Debian dla-4645 : cloud-init - security update

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-4645 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4645-1 [email protected] https://www.debian.org/lts/security/...

GHSA-WCMJ-X466-56MM OpenTofu: Provider cache installation follows root-module-controlled package directory symlink and writes outside the working tree

Summary If a symlink already exists under the .terraform/providers directory where a provider package needs to be installed, tofu init would follow that symlink and install the new package content into it. If an attacker can coerce an operator into running tofu init in a directory whose contents...

PT-2026-73163

Name of the Vulnerable Software and Affected Versions OpenTofu versions prior to 1.11.7 Description During initialization, the software fails to validate existing symlinks within the provider cache directory. This allows an attacker to place a malicious symlink in a trusted working directory,...

SUSE-SU-2026:22320-1 Security update for amazon-ecs-init

This update for amazon-ecs-init fixes the following issues Update to version 1.103.2: - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZE bsc1265843. - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded...

OPENSUSE-SU-2026:21013-1 Security update for amazon-ecs-init

This update for amazon-ecs-init fixes the following issues Update to version 1.103.2: - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZE bsc1265843. - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded...

kernel: RDMA/rxe: Fix double free in rxe_srq_from_init

A flaw was found in the Linux kernel's Remote Direct Memory Access RDMA subsystem, specifically within the rxe driver. An error in the rxesrqfrominit function's memory management can lead to a double free vulnerability. This occurs when an attempt to copy data to user space fails, causing the sam...

PT-2026-55278

This update for rpcbind fixes the following issues - Update to rpcbind 1.2.9 bsc1267212 https://lore.kernel.org/linux-nfs/[email protected]/ rpcinfo: stack buffer overflow in rpcinfo rpcbaddrlist rpcbind: Stop unauthenticated oversized allocation in PMAPPROC CALLIT...

Exploit for Use After Free in Linux Linux_Kernel

CVE-2024-1086 Root Cause & Exploitation Target kernels: L...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: drm/xe/pf: Fixed sysfs initialization issues. In case of a failure in devmaddactionorreset, the provided cleanup action will be executed immediately on the not yet initialized kobject. This may lead to errors such as: - kobjec...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Rust: pwm: Fixed a potential memory leak during initialization errors. When initializing a PWM chip using pwmchipalloc, the allocated device requires an initial reference, which must be released in all error scenarios. If...

MAL-2026-5894 Malicious code in create-vercel-integration (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aeaea6bab6360c38ed5a7de7065eb04d0ac489bb3670b68defc8bc26874d3d62 Package name mimics Vercel's official create- initializer convention e.g. create-next-app, targeting developers who mistype or guess the initializer...

Exploit for Code Injection in Apache Nifi

CVE-2023-34468 PoC for Apache NiFi !Pythonhttps://img.shie...

PT-2026-49831

Name of the Vulnerable Software and Affected Versions Real Testimonials Pro affected versions not specified Product Slider Pro for WooCommerce affected versions not specified Smart Post Show Pro affected versions not specified Description A supply chain compromise occurred where attackers...

0xradishsdk (>=1.9.0, <=2.0.2), 2.typescript-init (1.0.0) +5836 more potentially affected by unknown CVE via esbuild (>=0.27.3, <=0.28.0)

esbuild NPM version =0.27.3, =1.9.0, =0.0.1, =0.1.1, =0.1.5, =0.1.0, =1.0.22, =0.1.0, =0.1.6, =0.2.9, =0.0.1, =13.7.0, =0.5.4, =0.0.2, =0.0.5 and more Source cves: unknown CVE Source advisory: SNYK:JS-ESBUILD-17750815...

GHSA-4R3C-5HPG-58QR Russh SSH message fields were decoded through allocation-first parsers before field-specific bounds

SSH message fields were decoded through allocation-first parsers before field-specific bounds Summary Several russh client and server message handlers decoded attacker-controlled SSH strings, name-lists, and byte fields into owned allocations before applying field-specific bounds. A remote SSH pe...

kernel: RDMA/rxe: Fix double free in rxe_srq_from_init

A flaw was found in the Linux kernel's Remote Direct Memory Access RDMA subsystem, specifically within the rxe driver. An error in the rxesrqfrominit function's memory management can lead to a double free vulnerability. This occurs when an attempt to copy data to user space fails, causing the sam...

Important: Red Hat Security Advisory: libsndfile security update

An update for libsndfile is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common...

RHEL 8 : libsndfile (RHSA-2026:25198)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:25198 advisory. libsndfile is a C library for reading and writing files containing sampled sound, such as AIFF, AU, or WAV. Security Fixes: libsndfile: integer...

Malicious code in @thomlecter1122/lab-helper-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75adb75a0025882efbcde3ddd88882aaaedfd692425222eda99c148096f1f58a The package ships a postinstall lifecycle script seccheck.js that fires automatically on npm install. The script first checks whether the host has a...

Important: Red Hat Security Advisory: libsndfile security update

An update for libsndfile is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...