Identity Protection in the AI Era

Enterprises aiming to predict and mitigate human, machine, and AI‑agent risks at scale demand AI‑powered identity‑first security without compromise...

MAL-2026-2620 Malicious code in upstartportal (npm)

Collects system info, reads sensitive files, and exfiltrates data to a suspicious host. Multiple YARA matches confirm malicious intent. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 932dee0dcf84fc1044efb1ec35950d6102fcbb5122f26cca5e2b1f13eb599729 The package...

Machine Learning-Based Detection of MCP Attacks

The Model Context Protocol MCP is a new and emerging technology that extends the functionality of large language models, improving workflows but also exposing users to a new attack surface. Several studies have highlighted related security flaws, but MCP attack detection remains underexplored. To...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: terraform-provider-azuread, verticadb-operator, cosign, prometheus-adapter, hubble, cilium, mesosphere-vsphere-csi, rancher-agent, temporal, cloud-provider-vsphere, crossplane-provider-azure-storage, aactl, vexctl, crossplane-provider-sql, yunikorn-k8shim, opencost,...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: nri-mssql, rancher-telemetry, cosign, cloud-provider-vsphere, crossplane-provider-sql, metrics-agent, gitleaks, step-ca, kpt, authservice, knative-client, lvm-driver, external-dns, stern, terraform-provider-kubernetes, spark-operator, flux-notification-controller,...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: cloudbeat, image-factory, multus-cni-fips, net-kourier-fips, cert-manager-csi-driver-fips, kubescape, portieris-fips, podinfo-fips, kubernetes-csi-driver-nfs-fips, mc, chaos-mesh-fips, contour-fips, rancher-support-bundle-kit, kubernetes-csi-external-resizer-fips,...

GHSA-5W89-2C2X-6X66 vulnerabilities

Vulnerabilities for packages: portieris-fips, age, contour-fips, crossplane-provider-kubernetes, seaweedfs-operator-fips, go, apko, kubernetes-csi-external-snapshotter-fips, kyverno-policy-reporter-plugins-kyverno, protoc-gen-go, traefik, cert-manager-cmctl, coredns, rancher-agent, net-kourier,...

GHSA-FM2X-C5QW-4H6F LXD: VM lowlevel restriction bypass via raw.apparmor and raw.qemu.conf

Summary The isVMLowLevelOptionForbidden function in lxd/project/limits/permissions.go is missing raw.apparmor and raw.qemu.conf from its hardcoded forbidden list. A user with canedit permission on a VM instance in a restricted project can combine these two omissions to bridge the LXD unix socket...

LXD: VM lowlevel restriction bypass via raw.apparmor and raw.qemu.conf

Summary The isVMLowLevelOptionForbidden function in lxd/project/limits/permissions.go is missing raw.apparmor and raw.qemu.conf from its hardcoded forbidden list. A user with canedit permission on a VM instance in a restricted project can combine these two omissions to bridge the LXD unix socket...

nodejs: Nodejs uninitialized memory exposure

A memory exposure flaw has been discovered in Node.js. A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the vm module with the timeout option. Under specific timing conditions, buffers allocated with Buffer.alloc and other...

GHSA-7XGM-5PRM-V5GC vulnerabilities

Vulnerabilities for packages: virt-operator-fips, virt-launcher, docker-machine-driver-harvester, virt-handler, virt-controller-fips...

GHSA-9M94-W2VQ-HCF9 vulnerabilities

Vulnerabilities for packages: virt-operator-fips, virt-launcher, docker-machine-driver-harvester, virt-handler, virt-controller-fips...

CVE-2025-64436 vulnerabilities

Vulnerabilities for packages: virt-operator-fips, virt-launcher, docker-machine-driver-harvester, virt-handler, virt-controller-fips...

CVE-2026-5194

A flaw was found in wolfSSL. Missing hash/digest size and Object Identifier OID checks allow the acceptance of smaller, less secure digests during the verification of Elliptic Curve Digital Signature Algorithm ECDSA certificates. This could enable a remote attacker, with knowledge of the public...

CVE-2026-5194

Missing hash/digest size and OID checks allow digests smaller than allowed when verifying ECDSA certificates, or smaller than is appropriate for the relevant key type, to be accepted by signature verification functions. This could lead to reduced security of ECDSA certificate-based authentication...

The agentic SOC—Rethinking SecOps for the next decade

Every major shift in cyberattacker behavior over the past decade has followed a meaningful shift in how defenders operate. When security operation centers SOCs deployed endpoint detection and response EDR—and later extended detection and response XDR—security teams raised the bar, pushing...

Weak Authentication

Overview Affected versions of this package are vulnerable to Weak Authentication due to improper validation of oauthuserid in the TokenGuard::authenticateViaBearerToken function. An attacker can gain unauthorized access to unrelated user accounts by presenting a machine-to-machine token with a...

CVE-2026-39976

Laravel Passport provides OAuth2 server support to Laravel. From 13.0.0 to before 13.7.1, there is an Authentication Bypass for clientcredentials tokens. the league/oauth2-server library sets the JWT sub claim to the client identifier since there's no user. The token guard then passes this value ...

systemd: systemd: Privilege escalation via improper access control in RegisterMachine D-Bus method

A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the class parameter in the RegisterMachine D-Bus Desktop Bus method. A local unprivileged user can exploit this by attempting to register a machine with a...

CVE-2026-39976: Improper Authentication

Laravel Passport provides OAuth2 server support to Laravel. From 13.0.0 to before 13.7.1, there is an Authentication Bypass for clientcredentials tokens. the league/oauth2-server library sets the JWT sub claim to the client identifier since there's no user. The token guard then passes this value ...