SUSE CVE-2026-68742

A flaw was found in SSSD. The sssnssprotocolparseaddr function in the NSS responder does not validate the addrlen field against the remaining packet body size. A local attacker can exploit this via a crafted GETHOSTBYADDR request to the NSS responder socket, causing an out-of-bounds read and...

SUSE CVE-2026-68744

A flaw was found in SSSD. The sssnssprotocolfillinitgr function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to...

Important: Red Hat Security Advisory: yggdrasil security update

An update for yggdrasil is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...

[SECURITY] [DSA 6414-1] udisks2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6414-1 [email protected] https://www.debian.org/security/ Alberto Garcia August 06, 2026 https://www.debian.org/security/faq -...

gpsd: gpsd: Command Injection via GPS device subtype allows arbitrary code execution

A flaw was found in gpsd, a service application that monitors one or more GPSes or AIS receivers. The gpsprof utility is vulnerable to a command injection. An attacker who can control the GPS device subtype value can embed malicious commands within the gnuplot plot title. When a user processes a...

Malicious code in @vanexalabs-ai/vanexa-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab5de2359eef117d1f491dc2c8628e56d866435912bd6f8e55a10eee8e7a9a6c The package implements a daemon that pairs with a remote peer phone over WebRTC, using https://vanexa-agent-relay.workers.dev and...

MAL-2026-13397 Malicious code in @vanexalabs-ai/vanexa-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab5de2359eef117d1f491dc2c8628e56d866435912bd6f8e55a10eee8e7a9a6c The package implements a daemon that pairs with a remote peer phone over WebRTC, using https://vanexa-agent-relay.workers.dev and...

ALSA-2026:51075 Important: gpsd security update

gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or USB interface, making its data on the location/course/velocity of the sensor available to be queried on TCP port 2947 of the host computer. With gpsd, multiple GPS client applications such as...

Important: gpsd-minimal security update

gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or USB interface, making its data on the location/course/velocity of the sensor available to be queried on TCP port 2947 of the host computer. The AlmaLinux support for this package is limited...

EulerOS 2.0 SP15 : sssd (EulerOS-SA-2026-2952)

According to the versions of the sssd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in the System Security Services Daemon SSSD. The pampasskeychildreaddata function within the PAM passkey responder fails to properl...

EulerOS 2.0 SP15 : rsync (EulerOS-SA-2026-2907)

According to the versions of the rsync packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement wh...

EulerOS 2.0 SP15 : sssd (EulerOS-SA-2026-2911)

According to the versions of the sssd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in the System Security Services Daemon SSSD. The pampasskeychildreaddata function within the PAM passkey responder fails to properl...

EulerOS 2.0 SP13 : nfs-utils (EulerOS-SA-2026-2983)

According to the versions of the nfs-utils packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package for Linux, that allows a NFSv3 client to escalate the...

MiracleLinux 9 : perl-HTTP-Daemon-6.12-6.el9_8.1 (AXSA:2026-1466:02)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1466:02 advisory. perl-HTTP-Daemon: HTTP::Daemon: Arbitrary code execution via OS command injection in sendfile CVE-2026-8450 Tenable has extracted the preceding description...

Malicious code in @agenthub-ai/agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 759e28e403a082017b33bb95bcc8c1d7abd229a59375b8a4a3de9841c89d3379 Package installs a long-running daemon that opens a persistent WebSocket to wss://agenthub-agent.fyenet.com and dispatches command envelopes from the...

MAL-2026-12312 Malicious code in @agenthub-ai/agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 759e28e403a082017b33bb95bcc8c1d7abd229a59375b8a4a3de9841c89d3379 Package installs a long-running daemon that opens a persistent WebSocket to wss://agenthub-agent.fyenet.com and dispatches command envelopes from the...

MAL-2026-12467 Malicious code in streak-int-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0acd9bdc8d6474a54b3c985b8472cd50295130d12029de1a8a10175f9be8bb35 [email protected] ships an x86-64 ELF binary as a base64 blob disguised as configuration data defaultConfig.data joined into embeddedService in...

CVE-2026-64578

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate compound request size before reading StructureSize2 When ksmbd validates a compound chained SMB2 request, ksmbdsmb2checkmessage reads pdu-StructureSize2 without first checking that the compound element is large...

httpd: httpd: HTTP/2 Remote Denial of Service via compression bomb and Slowloris-style attack

A flaw was found in HTTP/2, affecting various web servers. A remote attacker can exploit this vulnerability by combining an HPACK compression bomb with a zero-byte flow-control window. This technique allows a small amount of data to expand into large memory allocations on the server, which are th...

EUVD-2026-52964

Buffer Overflow vulnerability exists in open62541 1.5.5 when the Local Discovery Server LDS is built with multicast discovery enabled through the MDNSD backend. An unauthenticated remote attacker can send a RegisterServer or RegisterServer2 request containing many unique discoveryUrls. This allow...