CVE-2026-68189 Bluetooth: hci_sync: Protect UUID list traversal

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Protect UUID list traversal The hcisync conversion moved class-of-device and EIR generation from an HCI request built under hdev-lock to asynchronous command sync work. The worker holds hdev-reqlock, but that...

EUVD-2026-55266

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciuart: clear HCIUARTSENDING when writework is canceled HCIUARTSENDING bit in txstate means writework is pending and blocks queueing it again. Currently this bit is not cleared when canceling the work in hciuartclose,...

Xerox EFI Fiery Webtools LFI File Read

Reads arbitrary files via forceSave.php on Xerox DC260 EFI Fiery Controller Webtools 2.0. !/usr/bin/env python3 -- coding: utf-8 -- """Xerox EFI Fiery Controller Webtools forceSave.php pre-auth LFI file read.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

BloodHound.py collect

Run bloodhound-python / bloodhound-ce-python against a Domain Controller from Linux or Windows, produce a zip, and merge into the agent attack graph. Default collection=DCOnly LDAP-only, good from Kali. Use All for fuller Session/LocalAdmin fan-out when the network allows. !/usr/bin/env python3 -...

CVE-2026-16456: Unintended Proxy or Intermediary

A flaw was found in the odh-model-controller. An authenticated user with permissions to create custom resources can exploit a vulnerability in the loadSecret function. This function improperly reads the Secret namespace from user-controlled input without validation. This allows an attacker to rea...

CVE-2026-15467: Incorrect Privilege Assignment

A flaw was found in the trustyai-service-operator's LMEvalJob controller. An authenticated user within the cluster can exploit this vulnerability by configuring a sidecar container to bypass existing security policies. This allows the user to enable and execute untrusted remote code, leading to...

PT-2026-69954

Name of the Vulnerable Software and Affected Versions odh-model-controller affected versions not specified Description An authenticated user with permissions to create custom resources can exploit a flaw in the loadSecret function. The function improperly reads the Secret namespace from...

NGINX Ingress Controller DoS

The vulnerability of the Ingress and TransportServer components of the NGINX Ingress Controller monitoring and management platform is related to a pointer arithmetic error. Exploiting this vulnerability could allow an attacker to cause service interruptions...

NGINX Ingress Controller Arbitrary Configuration Injection DoS

The vulnerability of the Ingress components and Custom Resource Definitions CRDs of the NGINX Ingress Controller monitoring and management platform is related to the lack of measures taken to neutralize special elements during the processing of string values. Exploiting this vulnerability allows ...

PT-2026-69952

Name of the Vulnerable Software and Affected Versions trustyai-service-operator affected versions not specified Description A flaw in the LMEvalJob controller allows an authenticated user within the cluster to bypass security policies by configuring a sidecar container. This bypass enables the...

CVE-2026-19354

A vulnerability was found in lock-upme OPMS up to 831440f37a92c1568f2e071d5233bc873a9d8b09. The impacted element is an unknown function of the file controllers/messages/message.go of the component IN Clause Handler. Performing a manipulation of the argument ids results in sql injection. The attac...

CVE-2026-71556 vulnerabilities

Vulnerabilities for packages: kaniko-fips, nuclio-controller, kyverno, guac, amazon-ssm-agent-fips, xeol, flux-image-automation-controller, gptscript, crossplane-fips, trivy-fips, cerbos-fips, grype-db, trufflehog-fips, packer, rancher-fleet, tfsec, gomplate-fips, grafana-alloy, nemo, gitea-fips,...

CVE-2026-71557 vulnerabilities

Vulnerabilities for packages: kaniko-fips, nuclio-controller, kyverno, guac, amazon-ssm-agent-fips, xeol, flux-image-automation-controller, gptscript, crossplane-fips, trivy-fips, cerbos-fips, grype-db, trufflehog-fips, packer, rancher-fleet, tfsec, gomplate-fips, grafana-alloy, nemo, gitea-fips,...

GHSA-HC8V-WWC9-VGXM vulnerabilities

Vulnerabilities for packages: kaniko-fips, nuclio-controller, kyverno, guac, amazon-ssm-agent-fips, xeol, flux-image-automation-controller, gptscript, crossplane-fips, trivy-fips, cerbos-fips, grype-db, trufflehog-fips, packer, rancher-fleet, tfsec, gomplate-fips, grafana-alloy, nemo, gitea-fips,...

GHSA-QGQ7-7HM3-Q39J vulnerabilities

Vulnerabilities for packages: kaniko-fips, nuclio-controller, kyverno, guac, amazon-ssm-agent-fips, xeol, flux-image-automation-controller, gptscript, crossplane-fips, trivy-fips, cerbos-fips, grype-db, trufflehog-fips, packer, rancher-fleet, tfsec, gomplate-fips, grafana-alloy, nemo, gitea-fips,...

CVE-2026-71556 vulnerabilities

Vulnerabilities for packages: gitaly, src-fingerprint, pulumi-language-java, pulumi-kubernetes-operator, flux-image-automation-controller, pulumi-language-yaml, zot, kots, kubevela, argo-cd, kaniko, pulumi-language-dotnet, argo-events, argo-workflows, gptscript, goreleaser, bom, syft, tfsec,...

CVE-2026-71557 vulnerabilities

Vulnerabilities for packages: gitaly, src-fingerprint, pulumi-language-java, pulumi-kubernetes-operator, flux-image-automation-controller, pulumi-language-yaml, zot, kots, kubevela, argo-cd, kaniko, pulumi-language-dotnet, argo-events, argo-workflows, gptscript, goreleaser, bom, syft, tfsec,...

GHSA-HC8V-WWC9-VGXM vulnerabilities

Vulnerabilities for packages: gitaly, src-fingerprint, pulumi-language-java, pulumi-kubernetes-operator, flux-image-automation-controller, pulumi-language-yaml, zot, kots, kubevela, argo-cd, kaniko, pulumi-language-dotnet, argo-events, argo-workflows, gptscript, goreleaser, bom, syft, tfsec,...

GHSA-QGQ7-7HM3-Q39J vulnerabilities

Vulnerabilities for packages: gitaly, src-fingerprint, pulumi-language-java, pulumi-kubernetes-operator, flux-image-automation-controller, pulumi-language-yaml, zot, kots, kubevela, argo-cd, kaniko, pulumi-language-dotnet, argo-events, argo-workflows, gptscript, goreleaser, bom, syft, tfsec,...

CVE-2025-71412

Injection of false emergency or status messages over CPDLC may lead to misallocation of resources, operational confusion, and improper response actions by flight crews, traffic controllers, and ground operations. This type of attack can be carried out remotely over radio frequency...