EUVD-2026-54781

A weakness has been identified in andreahaku llmmemorymcp up to f11dc8bcff3ff8cf943a2945f99ff3b0bdc8a6d0. This impacts the function auto.capture of the file src/autolearn/GitHooksManager.ts of the component llmmemorymcp. Executing a manipulation of the argument hash can lead to command injection...

CVE-2026-19282

The CVE describes a local command-injection risk in the andreahaku llm_memory_mcp project, affecting the auto.capture function in src/autolearn/GitHooksManager.ts. The root cause is a manipulation of the argument hash, enabling injection, with exploitation restricted to local access. No product v...

CVE-2026-19282 andreahaku llm_memory_mcp GitHooksManager.ts auto.capture command injection

A weakness has been identified in andreahaku llmmemorymcp up to f11dc8bcff3ff8cf943a2945f99ff3b0bdc8a6d0. This impacts the function auto.capture of the file src/autolearn/GitHooksManager.ts of the component llmmemorymcp. Executing a manipulation of the argument hash can lead to command injection...

CVE-2026-68081

In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state Put all vmcs12 pages if KVM synthesizes a nested VM-Exit due to invalid guest while emulating VMLAUNCH or VMRESUME. The invalid guest state path...

UBUNTU-CVE-2026-68081

In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state Put all vmcs12 pages if KVM synthesizes a nested VM-Exit due to invalid guest while emulating VMLAUNCH or VMRESUME. The invalid guest state path...

CVE-2026-6067

A flaw was found in Netwide Assembler NASM. This heap buffer overflow vulnerability, stemming from insufficient bounds checking, allows a user to execute arbitrary code by assembling a specially crafted malicious assembly .asm file. Successful exploitation can lead to unauthorized command...

CVE-2026-13505

In Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series, sensitive key material held by the AES and DESede engines, the SP 800-90A DRBGs, SymmetricSecretKey and the PBKD and scrypt parameter classes was zeroised on garbage collection by...

EUVD-2026-54726

In Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series, sensitive key material held by the AES and DESede engines, the SP 800-90A DRBGs, SymmetricSecretKey and the PBKD and scrypt parameter classes was zeroised on garbage collection by...

CVE-2026-13505

CVE-2026-13505 concerns Bouncy Castle for Java FIPS (BC-FJA). The issue: sensitive key material held by AES/DESede engines, SP 800-90A DRBGs, SymmetricSecretKey, and PBKD/scrypt parameter classes was zeroised on garbage collection via Object.finalize. Finalization is non-deterministic and runs on...

CVE-2026-13505 Zeroisation of sensitive key material on garbage collection relies on finalization

In Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series, sensitive key material held by the AES and DESede engines, the SP 800-90A DRBGs, SymmetricSecretKey and the PBKD and scrypt parameter classes was zeroised on garbage collection by...

CVE-2026-8798 Native entropy source retries the CPU entropy instructions without limit

In Bouncy Castle for Java FIPS BC-FJA before bc-fips 2.1.3, the native entropy source used on Intel platforms retried the CPU entropy instructions without any bound. RDSEED and RDRAND report failure through their carry flag, and the JNI seeding routine spun re-issuing the instruction for as long ...

EulerOS 2.0 SP11 : golang (EulerOS-SA-2026-3068)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encod...

EulerOS 2.0 SP11 : krb5 (EulerOS-SA-2026-3072)

According to the versions of the krb5 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : In MIT Kerberos 5 aka krb5 before 1.22.3, there is a NULL pointer dereference if an application calls gssacceptseccontext on a system with a NegoEx...

EulerOS 2.0 SP11 : golang (EulerOS-SA-2026-3123)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encod...

Linux Distros Unpatched Vulnerability : CVE-2026-20347

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability in the Mach-O file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded...

Linux Distros Unpatched Vulnerability : CVE-2026-20348

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability in the XAR file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded...

Debian dsa-6417 : heif-gdk-pixbuf - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6417 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6417-1 [email protected] https://www.debian.org/securit...

SUSE CVE-2026-19146

Uninitialized Use in GPU in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security severity: High...

CVE-2026-47249

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.18, the P2P resolver request handling logic is vulnerable to hash-array amplification. A connected peer can send a compressed RequestDataTypeHashArrayType direct request that is only 442 bytes on the wire but expan...

CVE-2026-64676

Kata Containers is an open source implementation of lightweight Virtual Machines VMs that perform like containers. In versions prior to 4.0.0, the kata-agent is vulnerable to an authorization bypass in confidential-guest memory management. In Confidential Containers CoCo deployments, the kata-age...