GHSA-QMC5-GV6V-8P22 OpenStack Neutron: Neutron port RBAC policy bypass allows project managers to set trusted device owners on shared networks

In OpenStack Neutron before 28.0.1, a project manager can create or update a port on a shared network owned by another project and set deviceowner to a value that has "network:" at the beginning "network:dhcp" for example. The default port RBAC policies incorrectly included PROJECTMANAGER without...

CVE-2026-10796

nvm Node Version Manager through 0.40.4 executes arbitrary commands from version strings supplied by the configured Node.js/io.js mirror. Commands such as nvm install read the available versions from the mirror's index.tab and use the selected version, without sanitization, to build download URLs...

CVE-2026-10880 Unauthenticated SQL Injection in Osnexus Quantastor

OSNexus QuantaStor SDS Manager is vulnerable to SQL injection in the login endpoint. The username field is not properly sanitized before being incorporated into a SQL query, allowing an unauthenticated remote attacker to bypass authentication and log in as an administrator without supplying a val...

CVE-2026-10796 nvm executes commands from a malicious Node.js mirror's version strings

nvm Node Version Manager through 0.40.4 executes arbitrary commands from version strings supplied by the configured Node.js/io.js mirror. Commands such as nvm install read the available versions from the mirror's index.tab and use the selected version, without sanitization, to build download URLs...

CVE-2026-10796

Vulnerability summary (CVE-2026-10796) : nvm (Node Version Manager)

CVE-2026-10796 nvm executes commands from a malicious Node.js mirror's version strings

nvm Node Version Manager through 0.40.4 executes arbitrary commands from version strings supplied by the configured Node.js/io.js mirror. Commands such as nvm install read the available versions from the mirror's index.tab and use the selected version, without sanitization, to build download URLs...

CVE-2026-10796 nvm executes commands from a malicious Node.js mirror's version strings

nvm Node Version Manager through 0.40.4 executes arbitrary commands from version strings supplied by the configured Node.js/io.js mirror. Commands such as nvm install read the available versions from the mirror's index.tab and use the selected version, without sanitization, to build download URLs...

CVE-2026-10796

nvm Node Version Manager through 0.40.4 executes arbitrary commands from version strings supplied by the configured Node.js/io.js mirror. Commands such as nvm install read the available versions from the mirror's index.tab and use the selected version, without sanitization, to build download URLs...

EUVD-2026-34303

nvm Node Version Manager through 0.40.4 executes arbitrary commands from version strings supplied by the configured Node.js/io.js mirror. Commands such as nvm install read the available versions from the mirror's index.tab and use the selected version, without sanitization, to build download URLs...

Cisco Patches CVE-2026-20230 in Unified CM as Exploit Code Goes Public

Cisco has patched a bug in Unified Communications Manager that lets an unauthenticated attacker on the network write files to the box and, from there, climb to root. It is tracked as CVE-2026-20230, and proof-of-concept exploit code is already public. Cisco's PSIRT says it has not seen the flaw...

EUVD-2026-34302

In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys output can inject udev properties leading to arbitrary root code execution...

CVE-2026-50266

In OpenStack Neutron before 28.0.1, a project manager can create or update a port on a shared network owned by another project and set deviceowner to a value that has "network:" at the beginning "network:dhcp" for example. The default port RBAC policies incorrectly included PROJECTMANAGER without...

CVE-2026-50266

In OpenStack Neutron before 28.0.1, a project manager can create or update a port on a shared network owned by another project and set deviceowner to a value that has "network:" at the beginning "network:dhcp" for example. The default port RBAC policies incorrectly included PROJECTMANAGER without...

ThreatsDay Bulletin: AI Agents Gone Wrong, Sketchy C2 Tools, ClickFix Tricks, JS Backdoors & 20+ New Stories

It got stupid again. The internet still feels held together with tape. Bad plugins, old bugs, fake tools, trusted apps doing shady things. Same mess, new wrapper. And now the weird stuff is normal. Forums go down and come back worse. Cheap hackers get better toys. AI starts breaking real systems...

GHSA-H524-452V-82P9 vulnerabilities

Vulnerabilities for packages: promxy, prometheus, flux-kustomize-controller, cortex, crossplane-provider-aws-cloudfront, cilium, traefik, crossplane-provider-aws-memorydb, trino, kube-bench, kubeflow-pipelines, sealed-secrets, argo-events, grafana-operator, nova, grafana,...

CVE-2026-42504 vulnerabilities

Vulnerabilities for packages: promxy, prometheus, flux-kustomize-controller, cortex, crossplane-provider-aws-cloudfront, cilium, traefik, crossplane-provider-aws-memorydb, trino, kube-bench, kubeflow-pipelines, sealed-secrets, argo-events, grafana-operator, nova, grafana,...

CVE-2026-27145 vulnerabilities

Vulnerabilities for packages: envconsul, temporal-ui-server, nri-redis, promxy, prometheus, flux-kustomize-controller, cortex, crossplane-provider-aws-cloudfront, cilium, nri-kafka, crossplane-provider-aws-memorydb, nri-haproxy, traefik, kube-logging-operator-custom-runner, trino, kube-bench,...

GHSA-H3GM-Q7M7-MP28 vulnerabilities

Vulnerabilities for packages: envconsul, temporal-ui-server, promxy, prometheus, flux-kustomize-controller, cortex, crossplane-provider-aws-cloudfront, cilium, traefik, crossplane-provider-aws-memorydb, nri-haproxy, trino, kube-logging-operator-custom-runner, kube-bench, kubeflow-pipelines,...

CVE-2026-42507 vulnerabilities

Vulnerabilities for packages: envconsul, temporal-ui-server, promxy, prometheus, flux-kustomize-controller, cortex, crossplane-provider-aws-cloudfront, cilium, traefik, crossplane-provider-aws-memorydb, nri-haproxy, trino, kube-logging-operator-custom-runner, kube-bench, kubeflow-pipelines,...

GHSA-4279-Q6MJ-392R vulnerabilities

Vulnerabilities for packages: envconsul, temporal-ui-server, nri-redis, promxy, prometheus, flux-kustomize-controller, cortex, crossplane-provider-aws-cloudfront, cilium, nri-kafka, crossplane-provider-aws-memorydb, nri-haproxy, traefik, kube-logging-operator-custom-runner, trino, kube-bench,...