CVE-2026-97529

A flaw was found in the Linux kernel's qla2xxx driver. The driver fails to validate the length of vendor-specific request buffers before reading command data, resulting in an out-of-bounds read from heap memory. A local user with administrative privileges can exploit this flaw by submitting a...

CVE-2022-28108

Selenium Chrome RCE Exploit Extended This repository contains a modified version of a Metasploit module that exploits a Remote Code Execution vulnerability in older versions of Selenium Server Grid. Please read this README carefully before using this code. Acknowledgment of Original Code: This...

Malicious code in llm-nebula (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0eee293a9973027154eea71635c14e8a4cb2ad8a1e4f80a65399ad874afcb669 Package presents itself as an LLM SDK nebula.js exposes a small client stub but declares preinstall: node preinstall.cjs in package.json, and...

MAL-2026-17230 Malicious code in llm-nebula (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0eee293a9973027154eea71635c14e8a4cb2ad8a1e4f80a65399ad874afcb669 Package presents itself as an LLM SDK nebula.js exposes a small client stub but declares preinstall: node preinstall.cjs in package.json, and...

Important: Red Hat Security Advisory: kpatch-patch-4_18_0-553_109_1, kpatch-patch-4_18_0-553_125_1, kpatch-patch-4_18_0-553_158_1, kpatch-patch-4_18_0-553_72_1, and kpatch-patch-4_18_0-553_85_1 security update

An update for multiple packages is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Hackers Use NeedyMantis to Maintain Long-Term Access in Breached Networks

Hackers have used a malware family called NeedyMantis to maintain long-term access to networks they had already breached, Microsoft said in a technical analysis. The malware has been seen in a small number of targeted intrusions at telecommunications organizations, universities, medical nonprofit...

Malicious code in nebulaai-sdk (npm)

Source: amazon-inspector dc906b81107141fbd85dcabf89fd2f5112c4e4a134045c90d6a35abb4b67d16e The package's preinstall.js contains a base64+zlib-encoded 257 KB Windows PE executable. On npm install on Windows, the script decodes the blob and writes it to %LOCALAPPDATA%\Microsoft\Conhost\conhost.exe —...

CVE-2026-75600

FreePBX is an open source IP PBX. Prior to version 17.0.9, authenticated users who are authorized to access the GraphQL api module interface of FreePBX are able to execute arbitrary shell commands. Authenticated access to the api module is required. The PBX API module's documentation generator...

CVE-2026-55157

Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, token-optimizer-mcp is vulnerable to OS command injection in the smartuser tool. Any MCP client that can call the smartuser too...

Important: Red Hat Security Advisory: kpatch-patch-5_14_0-284_134_1, kpatch-patch-5_14_0-284_148_1, kpatch-patch-5_14_0-284_158_1, kpatch-patch-5_14_0-284_172_1, and kpatch-patch-5_14_0-284_188_1 security update

An update for multiple packages is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Important: Red Hat Security Advisory: kpatch-patch-5_14_0-427_100_1, kpatch-patch-5_14_0-427_113_1, kpatch-patch-5_14_0-427_126_1, kpatch-patch-5_14_0-427_146_1, and kpatch-patch-5_14_0-427_84_1 security update

An update for multiple packages is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Malicious code in nebulaai-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc906b81107141fbd85dcabf89fd2f5112c4e4a134045c90d6a35abb4b67d16e The package's preinstall.js contains a base64+zlib-encoded 257 KB Windows PE executable. On npm install on Windows, the script decodes the blob and...

MAL-2026-17228 Malicious code in nebulaai-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc906b81107141fbd85dcabf89fd2f5112c4e4a134045c90d6a35abb4b67d16e The package's preinstall.js contains a base64+zlib-encoded 257 KB Windows PE executable. On npm install on Windows, the script decodes the blob and...

Important: Red Hat Security Advisory: kpatch-patch-4_18_0-477_107_1, kpatch-patch-4_18_0-477_120_1, kpatch-patch-4_18_0-477_130_1, kpatch-patch-4_18_0-477_143_1, and kpatch-patch-4_18_0-477_161_1 security update

An update for multiple packages is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

CVE-2026-55157 Token Optimizer MCP: OS command injection in smart_user via username in get-user-info

Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, token-optimizer-mcp is vulnerable to OS command injection in the smartuser tool. Any MCP client that can call the smartuser too...

CVE-2026-55157 Token Optimizer MCP: OS command injection in smart_user via username in get-user-info

Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, token-optimizer-mcp is vulnerable to OS command injection in the smartuser tool. Any MCP client that can call the smartuser too...

CVE-2026-55157 Token Optimizer MCP: OS command injection in smart_user via username in get-user-info

Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, token-optimizer-mcp is vulnerable to OS command injection in the smartuser tool. Any MCP client that can call the smartuser too...

EUVD-2026-88397

Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, token-optimizer-mcp is vulnerable to OS command injection in the smartuser tool. Any MCP client that can call the smartuser too...

CVE-2026-55157

Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, token-optimizer-mcp is vulnerable to OS command injection in the smartuser tool. Any MCP client that can call the smartuser too...

CVE-2026-55157

The token-optimizer-mcp software is vulnerable to OS command injection in the smart_user tool (specifically the get-user-info operation) prior to version 5.1.0 . The root cause is the unsafe interpolation of a user-controlled username argument into a shell command executed via execAsync(). Becaus...