tamago v1.26.6

TamaGo - bare metal Go tamago | https://github.com/usbarmory/tamago Copyright c The TamaGo Authors. All Rights Reserved. Introduction TamaGo is a framework that enables compilation and execution of unencumbered Go applications on bare metal processors AMD64, ARM, ARM64, RISCV64. The projects spaw...

PT-2026-72915

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An AB/BA deadlock exists between the Common Clock Framework CCF and the I2C adapter lock. This occurs when an I2C-controlled clock generator client is registered or modified under the CC...

PT-2026-72858

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the drm/rockchip: inno-hdmi driver. The driver uses drmm encoder init to initialize the encoder and drmm add action to register drm encoder cleanup for...

CVE-2026-49282

Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's public csinsnname API forwards caller-supplied instruction IDs directly to the selected architecture backend. Most backends validate the ID before indexing instruction-name tables, but the M68K and RISCV backends have...

CVE-2026-49263

Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's WebAssembly backend accepts attacker-controlled raw WASM instruction bytes through the public csdisasm and csdisasmiter APIs. For a large but well-formed brtable instruction, the WASM decoder accumulates the immediate...

CVE-2026-49282 Capstone M68K and RISCV `cs_insn_name()` invalid IDs can trigger out-of-bounds reads and process crashes

Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's public csinsnname API forwards caller-supplied instruction IDs directly to the selected architecture backend. Most backends validate the ID before indexing instruction-name tables, but the M68K and RISCV backends have...

cynative v1.9.2

Build your own security agents Open-source framework for security agents with live, read-only access to your infrastructure. Quickstart · Your first agent · Docs Ask your infrastructure anything. Cynative runs frontier models across your code, cloud and runtime - reasoning through GitHub, GitLab,...

CLSA-2026-1786717612 TuxCare security update for org.springframework (7 CVEs)

TuxCare rebuilt 24 org.springframework packages to address 7 CVEs. Fixed in 6.0.23-tuxcare.5...

The OWASP Top 10 for LLM Applications 2026: From Model Risks to Agentic Security

...

Deserialization Of Untrusted Data

Spring Framework is vulnerable to deserialization of untrusted data. The vulnerability is due to MappingJackson2MessageConverter and JacksonJsonMessageConverter allowing arbitrary class instantiation from untrusted JMS messages, which allows an attacker to exploit gadget classes during...

Denial Of Service

Spring Data Commons is vulnerable to Denial Of Service. The vulnerability is due to a StackOverflowException when parsing attacker-controlled Sort parameters, allowing an attacker to exhaust application resources...

VulnScope

VulnScope POC Proof of Concept Vulnerability Verificati...

SUSE CVE-2026-73228

Django REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's request.data parsing in restframework/request.py Request.parse passes the underlying HttpRequest stream to JSONParser and FormParser for application/json and application/x-www-form-urlencoded bodies...

SUSE CVE-2026-73229

Django REST framework is a powerful and flexible toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's restframework/renderers.py AdminRenderer.render uses overridemethod to simulate GET and directly invokes view.get without view.checkpermissions while rendering an invalid write...

BGA: A Noise-Immune Neural Distillation Framework for Malicious Signature Extraction in High-Entropy Encrypted Flows

To mitigate attention dilution in high-entropy TLS 1.3 flows, we propose BGA, a noise-immune neural distillation framework for encrypted threat intelligence.The methodology first employs Analysis of Variance ANOVA to decouple high-discriminatory control-plane features - specifically industrial...

The vulnerability of the UI Framework component of the Oracle Enterprise Manager Base Platform allows a malicious actor to gain unauthorized access to read, modify, or delete data, thereby causing a service failure.

The vulnerability of the UI Framework component of the Oracle Enterprise Manager Base Platform is related to insecure management of privileges. Exploiting this vulnerability could allow an attacker to gain unauthorized access to read, modify, or delete data, as well as cause service failures usin...

The vulnerabilities of Microsoft .NET Framework software and the Visual Studio source code editor allow a perpetrator to execute arbitrary code.

The vulnerability of Microsoft.NET Framework software and the Visual Studio source code editor is related to a numerical overflow condition. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

The vulnerability of the Self Update Framework component of the Oracle Enterprise Manager Base Platform allows a perpetrator to gain full control over the application.

The vulnerability of the Self Update Framework component of the Oracle Enterprise Manager Base Platform software is related to insecure management of privileges. Exploiting this vulnerability could allow an attacker, operating remotely, to gain full control over the application using the HTTPS...

CVE-2026-73661

CVE-2026-73661 affects FreePBX by allowing an authenticated user with backup-restore or backup file write access to craft a backup that restores the hidden AUTHTYPE setting to none via runRestore() in amp_conf/htdocs/admin/libraries/Builtin/Restore.php. This enables bypassing the user‑interface r...

CVE-2026-73661 FreePBX: Authenticated Framework AUTHTYPE Can Be Restored From a Crafted Backup

FreePBX is an open source IP PBX. Prior to 16.0.47 and 17.0.30, the FreePBX Framework module permits a crafted backup to restore the hidden AUTHTYPE setting with the value none through runRestore in ampconf/htdocs/admin/libraries/Builtin/Restore.php. An authenticated user with sufficient...