Security Bulletin: This Power System update is being released to address CVE-2026-96262

Summary Power Systems Firmware is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to overflow host firmware runtime attribute storage, allowing arbitrary code to be...

MAL-2026-17302 Malicious code in solidity-lock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e283fd2d07e81705e23d5756d15edd4ff4dc7a074d375111155ef9dca1fd9b8 The package's declared main index.js is a trivial no-op Express middleware whose only real effect is to require'./lib/config', a 4 MB...

Malicious code in solidity-lock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e283fd2d07e81705e23d5756d15edd4ff4dc7a074d375111155ef9dca1fd9b8 The package's declared main index.js is a trivial no-op Express middleware whose only real effect is to require'./lib/config', a 4 MB...

EUVD-2026-89484

anchorme through 3.0.8 contains a regular expression denial of service vulnerability in the IPv6 host extraction regex due to catastrophic backtracking. Attackers can supply specially crafted input strings with repeated patterns to cause exponential regex engine backtracking, blocking the Node.js...

CVE-2026-102984: Uncaught Exception

Astro is a web framework for content-driven websites. Prior to 11.1.3, the @astrojs/node adapter builds a request URL from the Host header, and a malformed port can make that URL invalid. The recovery path reuses the same malformed host and throws an uncaught TypeError: Invalid URL before routing...

PT-2026-103281

Astro is a web framework for content-driven websites. Prior to 11.1.3, the @astrojs/node adapter builds a request URL from the Host header, and a malformed port can make that URL invalid. The recovery path reuses the same malformed host and throws an uncaught TypeError: Invalid URL before routing...

PT-2026-103085

Name of the Vulnerable Software and Affected Versions Moodle affected versions not specified Description Incorrect handling of IPv4-mapped IPv6 addresses within the URL downloader's host-blocking logic allows an authenticated remote user to bypass blocked-host restrictions. By supplying a crafted...

PT-2026-103617

Name of the Vulnerable Software and Affected Versions DB-GPT version 0.8.0 Description The sandbox API silently falls back to LocalRuntime, which allows for the execution of arbitrary code on the host system. Recommendations At the moment, there is no information about a newer version that contai...

PT-2026-105534

Summary In the Astro Node adapter, a request whose Host header contains a malformed port for example example.com:65536 or example.com:8080:8080 produced an invalid request URL. The fallback intended to recover from an unparseable URL reused the same malformed host, so it failed again and raised a...

ROS-20260930-73-0143

The vulnerability in the drivers/nvme/host/fc.c module of the Linux operating system is related to the improper shutdown or release of resources. Exploiting this vulnerability can allow an attacker to cause service failures...

AlmaLinux 9.2 [TuxCare] Security Update: systemd / systemd-boot-unsigned / systemd-container / systemd-devel / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1787064068)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1787064068 advisory. - In udev in systemd before 260, local root execution can occur via malicious hardware devices and unsanitized kernel output...

AlmaLinux 9.6 [TuxCare] Security Update: grafana / grafana-selinux (ALMALINUX9.6:CLSA-2026:1776070934)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1776070934 advisory. - url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. CVE-2026-25679 Note that Nessus has not...

CentOS Linux 7 [TuxCare] Security Update: wget (CENTOS7:CLSA-2024:1723796201)

The CentOS Linux 7 host has a package installed that is affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2024:1723796201 advisory. - url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which...

Rocky Linux 9.6 [TuxCare] Security Update: buildah / buildah-tests (ALMALINUX9.6:CLSA-2026:1778254382)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1778254382 advisory. - url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. CVE-2026-25679 Note that Nessus has not...

CVE-2026-51869

DB-GPT v0.8.0 sandbox API silently falls back to LocalRuntime and executes code on host...

CVE-2026-102577: Server-Side Request Forgery (SSRF)

A flaw was found in Moodle. Incorrect handling of IPv4-mapped IPv6 addresses within the URL downloader's host-blocking logic allows an authenticated remote user to bypass blocked-host restrictions. By supplying a crafted URL, an attacker can induce the server to make requests to restricted...

PT-2026-103311

🚨 CVE-2026-100264 In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the server host 🎖@cveNotify...

Rocky Linux 9.6 [TuxCare] Security Update: flatpak / flatpak-devel / flatpak-libs / flatpak-selinux / etc (ALMALINUX9.6:CLSA-2026:1781603962)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1781603962 advisory. - Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal accepts paths in the...

AlmaLinux 9.6 [TuxCare] Security Update: flatpak / flatpak-devel / flatpak-libs / flatpak-selinux / etc (ALMALINUX9.6:CLSA-2026:1781603962)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1781603962 advisory. - Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal accepts paths in the sandbox-expo...

Rocky Linux 9.6 [TuxCare] Security Update: spice-vdagent (ALMALINUX9.6:CLSA-2026:1786552586)

The Rocky Linux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1786552586 advisory. - A path traversal vulnerability was found in spice-vdagent. This flaw allows a malicious or compromised SPICE host to write arbitrary file...