libretto v0.6.38

Libretto Libretto is a toolkit for building robust web integrations. It gives your coding agent a live browser and a token-efficient CLI to: Inspect live pages with minimal context overhead Capture network traffic to reverse-engineer site APIs Record user actions and replay them as automation...

EUVD-2026-48744

The web management interface in Tycon Systems TPDIN-Monitor-WEB2 stores and displays system credentials in cleartext on a certain configuration page accessible to authenticated users. Any party with access to the administrative dashboard can immediately read these credentials, which may be used t...

Linux Distros Unpatched Vulnerability : CVE-2026-55708

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, the 'viewlocaldata' and 'viewlocaldatas' commands of 'unbound-control' create a bare local zones tree fo...

openSUSE 16 Security Update : chromium (openSUSE-SU-2026:21438-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21438-1 advisory. Changes in chromium: - Chromium 150.0.7871.181 boo1272156: CVE-2026-16420: Type Confusion in WebAudio CVE-2026-16421: Inappropriate implementati...

Linux Distros Unpatched Vulnerability : CVE-2026-64303

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - spi: fsl-lpspi: terminate the RX channel on TX prepare failure path When dmaengineprepslavesg fails for the TX channel, the error path terminates the TX DMA...

Linux Distros Unpatched Vulnerability : CVE-2026-64301

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - regulator: scmi: fix ofnode refcount leak in scmiregulatorprobe scmiregulatorprobe calls offindnodebyname which takes a reference on the returned device node. O...

Linux Distros Unpatched Vulnerability : CVE-2026-64405

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hciconn: Fix null ptr deref in hciabortconn hciabortconn read hciskbeventhdev-sentcmd when a connection was pending, but hdev-sentcmd can be NULL whi...

Linux Distros Unpatched Vulnerability : CVE-2026-64365

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HID: letsketch: fix UAF on inrangetimer at driver unbind letsketchdriver does not provide a .remove callback, but letsketchprobe arms a per-device timer:...

PT-2026-64716

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the Linux kernel within the bmg160 gyro driver. The functions bmg160 get filter and bmg160 set filter iterate through the bmg160 samp freq table array to...

Linux Distros Unpatched Vulnerability : CVE-2026-64427

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: HID: logitech-dj: Fix maxfield check in DJ short report validation Commit b6a57912854e HID:...

Linux Distros Unpatched Vulnerability : CVE-2026-64464

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: xhci: sideband: fix ring sg table pages leak xhciringtosgtable allocates a temporary pages...

PT-2026-64529

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the crypto ccp component where the system improperly initializes SNP for the ioctlSNP VLEK LOAD function. A userspace process could potentially trigger this code path...

PT-2026-64586

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the HID letsketch driver. The letsketch probe function initializes a per-device timer inrange timer using timer setup, which is subsequently re-armed...

PT-2026-64654

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free UAF issue exists in the Bluetooth MGMT component. The add device complete function, executing from the hci cmd sync work kworker, calls hci conn params lookup and...

Fedora 43 : chromium (2026-acf674bc6a)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-acf674bc6a advisory. Update to 150.0.7871.181 CVE-2026-16413: Out of bounds write in ANGLE CVE-2026-16414: Insufficient validation of untrusted input in Chromecast...

Linux Distros Unpatched Vulnerability : CVE-2026-64510

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ACPI: NFIT: core: Fix acpinfitinit error cleanup If acpinfitinit fails after adding the acpidesc object to the acpidescs list, that object is never removed from...

Isolated but Exposed: Persistence-Based Memory Extraction Attack on LLM Agents

LLM-based agents extend large language models with long-term memory LTM that persists privacy-sensitive user data across sessions. Production systems mitigate extraction risks through memory isolation, binding each user's LTM to a unique identifier. This defense has blocked known attacks on share...

etcd: Watch API authorization bypass via open-ended range requests

Impact What kind of vulnerability is it? Who is impacted? A user granted READ permission on a single, exact key can use the Watch gRPC API with clientv3.WithFromKey an open-ended, "from this key to the end of the keyspace" watch to receive watch events for every key lexicographically greater than...

OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API

Summary An authorization bypass vulnerability exists in the file sharing mechanism of Openlist. Due to a flawed, non-separator-aware path validation check, an authenticated user can create share links for files outside their restricted base directory. This allows an attacker to bypass tenant/user...

CVE-2026-55985

The web management interface in Tycon Systems TPDIN-Monitor-WEB2 stores and displays system credentials in cleartext on a certain configuration page accessible to authenticated users. Any party with access to the administrative dashboard can immediately read these credentials, which may be used t...