PT-2026-72586

In the Linux kernel, the following vulnerability has been resolved: sctp: add INIT verification after cookie unpacking In SCTP handshake, the INIT chunk is initially processed by the server and embedded into the cookie carried in INIT-ACK. The client then returns this cookie via COOKIE-ECHO, wher...

PT-2026-72819

In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix out-of-bounds access in nvme setup descriptor pools nvme setup descriptor pools indexes dev-descriptor pools using the numa node forwarded from hctx-numa node by its single caller, nvme init hctx common. On a non-NU...

PT-2026-73032

@fastify/oauth2 is an OAuth 2.0 plugin for Fastify. In versions from 7.2.0 up to but not including 8.3.0, the plugin validates the OAuth state, and with PKCE the code verifier, by comparing the callback query parameter against an unprefixed, predictable cookie, with no server-side binding to the...

Linux Distros Unpatched Vulnerability : CVE-2026-74509

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hcisync: Fix advertising data UAFs hcifindadvinstance returns an advinfo pointer that is valid only while hdev-lock is held. The advertising...

Linux Distros Unpatched Vulnerability : CVE-2026-74481

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mm/pagereporting: use systemfreezablewq to fix UAF during suspend During PM freeze e.g. S3 suspend or S4 hibernation, device drivers like virtioballoon reset...

SUSE CVE-2026-14679

Stack buffer overflow in PostgreSQL argument name matching allows an object creator to achieve unknown impacts via OUT parameter count. The attack can write only 0x0 and 0x1 bytes. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected...

CVE-2026-74243

A flaw was found in Red Hat Quay. When the SECURITYSCANNERV4PSK pre-shared key is not set, a remote unauthenticated attacker can send POST requests to the security scanner notification endpoint. This allows the attacker to flood the notification queue and inject path traversal characters into Cla...

GHSA-76PC-MQXP-3RQ5 Token Optimizer MCP: Unauthenticated Path Traversal in Dashboard Session Log API Endpoints

Unauthenticated Path Traversal in Dashboard Session Log API Endpoints | Field | Value | | ---------------- | ----- | | Repository | ooples/token-optimizer-mcp | | Affected version | 5.0.1 commit 8137147 | | Vulnerability | CWE-22 — Improper Limitation of a Pathname to a Restricted Directory | |...

Token Optimizer MCP: Unauthenticated Path Traversal in Dashboard Session Log API Endpoints

Unauthenticated Path Traversal in Dashboard Session Log API Endpoints | Field | Value | | ---------------- | ----- | | Repository | ooples/token-optimizer-mcp | | Affected version | 5.0.1 commit 8137147 | | Vulnerability | CWE-22 — Improper Limitation of a Pathname to a Restricted Directory | |...

GO-2026-6179 vulnerabilities

Vulnerabilities for packages: terraform, containerd, kyverno, aactl, kots, prometheus-mongodb-exporter, langfuse, spire-server, langfuse-fips, commercial-grafana, nerdctl, snyk-cli, k3d, zot, reports-server, k8s-device-plugin, k3s...

GO-2026-6180 vulnerabilities

Vulnerabilities for packages: terraform, containerd, kyverno, aactl, kots, prometheus-mongodb-exporter, langfuse, spire-server, langfuse-fips, commercial-grafana, nerdctl, snyk-cli, k3d, zot, reports-server, k8s-device-plugin, k3s...

CVE-2026-56865 vulnerabilities

Vulnerabilities for packages: terraform, containerd, kyverno, aactl, kots, prometheus-mongodb-exporter, langfuse, spire-server, langfuse-fips, commercial-grafana, nerdctl, snyk-cli, k3d, zot, reports-server, k8s-device-plugin, k3s...

CVE-2026-56864 vulnerabilities

Vulnerabilities for packages: terraform, containerd, kyverno, aactl, kots, prometheus-mongodb-exporter, langfuse, spire-server, langfuse-fips, commercial-grafana, nerdctl, snyk-cli, k3d, zot, reports-server, k8s-device-plugin, k3s...

GHSA-QV9R-C865-CP47 vulnerabilities

Vulnerabilities for packages: opensearch-fips, strimzi-kafka-operator, kafka-fips, spark, spark-fips, solr, hadoop-fips, kayenta-fips, apache-tika-fips, keycloak-config-cli, geoserver, cruise-control-fips, apache-activemq-fips, apache-camel-karavan-devmode, thingsboard, kayenta,...

CVE-2026-49844 vulnerabilities

Vulnerabilities for packages: opensearch-fips, strimzi-kafka-operator, kafka-fips, spark, spark-fips, solr, hadoop-fips, kayenta-fips, apache-tika-fips, keycloak-config-cli, geoserver, cruise-control-fips, apache-activemq-fips, apache-camel-karavan-devmode, thingsboard, kayenta,...

GO-2026-6090 vulnerabilities

Vulnerabilities for packages: nri-mssql, prometheus-alertmanager-fips, rancher-fleet-fips, rke2-runtime-fips, docker-machine-driver-linode, crossplane-provider-aws-detective, opensearch-k8s-operator, nri-haproxy, kubeflow-fips, tbot, ksops-fips, sftpgo-plugin-geoipfilter, buildah-fips, quic-go,...

GO-2026-6218 vulnerabilities

Vulnerabilities for packages: nri-mssql, prometheus-alertmanager-fips, rancher-fleet-fips, rke2-runtime-fips, docker-machine-driver-linode, crossplane-provider-aws-detective, opensearch-k8s-operator, nri-haproxy, kubeflow-fips, tbot, ksops-fips, sftpgo-plugin-geoipfilter, buildah-fips,...

CVE-2026-56853 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-lightsail-fips, prometheus-adapter-fips, virt-operator-fips, step-issuer, crossplane-provider-aws-dms-fips, tkn, victoriametrics-cluster-fips, nri-mssql, crossplane-provider-aws-s3control, omnictl-multiarch-fips,...

CVE-2026-56862 vulnerabilities

Vulnerabilities for packages: nri-mssql, prometheus-alertmanager-fips, rancher-fleet-fips, rke2-runtime-fips, docker-machine-driver-linode, crossplane-provider-aws-detective, opensearch-k8s-operator, nri-haproxy, kubeflow-fips, tbot, ksops-fips, sftpgo-plugin-geoipfilter, buildah-fips, quic-go,...

GO-2026-6089 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-lightsail-fips, prometheus-adapter-fips, virt-operator-fips, step-issuer, crossplane-provider-aws-dms-fips, tkn, victoriametrics-cluster-fips, nri-mssql, crossplane-provider-aws-s3control, omnictl-multiarch-fips,...