golang-x-net Uncontrolled Resource Consumption DoS

The vulnerability of the golang-x-net package in the Golang programming language is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

Perl-DBI Database Error DoS

The vulnerability of the Perl-DBI interface for connecting to and working with databases is related to the use of an erroneous operator. Exploiting this vulnerability can allow a malicious actor to cause service failures...

golang-x-net Clickjacking

The vulnerability of the golang-x-net package in the Golang programming language is related to an incorrect limitation on the visible layers of the user interface. Exploiting this vulnerability allows a remote attacker to carry out a clickjacking attack...

golang-x-net Package Code Execution

The vulnerability of the golang-x-net package in the Golang programming language is related to the lack of protective measures for web page structures. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

RHEL 8 : unbound (RHSA-2026:72110)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:72110 advisory. The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fixes: unbound: Unbound: Heap buffer overflow and...

RHEL 7 : kernel (RHSA-2026:71687)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:71687 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: crypto: afalg - Disallow...

golang-x-net Package Code Execution

The vulnerability of the golang-x-net package in the Golang programming language is related to improper checking of unsafe equivalence of input data. Exploiting this vulnerability allows an attacker to bypass existing security restrictions and execute arbitrary code...

PT-2026-98912

Name of the Vulnerable Software and Affected Versions RabbitMQ versions 3.13.0 through 3.13.17 RabbitMQ versions 4.0.x through 4.0.22 RabbitMQ versions 4.1.x through 4.1.13 RabbitMQ versions 4.2.x through 4.2.8 RabbitMQ versions 4.3.x through 4.3.2 Description Stored Cross-Site Scripting XSS exis...

CVE-2026-67239: Improper Neutralization of Input During Web Page Generation

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.18 and 4.0.23 and 4.1.14 and 4.2.9 and 4.3.3, Stored XSS via TLS peer-certificate DN in stream-management UI sibling of V-11. lines 102/106/110 render peercertsubject / peercertissuer with raw and no fmtstring. RFC4514...

RHEL 10 : kernel (RHSA-2026:72059)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:72059 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: crypto: afalg - Disallow...

RHEL 9 : kernel (RHSA-2026:71700)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:71700 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: fbcon: Set fbdisplayi-mode to...

Linux Distros Unpatched Vulnerability : CVE-2026-67239

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.18 and 4.0.23 and 4.1.14 and 4.2.9 and 4.3.3, Stored XSS via TLS peer-certificate DN in...

PT-2026-98989

Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plugin archive can chain relative symbolic link entries to escape the plugin installation directory, writing arbitrary files and an executable backend binary outside that directory...

Security update for sdbootutil (important)

openSUSE security update: security update for sdbootutil ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21933-1 Rating: important References: bsc1234010 bsc1270192 bsc1270420 bsc1270471 bsc1270616 bsc1270670 bsc1270742 bsc1270863 bsc1270922...

`@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction

Reported by @echennells Eric Chennells. Migrated from public issue 191 to a private advisory. Affected: @bsv/wallet-toolbox / -client / -mobile. Verified in 2.1.21 and 2.1.21-parity-fix.2; the relevant code is the same at current HEAD Summary: When createAction runs against a remote StorageClient...

GHSA-36F9-7RG5-CPF8 `@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction

Reported by @echennells Eric Chennells. Migrated from public issue 191 to a private advisory. Affected: @bsv/wallet-toolbox / -client / -mobile. Verified in 2.1.21 and 2.1.21-parity-fix.2; the relevant code is the same at current HEAD Summary: When createAction runs against a remote StorageClient...

Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context

Summary Decepticon wraps web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK Bring Your Own Key deployment model, users configure their own LLM credentials to any OpenAI-compatible...

GHSA-G5F9-3XFG-P9MF Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context

Summary Decepticon wraps web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK Bring Your Own Key deployment model, users configure their own LLM credentials to any OpenAI-compatible...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview decepticon is an AI-powered autonomous red team testing framework Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' via UntrustedOutputMiddleware.formatenvelope and...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview decepticon-sdk is a Decepticon plugin author SDK: protocols, fixtures, scaffolding Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' via UntrustedOutputMiddleware.formatenvelope and...