CVE-2026-64566 xfrm: iptfs: propagate SKBFL_SHARED_FRAG in iptfs_skb_add_frags()

In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: propagate SKBFLSHAREDFRAG in iptfsskbaddfrags When iptfsskbaddfrags copies frag references from the source frag walk into a new SKB, it increments the page reference count via skbfragref but does not propagate...

CVE-2026-64566

Consolidated details show CVE-2026-64566 affects the Linux kernel iptfs module. Root cause: when iptfs_skb_add_frags() copies frag references, it increments page refs without propagating SKBFL_SHARED_FRAG to the destination SKB, unlike other frag-transfer helpers. Consequence: if source SKB has s...

CVE-2026-64566

In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: propagate SKBFLSHAREDFRAG in iptfsskbaddfrags When iptfsskbaddfrags copies frag references from the source frag walk into a new SKB, it increments the page reference count via skbfragref but does not propagate...

CVE-2026-64566 xfrm: iptfs: propagate SKBFL_SHARED_FRAG in iptfs_skb_add_frags()

In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: propagate SKBFLSHAREDFRAG in iptfsskbaddfrags When iptfsskbaddfrags copies frag references from the source frag walk into a new SKB, it increments the page reference count via skbfragref but does not propagate...

Malicious code in platform-ui-island (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e678a3a4d4b9e16e6d6223aaa0c6ccaca9b7f2ac95e47940af4e706548e0f111 The package's index.js unconditionally loads bridge.js on require. bridge.js downloads a platform-specific native binary from obfuscated Cloudflare...

MAL-2026-12042 Malicious code in platform-ui-island (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e678a3a4d4b9e16e6d6223aaa0c6ccaca9b7f2ac95e47940af4e706548e0f111 The package's index.js unconditionally loads bridge.js on require. bridge.js downloads a platform-specific native binary from obfuscated Cloudflare...

Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-2014)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2014 advisory. In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU in ip6output CVE-2025-40158 In the Linux kernel, the following vulnerability has been resolved: gpio: Fix...

JLSEC-2026-1137 Issue summary: Receiving a QUIC initial packet with an invalid token may trigger a NULL pointer...

Issue summary: Receiving a QUIC initial packet with an invalid token may trigger a NULL pointer dereference in the OpenSSL QUIC server with address validation disabled. Impact summary: NULL pointer dereference typically causes abnormal termination of the affected QUIC server process and a Denial ...

Security update for bind

This update for bind fixes the following issues: CVE-2026-10723: accepting incorrect child-zone NSEC3 records as valid can allow an attacker to forge authenticated NXDOMAIN responses for sibling zones bsc1271982. CVE-2026-10822: storing a DNS key record with an invalid PRIVATEDNS algorithm...

glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char()

A flaw was found in GLib. A buffer over-read can occur in the gregexreplace function when used with the GREGEXRAW compile flag and case-change replacement escapes because the stringappend function processes matched substrings using UTF-8 functions that assume valid UTF-8 input, even when the stri...

EUVD-2026-52008

The OCPP 1.6 client in subsys/net/lib/ocpp parsed inbound WAMP RPC frames in parserpcmsg subsys/net/lib/ocpp/ocppj.c using a hand-rolled helper, extractstringfield, that copied the message's uid and action fields with strncpyoutbuf, token + 1, outlen - 1 and then scanned the result with...

offensive-security-labs

Offensive Security Labs A collection of hands-on offensive cy...

CVE-2026-15206

The SMS Alert WordPress plugin before 3.9.8 does not bind its "mobile verified" session flag to the phone number that was actually verified: after an attacker verifies an OTP sent to their own phone, the signup/login handler reads a fresh, attacker-supplied phone number to select the account and...

Anthropic Says Claude Mistook the Open Internet for a CTF and Breached Three Organizations

Anthropic on Thursday became the latest artificial intelligence AI company to reveal that three of its models, including Claude Opus 4.7, Mythos 5, and an unnamed research model, had breached three unnamed organizations during cybersecurity testing without its knowledge. The AI firm said the...

CVE-2026-14537

Incorrect Authorization in the direct HTTP API tool invocation endpoint in Google mcp-toolbox versions v1.3.0 and v1.4.0 allows an unauthenticated attacker to invoke tools protected by the scopeRequired feature via sending tool invocation requests through legacy HTTP endpoints when the --enable-a...

CVE-2026-14537

Incorrect Authorization in the direct HTTP API tool invocation endpoint in Google mcp-toolbox versions v1.3.0 and v1.4.0 allows an unauthenticated attacker to invoke tools protected by the scopeRequired feature via sending tool invocation requests through legacy HTTP endpoints when the --enable-a...

CVE-2026-14537 Authorization Bypass in MCP Toolbox Legacy HTTP Endpoints

Incorrect Authorization in the direct HTTP API tool invocation endpoint in Google mcp-toolbox versions v1.3.0 and v1.4.0 allows an unauthenticated attacker to invoke tools protected by the scopeRequired feature via sending tool invocation requests through legacy HTTP endpoints when the --enable-a...

CVE-2026-14537

The CVE-2026-14537 entry concerns Google mcp-toolbox versions v1.3.0 and v1.4.0 with Incorrect Authorization in the direct HTTP API tool invocation endpoint. The underlying issue allows an unauthenticated attacker to invoke tools protected by the scopeRequired feature by sending tool invocation r...

CVE-2026-8804

A flaw was found in Puppet resourceapi. This vulnerability occurs because the resource-api does not properly preserve the sensitive flag on parameters. As a result, sensitive information, such as passwords, can be stored in cleartext within the agent's local transaction state cache. This could...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via improper enforcement of the --permission. An attacker can gain unauthorized access to read from or write to filesystem paths outside the intended allowlist by exploiting boundary handling across radix-tree prefix...