Turbo Frame responses can restore stale session cookies

Summary A race condition in Turbo Frames allows delayed HTTP responses to restore stale session cookies after session-modifying operations. Details Browsers automatically process Set-Cookie headers from HTTP responses. When a Turbo Frame request is in-flight during a session-modifying action such...

CVE-2026-22031

@fastify/middie is the plugin that adds middleware support on steroids to Fastify. A security vulnerability exists in @fastify/middie prior to version 9.1.0 where middleware registered with a specific path prefix can be bypassed using URL-encoded characters e.g., /%61dmin instead of /admin. While...

Could ChatGPT Convince You to Buy Something?

Eighteen months ago, it was plausible that artificial intelligence might take a different path than social media. Back then, AI's development hadn't consolidated under a small number of big tech firms. Nor had it capitalized on consumer attention, surveilling users and delivering ads...

SUSE-SU-2026:20268-1 Security update for abseil-cpp

This update for abseil-cpp fixes the following issues: Update to version 20230802.3: - CVE-2025-0838: Fixed potential integer overflow in hash container create/resize 1813 bsc1237543...

CVE-2025-66523

URL parameters are directly embedded into JavaScript code or HTML attributes without proper encoding or sanitization. This allows attackers to inject arbitrary scripts when an authenticated user visits a crafted link. This issue affects na1.foxitesign.foxit.com: before 2026‑01‑16...

DEBIAN-CVE-2026-23949

jaraco.context, an open-source software package that provides some useful decorators and context managers, has a Zip Slip path traversal vulnerability in the jaraco.context.tarball function starting in version 5.2.0 and prior to version 6.1.0. The vulnerability may allow attackers to extract file...

CVE-2026-23874 ImageMagick's MSL: Stack overflow via infinite recursion in ProcessMSLScript

ImageMagick is free and open-source software used for editing and manipulating digital images. Versions prior to 7.1.2-13 have a stack overflow via infinite recursion in MSL Magick Scripting Language command when writing to MSL format. Version 7.1.2-13 fixes the issue...

CVE-2026-23947

CVE-2026-23947 / CVE-2026-25141 affect Orval’s OpenAPI JS client generator. Vulnerable in versions prior to 7.21.0 (and 8.2.0) with incomplete/patchy fixes; an attacker can inject arbitrary code via x-enumDescriptions during const enum generation, leading to code execution in generated clients. T...

Oracle Fusion Middleware security vulnerabilities

Oracle Fusion Middleware is a business innovation platform developed by Oracle Corporation for enterprise and cloud environments. This platform provides middleware, software collections, and other functions. WebLogic Server is an application server component suitable for both cloud and traditiona...

Oracle Virtualization security vulnerabilities

Oracle Virtualization is a virtualization solution developed by Oracle, a company in the United States. This product is used for unified management of the entire hardware and software system, from applications to disks, enabling virtualization from desktops to data centers. VM VirtualBox is one o...

PT-2026-3677

Name of the Vulnerable Software and Affected Versions Oracle Solaris version 11 Description An issue exists within the Driver component of Oracle Solaris that could allow a high-privileged attacker with access to the system to compromise the operating system. Successful exploitation requires...

MiracleLinux 8 : postgresql:13 (AXSA:2022-2993:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2022-2993:01 advisory. postgresql: memory disclosure in certain queries CVE-2021-3677 postgresql: server processes unencrypted bytes from man-in-the-middle CVE-2021-23214...

MiracleLinux 8 : python27:2.7 (AXSA:2022-3551:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2022-3551:01 advisory. python: urllib: Regular expression DoS in AbstractBasicAuthHandler CVE-2021-3733 python: ftplib should not use the host from the PASV response...

MiracleLinux 9 : qt5 (AXSA:2023-4961:01)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2023-4961:01 advisory. qt: QProcess could execute a binary from the current working directory when not found in the PATH CVE-2022-25255 Tenable has extracted the preceding...

Qnap QTS and QuTS hero Out-of-bounds Read (CVE-2025-54165)

An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data. We have already fixed the vulnerability in the following versions: QTS...

MiracleLinux 7 : containernetworking-plugins-0.8.3-3.el7 (AXSA:2020-186:02)

The remote MiracleLinux 7 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2020-186:02 advisory. containernetworking/plugins: IPv6 router advertisements allow for MitM attacks on IPv4 clusters CVE-2020-10749 Tenable has extracted the preceding description...

MiracleLinux 8 : git-2.18.2-2.el8 (AXSA:2020-270:05)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2020-270:05 advisory. git: Crafted URL containing new lines can cause credential leak CVE-2020-5260 Tenable has extracted the preceding description block directly from the...

LLM Security and Safety: Insights from Homotopy-Inspired Prompt Obfuscation

In this study, we propose a homotopy-inspired prompt obfuscation framework to enhance understanding of security and safety vulnerabilities in Large Language Models LLMs. By systematically applying carefully engineered prompts, we demonstrate how latent model behaviors can be influenced in...

PT-2026-3709

Name of the Vulnerable Software and Affected Versions Oracle HTTP Server versions 12.2.1.4.0 through 14.1.2.0.0 Oracle WebLogic Server Proxy Plug-in for Apache HTTP Server versions 12.2.1.4.0 through 14.1.2.0.0 Oracle WebLogic Server Proxy Plug-in for IIS version 12.2.1.4.0 Description An imprope...

MiracleLinux 8 : dotnet6.0-6.0.120-1.el8.ML.1 (AXSA:2023-6237:19)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2023-6237:19 advisory. dotnet: race condition in Core SignInManager PasswordSignInAsync method CVE-2023-33170 Tenable has extracted the preceding description block directly from th...