Security update for openssl-3-livepatches

This update for openssl-3-livepatches fixes the following issues: HollowByte: DoS vector against OpenSSL TLS ClientHello via remote, attacker-controlled memory allocations bsc1271712, bsc1271713. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like Ya...

CVE-2026-17494

CVE-2026-17494 is a stack-based buffer overflow (CWE-121) in the interface between the BMC and host system of IBM Power Systems Firmware. Affected versions are FW1120.00 and FW1110.00 through FW1110.30 . An attacker with service access to the BMC can send a specially crafted command to achieve ar...

EUVD-2026-62686

IBM Power Systems Firmware FW1120.00, and FW1110.00 through FW1110.30 is affected by a vulnerability in the interface between the BMC and the host system. An attacker with service access to the BMC can send a specially crafted command, allowing arbitrary code to be executed on the host system,...

CVE-2026-17494 Power System Buffer Overflow

IBM Power Systems Firmware FW1120.00, and FW1110.00 through FW1110.30 is affected by a vulnerability in the interface between the BMC and the host system. An attacker with service access to the BMC can send a specially crafted command, allowing arbitrary code to be executed on the host system,...

CVE-2026-17494 Power System Buffer Overflow

IBM Power Systems Firmware FW1120.00, and FW1110.00 through FW1110.30 is affected by a vulnerability in the interface between the BMC and the host system. An attacker with service access to the BMC can send a specially crafted command, allowing arbitrary code to be executed on the host system,...

exploit-development-framework

Exploit Development Framework EDF A modular, educational ex...

lamda v10.6

FIRERPA Android ｜ AI-Powered Automation An all-in-one Android automation framework that combines on-device services, AI-ready agents, and extensible tool invocation. Documentation | 使用文档 | TELEGRAM | QQ Group | SKILLS | llms-full.txt | 中文版本 FIRERPA is an all-in-one Android device control platform...

CVE-2026-19321 Power System Integer Overflow

Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 is affected by a vulnerability in the host firmware. An attacker with service access to the service processor can supply a carefully crafted command that could leak the contents of hardware registers th...

CVE-2026-19321

IBM Power Firmware is vulnerable due to CWE-190: Integer Overflow or Wraparound in host firmware. An attacker with service-processor access can craft commands to leak inaccessible hardware registers, causing limited confidentiality and high availability impact (CVSS 6.7). Affected versions includ...

CVE-2026-19321 Power System Integer Overflow

Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 is affected by a vulnerability in the host firmware. An attacker with service access to the service processor can supply a carefully crafted command that could leak the contents of hardware registers th...

EUVD-2026-62682

Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 is affected by a vulnerability in the host firmware. An attacker with service access to the service processor can supply a carefully crafted command that could leak the contents of hardware registers th...

CVE-2026-75149

marimo before 0.23.15 contains a code injection vulnerability in the notebook configuration handler that allows attackers to execute arbitrary commands by supplying a crafted MCP server entry with an attacker-controlled command value embedded in a notebook. When the notebook is opened in edit mod...

CVE-2026-72410

A flaw was found in the Linux kernel's octeontx2-af driver. This vulnerability stems from an incorrect validation check when setting the maximum number of NIX Logical Functions LFs using the devlink command. An attacker could potentially exploit this to configure the system in an unintended state...

CVE-2026-63641

A flaw was found in MagicMirror. The Socket.IO server in MagicMirror does not properly enforce the configured IP whitelist, allowing an unauthenticated client on an adjacent network to connect directly to module Socket.IO namespaces. This bypass enables the client to dispatch arbitrary events and...

CVE-2026-76231

A flaw was found in Renovate. Attackers with repository write access can exploit a command injection vulnerability in the hermit manager. This occurs because user-provided dependency names are not properly sanitized when appended to install and uninstall commands. Successful exploitation allows a...

CVE-2026-76228

A flaw was found in Renovate. This command injection vulnerability occurs when Renovate processes Gradle Wrapper updates. An attacker can introduce a malicious gradle-wrapper.properties file into a scanned repository, where a specially crafted distributionUrl containing shell command substitution...

CVE-2026-74458

A flaw was found in the Kvaser USB CAN driver kvaserusbleaf in the Linux kernel. This vulnerability occurs due to insufficient validation of received command lengths from a USB buffer. A malicious or malformed command shorter than the expected header length, or one that exceeds the destination...

CVE-2026-75149 marimo < 0.23.15 Code Injection via MCP Server Configuration

marimo before 0.23.15 contains a code injection vulnerability in the notebook configuration handler that allows attackers to execute arbitrary commands by supplying a crafted MCP server entry with an attacker-controlled command value embedded in a notebook. When the notebook is opened in edit mod...

EUVD-2026-62665

marimo before 0.23.15 contains a code injection vulnerability in the notebook configuration handler that allows attackers to execute arbitrary commands by supplying a crafted MCP server entry with an attacker-controlled command value embedded in a notebook. When the notebook is opened in edit mod...

CVE-2026-75149

The marimo Python notebook framework (versions before 0.23.15) launches attacker-controlled commands embedded in a notebook's MCP server configuration as local subprocesses upon opening in edit mode, requiring no authentication or cell execution. CVSS 3.1 scores this HIGH (8.8). Upgrade to 0.23.1...