Important: nodejs24

Issue Overview: A use-after-free / double-free in c-ares' query-completion handling. The same flaw -- a query's callback being invoked while the query is still linked in the channel's internal lookup structures -- is present at multiple points in the resend/finish path timeout handling, response...

EUVD-2026-45468

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix UAF in blkcgrstatflush When multiple blkgs in the same blkcg are released concurrently, a use-after-free can occur. The race happens when one blkg's blkcgrstatflush removes another blkg's iostat entries via...

CVE-2026-12978

creationtimestamp| type| source ---|---|--- 2026-07-16 07:55:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqqr3rj5be2u...

CVE-2025-56362

creationtimestamp| type| source ---|---|--- 2026-07-14 23:49:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqnfifeijg24 2026-07-27 09:09:39+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrmkejrkej2p...

CVE-2026-54986

creationtimestamp| type| source ---|---|--- 2026-07-14 19:01:06+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0231 2026-07-14 22:05:01+00:00| seen| https://www.thezdi.com/blog/2026/7/14/the-july-2026-security-update-review 2026-07-15 01:00:59+00:00| seen|...

PYSEC-2026-2862 PDM: Project-Local State and Config Writes Follow Symlinks

Summary PDM writes several project-local state or configuration files without symlink protection. If a malicious repository places those files as symlinks, local PDM operations can overwrite the symlink targets. This creates an arbitrary file clobber primitive relative to the privileges of the...

PYSEC-2026-2349 Apache Airflow has an Improper Authorization issue

The structuredata endpoint in the Airflow UI returned external dependency graph nodes for linked Dags without checking whether the caller had read permission on those linked Dags. An authenticated UI/API user authorized for one Dag could enumerate linked Dag IDs and dependency metadata for other...

CVE-2026-61429

creationtimestamp| type| source ---|---|--- 2026-07-11 14:35:37+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqev4ocscu26 2026-07-11 15:01:57+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqewli45ax2j 2026-07-11 15:34:33+00:00| seen|...

CVE-2026-58378

creationtimestamp| type| source ---|---|--- 2026-07-09 18:53:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqacm3aa3b2x...

PYSEC-2026-3148 Out of bounds write in TFLite

Impact An attacker can craft a TFLite model that would cause a write outside of bounds of an array in TFLite. In fact, the attacker can override the linked list used by the memory allocator. This can be leveraged for an arbitrary write primitive under certain conditions. Patches We have patched t...

China-Linked UAT-7810 Expands ORB Network With New LONGLEASH Malware

A Chinese threat actor tracked as UAT-7810 is actively refining its bespoke malware to expand its Operational Relay Box ORB network by breaking into internet-facing networking devices. According to findings from Cisco Talos, UAT-7810 is an advanced persistent threat APT actor that's responsible f...

CVE-2026-54769

creationtimestamp| type| source ---|---|--- 2026-07-06 21:32:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mpz22qfgd22g 2026-07-06 22:35:25+00:00| published-proof-of-concept| https://github.com/langroid/langroid/security/advisories/GHSA-q9p7-wqxg-mrhc 2026-07-10...

BIT-MASTODON-2026-48028 Mastodon: Removal of integrity-protected JSON entries from signed activities

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.10, 4.4.17, and 4.3.23, Mastodon's normalization of incoming activities signed with Linked-Data Signatures does not sufficiently protect the activities from a certain class of spoofing, allowing threat actors...

BIT-MASTODON-2026-46349 Mastodon: LD-Signature Bypass via JSON-LD Named-Graph Restructuring

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.10, 4.4.17, and 4.3.23, Mastodon's normalization of incoming activities signed with Linked-Data Signatures does not sufficiently protect the activities from a certain class of spoofing, allowing attackers to...

CVE-2026-48205

creationtimestamp| type| source ---|---|--- 2026-07-05 20:21:56+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mpwfofkvu425 2026-07-06 20:34:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mpywszkc562b 2026-07-09 08:07:07+00:00| seen|...

CVE-2026-35097

creationtimestamp| type| source ---|---|--- 2026-07-01 02:37:38+00:00| seen| https://cert.pl/en/posts/2026/06/CVE-2026-35095...

CVE-2026-54899

creationtimestamp| type| source ---|---|--- 2026-07-01 02:25:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpkhnr7sqg26 2026-07-02 01:13:05+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmu3d3qlr22...

CVE-2025-15660

creationtimestamp| type| source ---|---|--- 2026-06-30 14:45:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mpjajjku442c 2026-07-01 02:50:50+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0819...

CVE-2026-13474

Denial of service via malformed HTTP/2 requests in NetScaler ADC and NetScaler Gateway if HTTP/2 is enabled in HTTP Profile and associated with the virtual server of type LB, CS, VPN or the service configured on NetScaler...

SUSE CVE-2026-53092

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix linked reg delta tracking when srcreg == dstreg Consider the case of rX += rX where srcreg and dstreg are pointers to the same bpfregstate in adjustregminmaxvals. The latter first modifies the dstreg in-place, and later ...