive Adserver: Stored XSS via malicious usernames in audit log details + Username validation bypass in XML‑RPC addUser

Vulnerability description not provided...

WordPress WP Statistics plugin <= 14.16.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure and Privacy Audit Manipulation vulnerability

Missing Authorization to Authenticated Subscriber+ Sensitive Information Exposure and Privacy Audit Manipulation vulnerability discovered by Jack Pas Dark. - Black Lantern Security in WordPress Plugin WP Statistics versions = 14.16.4...

CVE-2026-3488 WP Statistics <= 14.16.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure and Privacy Audit Manipulation

The WP Statistics plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 14.16.4. This is due to missing capability checks on multiple AJAX handlers including wpstatisticsgetfilters, wpstatisticsgetPrivacyStatus, wpstatisticsupdatePrivacyStatus, and...

CVE-2026-3488

The WP Statistics plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 14.16.4. This is due to missing capability checks on multiple AJAX handlers including wpstatisticsgetfilters, wpstatisticsgetPrivacyStatus, wpstatisticsupdatePrivacyStatus, and...

Insufficient Verification of Data Authenticity

Overview Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity via the decidedByUserId field in approval-related endpoints. An attacker can forge decision attribution by supplying an arbitrary user identifier in the request body, causing the system to...

Insufficient Verification of Data Authenticity

Overview Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity via the decidedByUserId field in approval-related endpoints. An attacker can forge decision attribution by supplying an arbitrary user identifier in the request body, causing the system to...

GHSA-P7MM-R948-4Q3Q Paperclip: Approval decision attribution spoofing via client-controlled `decidedByUserId` in paperclip server

Summary The approval-resolution endpoints POST /approvals/:id/approve, /reject, /request-revision accept a client-supplied decidedByUserId field in the request body and write it verbatim into the authoritative approvals.decidedByUserId column — without cross-checking it against the authenticated...