ALSA-2026:46395 Important: go-fdo-server security update

This package provides a server-side implementation of the FIDO Device Onboard FDO specification, written in Go. FDO is an open standard for the late binding of device credentials, allowing for automated and secure on-boarding of devices when they are first powered on in their final location...

PT-2026-65378

Gitea: Fork Synchronization Continues After Parent Repository Changes from Public to Private in code.gitea.io/gitea...

PT-2026-65356

Gitea: Repository migration SSRF via multi-answer DNS allow-list bypass in gitea.dev...

PT-2026-64979

Relative Path Traversal vulnerability in Erlang OTP stdlib zip module allows writing files outside the intended extraction directory via a crafted zip archive. zip:unzip/1,2 and zip:extract/1,2 validate entry paths using zip:check dir level/2, which tracks directory depth as a running integer...

PT-2026-65374

Gitea: Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service in code.gitea.io/gitea...

PT-2026-65224

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x setup bpa10x setup sends the vendor command 0xfc0e and passes the response to bt dev info and hci set fw info as a "%s" string starting at skb-data + 1, without...

PT-2026-64878

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.24.0 Description An infinite loop issue exists in the Python, Go, PHP, and Java bindings of Apache Thrift. This occurs due to a loop with an unreachable exit condition within the TCompactProtocol varint...

PT-2026-64882

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.24.0 Description Improper handling of highly compressed data leads to a data amplification issue in the C++, Java, Python, Go, D, and C/GLib bindings. This occurs within the TZlibTransport decompression proces...

Xalgorix Autonomous AI Pentesting Agent 4.5.87

Most scanners detect. Xalgorix proves. An autonomous LLM agent works a full pentest methodology, then an independent verifier re-exploits every finding before it's reported - so you get proof, not a pile of maybes to triage. Self-hosted, private, and bring-your-own-LLM. Built in Go + TypeScript...

go-fdo-server security update

1.0.1-3 - Rebuild against updated golang...

Security Advisory 0144

Security Advisory 0144 PDF Date: July 27, 2026 Revision | Date | Changes ---|---|--- 1.0 | July 27, 2026 | Initial release The CVE-ID tracking this issue: CVE-2026-16812 CVSSv3.1 Base Score: 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVSSv4.0 Base Score: 10.0...

PT-2026-65347

Several Avro decoder paths read attacker-controlled 64-bit values from the wire format and either narrowed them to platform-sized int before bounds-checking, or summed them with overflow-prone signed-int arithmetic. On 32-bit targets, the truncation paths can silently bypass byte-slice limits,...

PT-2026-64885

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.24.0 Description An integer overflow or wraparound issue exists in the C++, c glib, Go, netstd, Delphi, and Haxe bindings. The flaw is located in the checkReadBytesAvailable function of the TProtocol class...

📄 vBulletin 6.2.1 Remote Code Execution

vBulletin version 6.2.1 and prior 6.x versions, along with version 5.7.5 and prior 5.x versions, contain a pre-authentication remote code execution vulnerability in the vB5TemplateRuntime::runMaths method. Insufficient input validation allows a crafted vb:math expression to bypass the regular...

Important: grafana security, bug fix, and enhancement update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation CVE-2026-44740 Bug Fixes and Enhancements: grafana / almalinux-8.10.z...

RHEL 10 : go-fdo-client (RHSA-2026:46394)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:46394 advisory. go-fdo-client is the device-side implementation of FIDO Device Onboard specification in Go. It provides an FDO client that interacts with FDO...

MiracleLinux 8 : [security - high] container-tools:rhel8, udica-0.2.6-21.module+el8+2010+faa02dac (AXSA:2026-1348:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1348:01 advisory. net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME CVE-2026-33811 golang.org/x/crypto/ssh: golang:...

ALSA-2026:46391 Important: grafana security, bug fix, and enhancement update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation CVE-2026-44740 Bug Fixes and Enhancements: grafana / almalinux-8.10.z...

ALSA-2026:46394 Important: go-fdo-client security update

go-fdo-client is the device-side implementation of FIDO Device Onboard specification in Go. It provides an FDO client that interacts with FDO manufacturer and owner servers to perform device on-boarding. Security Fixes: crypto/x509: golang: golang crypto/x509: Denial of Service via excessive...

Security update for trivy (important)

openSUSE Security Update: Security update for trivy Announcement ID: openSUSE-SU-2026:0263-1 Rating: important References: 1266495 1268356 1269269 1269271 1271658 1271670 Cross-References: CVE-2026-39821 CVE-2026-46680 CVE-2026-50151 CVE-2026-54448 CVE-2026-55092 CVE-2026-56852 CVSS scores:...