CVE-2026-16445 Dracut: dracut: root code execution via dhcp options command injection in networkmanager initrd module

A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP options, such as a malicious root-path, next-server, or bootfile name, to a system using dracut's NetworkManager-based initrd network module. These options are...

CVE-2026-16445

A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP options, such as a malicious root-path, next-server, or bootfile name, to a system using dracut's NetworkManager-based initrd network module. These options are...

CVE-2026-16445

A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP options, such as a malicious root-path, next-server, or bootfile name, to a system using dracut's NetworkManager-based initrd network module. These options are...

MAL-2026-10987 Malicious code in react-tabulix-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4338419bb73e69db7de001f3d27b86c8890a0ba3ace3bfa60e09552d1be3ad9c [email protected] declares a preinstall lifecycle hook that runs dist/index.d.js. That file base64-decodes an embedded blob and passes the...

Open-Source Android AI Agents Could Let Invisible Screen Text Run Code on Host PCs

An Android app that can draw over other windows and write to shared storage can slip instructions to the AI agent driving that phone, in text no human eye will ever see. Two more steps, and the same app is running commands on the PC driving the agent. Researchers demonstrated that chain, plus six...

CVE-2026-64003

A flaw was found in the Linux kernel's SCSI Small Computer System Interface core. During a SCSI host recovery, the scsirunhostqueues function may incorrectly ignore devices that are in a partially removed state. This oversight can cause pending requests for these devices to become stuck, leading ...

Malicious code in rasterkit-demo (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d748af7546aacbfca356759d4c81386f113a32dfc80ff8bb75da3eb3c8b4358d rasterkit-demo ships a CLI entry point rasterkit-demo whose rundemo function imports demochannelwindows from PIL.data and passes the returned buffer ...

Mozilla Firefox ESR < 115.38

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 115.38. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-69 advisory. - We are aware that exploit code for this is public however we are not aware of any attacks in the wild...

AlmaLinux 8 : nodejs:22 (ALSA-2026:41947)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:41947 advisory. ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input CVE-2026-42338 undici: undici: Denial of Service due to...

libvirt security update

11.10.0-12.4.0.1 - Set SOURCEDATEEPOCH from changelog Orabug: 32019554 11.10.0-12.4.el102 - cpuconf: Introduce virCPUDefSortFeatures RHEL-180449 - qemucapabilities: Split virQEMUCapsFillDomainCPUCaps RHEL-180449 - qemu: Move domain caps flags handling to virQEMUCapsFillDomainCPUHostModel...

PT-2026-63278

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description The internal API HTTP client in modules/private/internal.go hardcodes TLSClientConfig.InsecureSkipVerify = true, which disables TLS certificate verification for outbound internal requests. When...

PT-2026-63317

Impact If this library is used to implement a WebSocket server on top of a TCP server, by using the WebSocket::Driver.server method, then a client can cause the server to crash by sending a Host header that is not a valid host:port string. When this happens, a URI::InvalidURIError exception is...

CVE-2025-66390

In Microsoft Azure API Management through 2025-10-17, when self-service signup username/password Basic Authentication is enabled in Tenant A, an attacker can reuse the registration flow by changing the hostname or tenant identifier to Tenant B, even when Tenant B has signup disabled at the UI...

PT-2026-62214

Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox version 7.2.12 Description A flaw in the Core component of Oracle VM VirtualBox on Windows hosts allows a low-privileged attacker with access to the infrastructure where the software executes to compromise the system...

CVE-2025-66390

CVE-2025-66390 affects Microsoft Azure API Management Developer Portal: when Basic Authentication signup is enabled in Tenant A, an attacker can register on Tenant B by altering the Host header, bypassing a UI-level signup disable because the underlying /signup API remains accessible and validate...

tomcat9 security update

1:9.0.117-2 - Resolves: RHEL-185571 Remove tomcat clustering JAR from RPM builds 1:9.0.117-1 - Resolves: RHEL-150720 Tomcat: Certificate revocation bypass due to improper OCSP response validation CVE-2026-24734 - Resolves: Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is...

Linux Distros Unpatched Vulnerability : CVE-2026-63030

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the authornotin WPQuery...

EulerOS Virtualization 2.12.0 : curl (EulerOS-SA-2026-2769)

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Using libcurl, when a custom Host: header is first set for an HTTP request and a second request is subsequently done using the same...

MAL-2026-11001 Malicious code in date-format-utils-xz (npm)

The npm package date-format-utils-xz masquerades as a date-formatting utility but is malicious. Its own decoy index.js is prefaced with a Chinese comment translating to "disguised as a normal date formatting tool." Every published version 1.0.0-1.0.4 declares a postinstall lifecycle hook...

MAL-2026-10990 Malicious code in ts-vitest (npm)

ts-vitest is a typosquat of vitest/ts-eslint hollow "kelly-calc"/"clob-math" content, no legitimate functionality that ships a postinstall two-stage fetch-exec dropper. The package.json declares postinstall: node scripts/install-check.cjs; the hook's resolvePeerBundleUrl fetches a JSON config fro...