CVE-2026-74738 regmap: sdw-mbq: don't call an unset readable_reg callback

In the Linux kernel, the following vulnerability has been resolved: regmap: sdw-mbq: don't call an unset readablereg callback regmapsdwmbqpollbusy decides whether to poll the Function Busy bit by calling ctx-readablereg, which is a straight copy of config-readablereg. That callback is optional:...

CVE-2026-74739 net/sched: cls_u32: skip hash tables in u32_bind_class()

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsu32: skip hash tables in u32bindclass u32walk enumerates both struct tcuhnode and struct tcuknode through the walker callback. u32bindclass unconditionally casts the passed fh to tcuknode and accesses &n-res, so whe...

CVE-2026-74737 net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw-nuss: Fix portid extraction from SRC TAG On the packet reception path, the ID of the MAC Port on which the packet was received, is embedded in the RX DMA Descriptor's metadata. The ID is extracted usi...

CVE-2026-74735 l2tp: fix tunnel and session refcount leak on seq_file release

In the Linux kernel, the following vulnerability has been resolved: l2tp: fix tunnel and session refcount leak on seqfile release In pppol2tpprocopen and l2tpdfsseqopen, iteration state pd-tunnel and pd-session is kept in seqfile private data to allow iteration across multiple read system calls...

CVE-2026-74736 net/sched: cls_bpf: reject dev-bound programs bound to a different device

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsbpf: reject dev-bound programs bound to a different device clsbpfprogfromefd obtained a SCHEDCLS program via bpfproggettypedev but never verified that a device-bound offloaded program's bound netdev matches the TC...

CVE-2026-74734 firewire: ohci: fix NULL pointer dereference in ar_context_release

In the Linux kernel, the following vulnerability has been resolved: firewire: ohci: fix NULL pointer dereference in arcontextrelease During the error handling path of the driver's probe function, a NULL pointer dereference can occur in arcontextrelease. When pciprobe fails early e.g., if...

Trojanized pantheon-agents 0.6.1 and 0.6.2 on PyPI ship a credential stealer (supply-chain account compromise)

Summary The PyPI account that publishes pantheon-agents was compromised in the June 2026 "Hades" PyPI supply-chain attack Mini Shai-Hulud / Miasma lineage. The attacker used a stolen, long-lived PyPI API token to upload trojanized releases pantheon-agents 0.6.1 and 0.6.2 directly to PyPI. Only th...

GHSA-93QJ-5Q5V-3C2H Trojanized pantheon-agents 0.6.1 and 0.6.2 on PyPI ship a credential stealer (supply-chain account compromise)

Summary The PyPI account that publishes pantheon-agents was compromised in the June 2026 "Hades" PyPI supply-chain attack Mini Shai-Hulud / Miasma lineage. The attacker used a stolen, long-lived PyPI API token to upload trojanized releases pantheon-agents 0.6.1 and 0.6.2 directly to PyPI. Only th...

IzPack has Path Traversal in UnpackerBase that allows writing files outside the installation directory via malicious pack entries

Summary IzPack's UnpackerBase.unpack resolves pack-file target paths without any canonical-path or directory-containment check. An attacker who distributes a trojanized installer JAR the format is unsigned can include pack entries whose targetPath contains ../ sequences. When a victim runs the...

GHSA-F63G-88CJ-HJF9 IzPack has Path Traversal in UnpackerBase that allows writing files outside the installation directory via malicious pack entries

Summary IzPack's UnpackerBase.unpack resolves pack-file target paths without any canonical-path or directory-containment check. An attacker who distributes a trojanized installer JAR the format is unsigned can include pack entries whose targetPath contains ../ sequences. When a victim runs the...

Security update for go1.27

This update for go1.27 fixes the following issues: go1.27.0 released 2026-08-19 is a major release of Go. go1.27.x minor releases will be provided through August 2027. https://github.com/golang/go/wiki/Go-Release-Cycle go1.27 arrives six months after Go 1.26. Most of its changes are in the...

chpwd

DEPRECATO Questa è una vecchia versione di un vault di password CLI. Lo sviluppo è stato spostato su vlt: https://codeberg.org/artich0ke/vlt mirror GitHub: https://github.com/b0lbas/vlt. Puoi ancora scaricare l'utility / usarla come archivio personale di password, tuttavia, nessuna delle due è...

duchamp-root

中文 | English +One-Click+Root;CVE-2026-43499+\IonStack+Exploit;710%E8%A7%A3%E9%94%81%E8%8A%82%E6%9C%80%E6%96%B0%E5%8A%9B%E4%BD%9C+%F0%9F%94%A5 -blue -green ⚡ Orgoglioso utente di JetBrains Mono ⚡ Questa README usa esclusivamente JetBrains Mono. Comic Sans è vietato. !IMPORTANT 🚨 Disclaimer Questo...

CVE-2026-39912

CVE-2026-39912 - Xboard / V2Board Account Takeover non autenticato Fuga del token del link magico in loginWithMailLink | ---|--- CVE| CVE-2026-39912 CVSS| 9.1 Critical CWE| CWE-201 Insertion of Sensitive Information Into Sent Data Interessati| V2Board = 1.6.1 through 1.7.4 / Xboard all versions...

audit-kernel

Sottosistema Audit del Kernel Linux https://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit.git https://github.com/linux-audit/audit-kernel Il sottosistema di audit di Linux fornisce un framework di logging sicuro utilizzato per catturare e registrare eventi rilevanti per la sicurezza. È...

regipy

regipy ⚠️ Breaking Changes in v6.0.0 Version 6.0.0 includes significant modernization changes: Python 3.9+ required - Dropped support for Python 3.6, 3.7, and 3.8 attrs library removed - Data classes now use Python's built-in dataclasses module If your code imports internal classes Cell,...

regipy

regipy ⚠️ Modifiche importanti in v6.0.0 La versione 6.0.0 include importanti modifiche di modernizzazione: Richiede Python 3.9+ - Supporto terminato per Python 3.6, 3.7 e 3.8 Rimossa la libreriaattrs - Le classi data ora usano il modulo dataclasses integrato di Python Se il tuo codice importa...

In0ri

In0ri è un sistema automatizzato di rilevamento di defacement di siti web basato su intelligenza artificiale. Introduzione In0ri funge da watchdog intelligente per le tue applicazioni web. Invece di basarsi sul monitoraggio tradizionale del codice sorgente, simula il comportamento di un utente...

Security Bulletin: Multiple Vulnerabilities in IBM Concert Operate / IBM Cloud Pak for AIOps

Summary Multiple vulnerabilities were addressed in IBM Concert Operate version 5.1.9 Vulnerability Details CVEID:CVE-2026-54058 DESCRIPTION: Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path,...

SigDigger

SigDigger - L'analizzatore di segnali digitali libero SigDigger è un analizzatore di segnali digitali libero per GNU/Linux e macOS, progettato per estrarre informazioni da segnali radio sconosciuti. Supporta una varietà di dispositivi SDR tramite SoapySDR e consente la demodulazione regolabile di...