CVE-2026-12520: Out-of-bounds Write

The Sierra Wireless HL7800 cellular modem driver drivers/modem/vendorstandalone/hl7800.c, located at drivers/modem/hl7800.c in v4.4.0 and earlier parses AT responses with roughly twenty handlers that call netbuflinearizevalue, sizeofvalue, buf, 0, len into a 128-byte stack buffer and then write...

PT-2026-77289

The Sierra Wireless HL7800 cellular modem driver drivers/modem/vendor standalone/hl7800.c, located at drivers/modem/hl7800.c in v4.4.0 and earlier parses AT responses with roughly twenty handlers that call net buf linearizevalue, sizeofvalue, buf, 0, len into a 128-byte stack buffer and then writ...

Authentication Bypass

org.apache.cxf, cxf-rt-rs-security-oauth2 is vulnerable to an Authentication Bypass. The vulnerability is due to a missing throw statement in the security context check, which allows an unauthenticated network attacker to access the /services/oauth2/introspect endpoint and perform token...

CVE-2026-65899

A flaw was found in DOMPurify where the clearConfig function does not properly reset the retained Trusted Types policy. This can lead to a DOMPurify instance, when reused across different security contexts, remaining bound to a previously supplied and potentially unsafe policy. An attacker could...

BIT-NIFI-2026-68980 Apache NiFi: Authorization Bypass for Parameter Context Asset Deletion

Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Contexts through the REST API. The framework authorizes asset deletion against the owning Parameter Context using the supplied Parameter Context Identifier and Asset Identifier. The framework...

BIT-NIFI-2026-68979 Apache NiFi: Missing Authorization for Components Referenced by Parameter Context Updates

Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on components referencing Parameter values. Updating a Parameter Context can change parameter values that affect referencing components, but framework authorization wa...

BIT-NIFI-2026-62354 Apache NiFi: Incorrect Authorization for Parameter Context Validation Requests

Authorization handling for Parameter Context validation requests in Apache NiFi 1.10.0 through 2.10.0 allows clients with read access to submit proposed Parameter values. The proposed values override current configuration, enabling users with read access to invoke predefined component validation...

Authorization Before Context: A Model-Neutral Audience Boundary against Cross-Audience Memory Leakage in Agentic Systems

A personal language agent learns a fact from one audience and may later place it in the prompt it assembles for another. This memory-to-context step is an attack surface: ambiguous or inconsistent channels, cross-audience prying, and poisoned memory can each cause the system to assemble context...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100700)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100700 advisory. In the Linux kernel, the following vulnerability has been resolved: net/rds: fix NULL deref in rdsibsendcqehandler on masked atomic completion rdsibxmitatomic always...

When Agents Act on Web3: An Attack-Surface Survey of MCP, Skills, and Tool Calling

AI agents increasingly act rather than merely read: across the Model Context Protocol MCP ecosystem, the share of deployed tools that modify external state has risen from 27% to 65% of tool use. When agents exercise this authority on public blockchains through MCP, skills, and tool calling, the...

PT-2026-73392

Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Contexts through the REST API. The framework authorizes asset deletion against the owning Parameter Context using the supplied Parameter Context Identifier and Asset Identifier. The framework...

PT-2026-73390

Authorization handling for Parameter Context validation requests in Apache NiFi 1.10.0 through 2.10.0 allows clients with read access to submit proposed Parameter values. The proposed values override current configuration, enabling users with read access to invoke predefined component validation...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-100136)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100136 advisory. In the Linux kernel, the following vulnerability has been resolved: usb: xhci: tegra: fix sleep in atomic call When we set the dual-role port to Host mode, we observ...

PT-2026-73391

Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on components referencing Parameter values. Updating a Parameter Context can change parameter values that affect referencing components, but framework authorization wa...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099739)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099739 advisory. In the Linux kernel, the following vulnerability has been resolved: seg6: separate dstcache for input and output paths in seg6 lwtunnel The seg6 lwtunnel uses a sing...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100370)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100370 advisory. In the Linux kernel, the following vulnerability has been resolved: seg6: separate dstcache for input and output paths in seg6 lwtunnel The seg6 lwtunnel uses a sing...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099986)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099986 advisory. In the Linux kernel, the following vulnerability has been resolved: ceph: supply snapshot context in cephzeropartialobject The cephzeropartialobject function was...

CVE-2026-74791

Scriban before 7.0.0 fails to clear the CachedTemplates dictionary when TemplateContext.Reset is called, allowing cached templates to persist across reused contexts. Attackers can exploit request-dependent ITemplateLoader implementations to access previously authorized template content from earli...

CVE-2026-74794 Scriban before 6.6.0 Denial of Service via Infinite Recursion

Scriban before 6.6.0 contains an infinite recursion vulnerability in object rendering when the ObjectRecursionLimit property defaults to unlimited. Attackers can supply circular reference objects to the template context, exhausting stack space and triggering an uncatchable StackOverflowException...

CVE-2026-74791

Scriban before 7.0.0 fails to clear the CachedTemplates dictionary when TemplateContext.Reset is called, allowing cached templates to persist across reused contexts. Attackers can exploit request-dependent ITemplateLoader implementations to access previously authorized template content from earli...