OPENSUSE-SU-2026:11606-1 cadvisor-0.60.5-2.1 on GA media

These are all security issues fixed in the cadvisor-0.60.5-2.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11609-1 distribution-registry-3.1.1-5.1 on GA media

These are all security issues fixed in the distribution-registry-3.1.1-5.1 package on the GA media of openSUSE Tumbleweed...

Astra Linux – Vulnerability in Heimdal, Samba

Before version 7.7.1, Heimdal allowed remote attackers to execute arbitrary code due to an invalid free operation in the ASN.1 codec used by the Key Distribution Center KDC...

Astra Linux – Vulnerability in gnupg1

Libgcrypt before version 1.7.8 is vulnerable to a cache-side-channel attack that can lead to a complete failure of the RSA-1024 algorithm. This attack occurs when the left-to-right method is used for computing the sliding-window expansion. It is believed that the same attack also works on the...

CVE-2026-77710

misp-stix (the MISP STIX import library) is vulnerable to STIX2 parser confusion and mass assignment (CWE-915, CWE-807). The import logic selected between the internal MISP parser and the external STIX parser based on untrusted metadata—MISP-specific tool labels (STIX2) or document title (STIX1)—...

CVE-2026-77710 STIX2 Parser Confusion and Mass Assignment Allow Unauthorized MISP Attribute Metadata Injection in misp-stix library

A vulnerability in misp-stix could allow a crafted STIX document to influence security-sensitive MISP attribute metadata during import. The STIX import logic automatically selected between the internal MISP parser and the external STIX parser based on metadata contained in the STIX document itsel...

CVE-2026-77710 STIX2 Parser Confusion and Mass Assignment Allow Unauthorized MISP Attribute Metadata Injection in misp-stix library

A vulnerability in misp-stix could allow a crafted STIX document to influence security-sensitive MISP attribute metadata during import. The STIX import logic automatically selected between the internal MISP parser and the external STIX parser based on metadata contained in the STIX document itsel...

CVE-2026-70782

Vulnerability in the Oracle Labor Distribution product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Labor...

EUVD-2026-61733

Vulnerability in the Oracle Labor Distribution product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Labor...

EUVD-2026-61139

Kraken agents fail to verify peer-to-peer downloaded blobs against their requested SHA-256 digest before committing to the content-addressable cache, relying only on CRC32 checksums for piece validation. Attackers on the agent-to-agent path or malicious peers can supply substituted content with...

BIT-DISTRIBUTION-2026-41888 Distribution: Tag deletion bypasses `storage.delete.enabled` configuration

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.1, tag deletion via the DELETE /v2//manifests/ endpoint bypasses the storage.delete.enabled: false configuration, allowing any API client to remove tags from repositories even when the operator has...

BIT-DISTRIBUTION-2026-35172 Distribution has stale blob access resurrection via repo-scoped redis descriptor cache invalidation

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.0, distribution can restore read access in repo a after an explicit delete when storage.cache.blobdescriptor: redis and storage.delete.enabled: true are both enabled. The delete path clears the shared dige...

PT-2026-77777

Vulnerability in the Oracle Labor Distribution product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Labor...

DEBIAN-CVE-2026-72030

In the Linux kernel, the following vulnerability has been resolved: ata: libata-core: Reject an invalid concurrent positioning ranges count atadevconfigcpr takes the number of range descriptors from buf0 of the concurrent positioning ranges log up to 255, which the device reports independently of...

Hackers Spend Nearly $7 Million on Expired Domains to Redirect Traffic to Scams and Malware

Threat actors are acquiring expired domains to inherit their website traffic and reputation with an aim to redirect victims to scams and malware on a large scale. DNS threat intelligence firm Infoblox has given the name dropcatch domains to those that get a second chance, where an expired domain...

GO-2025-4013 vulnerabilities

Vulnerabilities for packages: dagdotdev, localstack, iptables-wrappers, istio, cloud-provider-gcp-cloud-controller-manager-fips, gitlab-rails-ce, vertical-pod-autoscaler-fips, age, vitess, mc, blob-csi-fips, terraform-provider-time-fips, consul-k8s, minio-object-browser-fips, kuberay-operator-fip...

GO-2025-4009 vulnerabilities

Vulnerabilities for packages: dagdotdev, localstack, iptables-wrappers, istio, cloud-provider-gcp-cloud-controller-manager-fips, gitlab-rails-ce, vertical-pod-autoscaler-fips, age, vitess, mc, blob-csi-fips, terraform-provider-time-fips, consul-k8s, minio-object-browser-fips, kuberay-operator-fip...

GO-2025-3749 vulnerabilities

Vulnerabilities for packages: dagdotdev, localstack, secrets-store-csi-driver-fips, istio, sigstore-scaffolding-fips, aws-flb-firehose, vertical-pod-autoscaler-fips, cilium-envoy-fips, kubernetes-csi-external-provisioner-fips, cilium-cli, age, splunk-otel-collector, mc, blob-csi-fips,...

GO-2025-3553 vulnerabilities

Vulnerabilities for packages: minio-operator, git-sync-fips, tkn, cluster-autoscaler, kaniko, wal-g, glab, terraform-provider-azurerm, sigstore-scaffolding-fips, kaniko-fips, velero-fips, grafana, kuma, flyte, sigstore-scaffolding, splunk-otel-collector, harbor-registry-fips, mc, step, k8sgpt,...

GO-2024-3321 vulnerabilities

Vulnerabilities for packages: dagdotdev, secrets-store-csi-driver-fips, kaniko, argo-events, wolfictl, go-discover, rabbitmq-messaging-topology-operator, sigstore-scaffolding-fips, kiali-fips, cilium-cli, age, splunk-otel-collector, mc, gitea-fips, podman, crossplane-provider-azure-storage,...