SUSE CVE-2026-21444

libtpms, a library that provides software emulation of a Trusted Platform Module, has a flaw in versions 0.10.0 and 0.10.1. The commonly used integration of libtpms with OpenSSL 3.x contained a vulnerability related to the returned IV initialization vector when certain symmetric ciphers were used...

SHARP routers missing authentication for some web APIs

Overview SHARP routers do not perform authentication for some web APIs. Those web APIs provide device information, and the initial administrative password is based on a part of the device information. Missing authentication for critical function CWE-306 - CVE-2026-32326 Shota Zaizen reported this...

EUVD-2026-15194

SHARP routers do not perform authentication for some web APIs. The device information may be retrieved without authentication. If the administrative password of the device is left as the initial one, the device may be taken over...

SUSE-SU-2026:20834-1 Security update for the initial kernel livepatch

This update contains initial livepatches for the SUSE Linux Enterprise Server 16.0 and SUSE Linux Micro 6.2 kernel update...

U.S. Sentences Russian Hacker to 6.75 Years for Role in $9M Ransomware Damage

A 26-year-old Russian citizen has been sentenced in the U.S. to 6.75 years 81 months in prison for his role in assisting major cybercrime groups, including the Yanluowang ransomware crew, in conducting numerous attacks against U.S. companies and other organizations. According to the U.S. Departme...

New Search Experience for Veeam Data Cloud for Microsoft 365

Scope of This Article This article describes only the new search experience in Veeam Data Cloud for Microsoft 365. It does not cover all available search functions. Direct Search and Advanced Search remain available and support capabilities that are not yet part of the new search. For example,...

CVE-2026-33039

WWBN AVideo is an open source video platform. In versions 25.0 and below, the plugin/LiveLinks/proxy.php endpoint validates user-supplied URLs against internal/private networks using isSSRFSafeURL, but only checks the initial URL. When the initial URL responds with an HTTP redirect Location heade...

CVE-2023-43010

A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling. Mitigation Do not process or load untrusted web content with WebKitGTK. In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server,...

GHSA-GFGR-6HRJ-85WW Juju affected by timing ownership claim attack on new external back-end secrets

A race condition in the secrets management subsystem of Juju versions 3.0.0 through 3.6.18 allows an authenticated unit agent to claim ownership of a newly initialized secret. Between generating a Juju Secret ID and creating the secret's first revision, an attacker authenticated as another unit...

SUSE CVE-2026-23247

In the Linux kernel, the following vulnerability has been resolved: tcp: secureseq: add back ports to TS offset This reverts 28ee1b746f49 "secureseq: downgrade to per-host timestamp offsets" tcptwrecycle went away in 2017. Zhouyan Deng reported off-path TCP source port leakage via SYN cookie...

GHSA-QWXP-6QF9-WR4M PinchTab has a Blind SSRF via browser-side redirect bypass in /download URL validation

The /download endpoint validates only the initial URL provided by the user using validateDownloadURL to prevent requests to internal or private network addresses. Exploitation requires \security.allowDownload=true, which is disabled by default. However, pages loaded by the embedded Chromium brows...

The Attack Cycle is Accelerating: Announcing the Rapid7 2026 Global Threat Landscape Report

The predictive window has collapsed. In 2025, high-impact vulnerabilities weren’t quietly accumulating risk. They were operationalized, and often within days. Today, Rapid7 Labs released the 2026 Global Threat Landscape Report, an in-depth analysis of how attacker behavior is evolving across...

Malicious code in initial-path32 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 71e77f0ff5d620fe6b79ce6c0ba799edb94b5ec3b8eea98b7da903d2f70e9c86 The package initial-path32 was found to contain malicious code...

MAL-2026-1749 Malicious code in initial-path32 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 71e77f0ff5d620fe6b79ce6c0ba799edb94b5ec3b8eea98b7da903d2f70e9c86 The package initial-path32 was found to contain malicious code...

Malicious code in initial-path21 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9016e70b5df975a1a657b63786d763547450ae6c1899e11e100eb25ba0fe1392 The package initial-path21 was found to contain malicious code...

MAL-2026-1748 Malicious code in initial-path21 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9016e70b5df975a1a657b63786d763547450ae6c1899e11e100eb25ba0fe1392 The package initial-path21 was found to contain malicious code...

Malicious code in aboba-initial (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c2bc49e5fcbf02e59b7bcf6e398b57d9376722e9836dc06141e4b1fbeac1cb1f The package aboba-initial was found to contain malicious code...

MAL-2026-1645 Malicious code in aboba-initial (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c2bc49e5fcbf02e59b7bcf6e398b57d9376722e9836dc06141e4b1fbeac1cb1f The package aboba-initial was found to contain malicious code...

EUVD-2026-12810

In the Linux kernel, the following vulnerability has been resolved: tcp: secureseq: add back ports to TS offset This reverts 28ee1b746f49 "secureseq: downgrade to per-host timestamp offsets" tcptwrecycle went away in 2017. Zhouyan Deng reported off-path TCP source port leakage via SYN cookie...

CVE-2026-32691

A race condition in the secrets management subsystem of Juju versions 3.0.0 through 3.6.18 allows an authenticated unit agent to claim ownership of a newly initialized secret. Between generating a Juju Secret ID and creating the secret's first revision, an attacker authenticated as another unit...