USN-8530-2: Linux kernel (HWE) vulnerabilities

It was discovered that the Linux kernel did not properly handle shared page fragments during socket buffer operations, collectively known as Dirty Frag. A logic flaw existed in the XFRM ESP-in-TCP subsystem and in the RxRPC networking subsystem when processing paged fragments. A local attacker...

Malicious code in in-install (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58b0bedeac5b8460ad12e0ef3e013f8146eb2b7adacd483c3b8833f1dcbb457b [email protected] declares its ltidisafe dependency as an HTTPS tarball URL hosted on a Google Cloud Storage bucket...

MAL-2026-13982 Malicious code in in-install (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58b0bedeac5b8460ad12e0ef3e013f8146eb2b7adacd483c3b8833f1dcbb457b [email protected] declares its ltidisafe dependency as an HTTPS tarball URL hosted on a Google Cloud Storage bucket...

CVE-2026-48099

CVE-2026-48099 - WsgiDAV directory traversal via encoded dot segments WsgiDAV

PhotoPrism WebDAV Sync path traversal allows writing to arbitrary paths

PhotoPrism WebDAV Sync path traversal allows writing to arbitrary paths Vulnerability Overview PhotoPrism supports WebDAV sync: after an administrator configures a WebDAV remote, a background worker pulls the remote directory listing and downloads files to the local sync directory. The local...

CVE-2026-55402

CVE-2026-55402 is an out of bounds read vulnerability in Secure Access servers prior to version 14.57. Attackers with an ‘in the middle’ position can send specially crafted data to a server causing a persistent denial of service...

CVE-2026-55402

An out-of-bounds read vulnerability in Secure Access servers prior to version 14.57 could allow a man-in-the-middle attacker to send specially crafted data to trigger a persistent denial of service. The connected documents do not specify the exact vulnerable component, underlying root cause detai...

CVE-2026-55402

CVE-2026-55402 is an out of bounds read vulnerability in Secure Access servers prior to version 14.57. Attackers with an ‘in the middle’ position can send specially crafted data to a server causing a persistent denial of service...

Malicious Package

Overview in-install is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

JLSEC-2026-1317

Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to version 0.28.8, an out-of-bounds read was found in Exiv2. The vulnerability is in the preview component, which is only triggered when running Exiv2 with an extra...

JLSEC-2026-1310

Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in Exiv2 versions v0.27.4 and earlier. The out-of-bounds read is triggered when Exiv2 is used to read the metadata of a crafted image file. An...

CVE-2026-70454

rsync 3.2.0 through 3.2.3 openssl mode and rsync-ssl through 3.4.4 stunnel mode contain a TLS certificate validation vulnerability that allows on-path attackers to intercept encrypted sessions by presenting self-signed or otherwise invalid certificates. Attackers can exploit the failure to valida...

org.postgresql/postgresql: com.ongres.scram/scram-client: pgjdbc: Man-in-the-middle protection bypass via SCRAM-SHA-256-PLUS downgrade

A flaw was found in pgjdbc, an open-source PostgreSQL JDBC Driver. A remote attacker who can intercept a TLS Transport Layer Security connection can silently downgrade connections configured to require channel binding from SCRAM-SHA-256-PLUS to plain SCRAM-SHA-256. This downgrade bypasses the...

com.ongres.scram/scram-client: com.ongres.scram/scram-common: SCRAM Libraries: Authentication downgrade via TLS man-in-the-middle attack

A flaw was found in the SCRAM Salted Challenge Response Authentication Mechanism client and common libraries. An attacker performing a man-in-the-middle MITM attack on a Transport Layer Security TLS connection can silently downgrade the authentication process. This vulnerability allows the attack...

org.apache.camel/camel-vertx-http: Apache Camel (camel-vertx-http): Remote Code Execution via Deserialization of Untrusted Data

A flaw was found in the camel-vertx-http component of Apache Camel. This vulnerability, a Deserialization of Untrusted Data, could allow a remote attacker to execute arbitrary code. By controlling the backend server or acting as a man-in-the-middle, an attacker could send a specially crafted...

CVE-2026-70454

rsync 3.2.0 through 3.2.3 openssl mode and rsync-ssl through 3.4.4 stunnel mode contain a TLS certificate validation vulnerability that allows on-path attackers to intercept encrypted sessions by presenting self-signed or otherwise invalid certificates. Attackers can exploit the failure to valida...

CVE-2026-70454 rsync < 3.5.0 TLS Certificate Validation Bypass via SSL/OpenSSL Mode

rsync 3.2.0 through 3.2.3 openssl mode and rsync-ssl through 3.4.4 stunnel mode contain a TLS certificate validation vulnerability that allows on-path attackers to intercept encrypted sessions by presenting self-signed or otherwise invalid certificates. Attackers can exploit the failure to valida...

CVE-2026-70454 rsync < 3.5.0 TLS Certificate Validation Bypass via SSL/OpenSSL Mode

rsync 3.2.0 through 3.2.3 openssl mode and rsync-ssl through 3.4.4 stunnel mode contain a TLS certificate validation vulnerability that allows on-path attackers to intercept encrypted sessions by presenting self-signed or otherwise invalid certificates. Attackers can exploit the failure to valida...

CVE-2026-28185

Unauthenticated Broken Authentication in Log in with Google = 1.4.2 versions...

OESA-2026-3402 podman security update

Podman manages the entire container ecosystem which includes pods, containers, container images, and container volumes using the libpod library. Security Fixes: A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM images from an O...