io.projectreactor/reactor-core: Reactor Core: Denial of Service via Flux.windowTimeout operator with fairBackpressure

A flaw was found in Reactor Core. A remote attacker could exploit this vulnerability by using the Flux.windowTimeout operator with fairBackpressure enabled, leading to a Denial of Service DoS condition. This could cause applications to become unresponsive or crash...

io.projectreactor/reactor-core: Reactor Core: Denial of Service in bufferTimeout operator

A flaw was found in Reactor Core. Applications using the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service DoS condition. This occurs when upstream components deliver items during an active flush, causing the processing pipeline to permanently hang an...

CVE-2026-62987 Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tls/requestid) still strippable via the Connection header

Fabio is an HTTPS and TCP router for deploying applications managed by consul. From 1.6.6 until 1.7.2, the CVE-2025-48865 fix in proxy/httpheaders.go uses protectHeaders for a hardcoded set of forwarded headers but omits the operator-configured ClientIPHeader, TLSHeader, and RequestID names. In...

CVE-2026-62987

Fabio (an HTTP/S and TCP router for Consul-managed applications) versions 1.6.6 through 1.7.2 contain an incomplete fix for CVE-2025-48865 . The protectHeaders logic in proxy/http_headers.go covers a hardcoded set of forwarded headers but omits operator-configured ClientIPHeader , TLSHeader , and...

CVE-2026-62987

Fabio is an HTTPS and TCP router for deploying applications managed by consul. From 1.6.6 until 1.7.2, the CVE-2025-48865 fix in proxy/httpheaders.go uses protectHeaders for a hardcoded set of forwarded headers but omits the operator-configured ClientIPHeader, TLSHeader, and RequestID names. In...

CVE-2026-62987 Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tls/requestid) still strippable via the Connection header

Fabio is an HTTPS and TCP router for deploying applications managed by consul. From 1.6.6 until 1.7.2, the CVE-2025-48865 fix in proxy/httpheaders.go uses protectHeaders for a hardcoded set of forwarded headers but omits the operator-configured ClientIPHeader, TLSHeader, and RequestID names. In...

CVE-2026-62987 Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tls/requestid) still strippable via the Connection header

Fabio is an HTTPS and TCP router for deploying applications managed by consul. From 1.6.6 until 1.7.2, the CVE-2025-48865 fix in proxy/httpheaders.go uses protectHeaders for a hardcoded set of forwarded headers but omits the operator-configured ClientIPHeader, TLSHeader, and RequestID names. In...

The fake sites using a cheap toolkit to sell $2,000 AI subscriptions

We found more than 100 subscription websites linked through the same toolkit and closely related developer details. Some impersonate existing products, including GPT-6 Astra, DaVinci Resolve, PixAI, and OpenCut. Another uses the name of Omegle, the chat service that shut down in 2023. Others...

CVE-2026-55074

Ansible FreeBSD Jail Connection Plugin is an Ansible connection plugin for FreeBSD Jails via jexec. Through version 1.3.0, the jailexec connection plugin's putfile resolved a transfer's destination to a path on the jail host + and ran mkdir -p and mv there as root on the host. Those commands foll...

CVE-2026-55074 Ansible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put_file (host-side root mv)

Ansible FreeBSD Jail Connection Plugin is an Ansible connection plugin for FreeBSD Jails via jexec. Through version 1.3.0, the jailexec connection plugin's putfile resolved a transfer's destination to a path on the jail host + and ran mkdir -p and mv there as root on the host. Those commands foll...

CVE-2026-55074

Ansible FreeBSD Jail Connection Plugin is an Ansible connection plugin for FreeBSD Jails via jexec. Through version 1.3.0, the jailexec connection plugin's putfile resolved a transfer's destination to a path on the jail host + and ran mkdir -p and mv there as root on the host. Those commands foll...

EUVD-2026-83940

Ansible FreeBSD Jail Connection Plugin is an Ansible connection plugin for FreeBSD Jails via jexec. Through version 1.3.0, the jailexec connection plugin's putfile resolved a transfer's destination to a path on the jail host + and ran mkdir -p and mv there as root on the host. Those commands foll...

CVE-2026-55074 Ansible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put_file (host-side root mv)

Ansible FreeBSD Jail Connection Plugin is an Ansible connection plugin for FreeBSD Jails via jexec. Through version 1.3.0, the jailexec connection plugin's putfile resolved a transfer's destination to a path on the jail host + and ran mkdir -p and mv there as root on the host. Those commands foll...

CVE-2026-55074

CVE-2026-55074 affects the Ansible FreeBSD Jail Connection Plugin (jailexec) through version 1.3.0 . The put_file function resolved transfer destinations to paths on the jail host and executed mkdir -p and mv as root on the host , rather than inside the jail. Because these commands follow symboli...

CVE-2026-55074 Ansible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put_file (host-side root mv)

Ansible FreeBSD Jail Connection Plugin is an Ansible connection plugin for FreeBSD Jails via jexec. Through version 1.3.0, the jailexec connection plugin's putfile resolved a transfer's destination to a path on the jail host + and ran mkdir -p and mv there as root on the host. Those commands foll...

Gemini’s breach of real companies exposes an AI guardrail problem

Google says one of its Gemini models accessed systems belonging to three real companies during a cybersecurity evaluation in May. The model reportedly guessed credentials in one case, while finding exposed credentials in public repositories in two others. Google says Gemini stopped once it...

OPENSUSE-SU-2026:21900-1 Security update for jsoup, re2j

This update for jsoup, re2j fixes the following issue: - CVE-2026-75140: The builder copies the entire inherited namespace map on every start element, causing quadratic time and memory complexity, which attackers can exploit to trigger an OutOfMemoryError and terminate the application bsc1275912...

SUSE-SU-2026:23856-1 Security update for jsoup, re2j

This update for jsoup, re2j fixes the following issue: - CVE-2026-75140: The builder copies the entire inherited namespace map on every start element, causing quadratic time and memory complexity, which attackers can exploit to trigger an OutOfMemoryError and terminate the application bsc1275912...

SUSE-SU-2026:23867-1 Security update for jsoup, re2j

This update for jsoup, re2j fixes the following issue: - CVE-2026-75140: The builder copies the entire inherited namespace map on every start element, causing quadratic time and memory complexity, which attackers can exploit to trigger an OutOfMemoryError and terminate the application bsc1275912...

CVE-2026-89139

Temporal Server compiles a Worker Controller Instance module into its Worker Service, and that module registers a compute provider named subprocess whose function is to launch a worker by running a command on the machine hosting the Worker Service. The program name and the argument vector that...