starboard

StarboardはTrivyに統合されます。 私たちは、Starboardを廃止し、Trivyに統合する計画を発表しました。 Starboard CLIは、trivy kubernetesコマンドとして再導入され、Trivyの機能に焦点を当てたstarboard-operatorは、Trivy-Operatorとして利用可能です。 新しい機能やプルリクエスト、Issueは受け付けません。 Trivy-OperatorとTrivy CLIに貢献し、Trivy Kubernetesの将来に影響を与えることをお勧めします。 詳細については、ディスカッションをご覧ください。...

DarunGrim

注意 DarunGrim 现已合并至 binkit 项目。 大部分分析算法已移植到新工具中 仍在正式发布前的内部测试阶段...

certipy-merged

certipy-merged 此仓库包含 ly4k/Certipy 的一个分支，合并了许多开放的 pull request，使其彼此兼容，并进行了（一定程度的）测试。 由于这是一个正在进行的工作，某些功能可能无法按预期工作，也可能会出现损坏。 安装 使用 pipx（推荐） 如果你更喜欢自动管理的虚拟环境的便利性，请使用 pipx： pipx install git+https://github.com/zimedev/certipy-merged.git@main 如果你需要 LDAP 通道绑定（Channel Binding）支持，你需要将打过补丁的 ldap3 库注入到 Python...

CVE-2026-90244

In the Linux kernel, the following vulnerability has been resolved: iommu/dma: Restore locking around msipagelist Unlike a group's default domain, which is always freshly allocated and privately owned iommugroupallocdefaultdomain, VFIO type1's legacy container merges any newly attached group into...

AZL-101675 CVE-2026-89951 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix stale receive device on merged fragments Fragment reassembly reuses the skb from the highest-numbered buffered fragment as the merged packet. When that fragment was received on a hard interface which is deleted...

CVE-2026-89951

In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix stale receive device on merged fragments Fragment reassembly reuses the skb from the highest-numbered buffered fragment as the merged packet. When that fragment was received on a hard interface which is deleted...

CVE-2026-89951 batman-adv: fix stale receive device on merged fragments

In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix stale receive device on merged fragments Fragment reassembly reuses the skb from the highest-numbered buffered fragment as the merged packet. When that fragment was received on a hard interface which is deleted...

CVE-2026-89951 batman-adv: fix stale receive device on merged fragments

In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix stale receive device on merged fragments Fragment reassembly reuses the skb from the highest-numbered buffered fragment as the merged packet. When that fragment was received on a hard interface which is deleted...

Linux Distros Unpatched Vulnerability : CVE-2026-89951

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - batman-adv: fix stale receive device on merged fragments Fragment reassembly reuses the skb from the highest-numbered buffered fragment as the merged packet. Wh...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the processSecuredAnnotation method of GrpcServiceAuthorizationConfigurer, which uses MultiValueMap.addAll to combine class-level and method-level @Secured rules and evaluates the merged set with...

CVE-2026-48024 Wazuh: merged-file header path traversal in cluster sync allows arbitrary file write under WAZUH_PATH in Wazuh manager

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta3, cluster.unmergeinfo in framework/wazuh/core/cluster/cluster.py constructs paths from peer-controlled mergetype and name values in a merged synchronization archive...

Prototype Pollution

Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Prototype Pollution n the getMergedValue function of lib/core/mergeConfig.js, which clones nested option objects such as auth and paramsSerializer into...

PT-2026-60016

Summary vLLM's /v1/audio/transcriptions endpoint limits compressed upload size but not decoded PCM output. A 25MB OPUS file expands to 14.9GB of float32 PCM at decode time. Tested on vLLM v0.19.0. Details SpeechToTextProcessor rejects uploads over VLLM MAX AUDIO CLIP FILESIZE MB default 25MB base...

SUSE CVE-2026-44494

Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the application's dependency tree to be escalated into a full Man-in-the-Middle MIT...

PT-2026-50489

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.23.1rc0 Description The '/v1/audio/transcriptions' endpoint limits the size of compressed uploads but fails to limit the size of the decoded PCM Pulse Code Modulation output. PCM is an uncompressed digital audio format...

Quality and Security Signals in AI-Generated Python Refactoring Pull Requests

As AI agents increasingly contribute to code development and maintenance, there is still limited empirical evidence on the quality and risk characteristics of their changes in real-world projects, particularly for refactoring-oriented contributions. It remains unclear how agent-authored refactori...

Grav: Twig sandbox allows editor-role users to exfiltrate all plugin secrets via Config::toArray()

Summary The Twig sandbox allow-list permits any user with the admin.pages role to call config.toArray from within a page body, dumping the entire merged site configuration — including all plugin secrets SMTP passwords, AWS keys, OAuth client secrets, API tokens — into the rendered HTML. No...

CVE-2026-43254

A flaw was found in the Linux kernel's handling of OpenVPN ovpn TCP network traffic. This vulnerability occurs when the kernel processes multiple network packets that have been combined into a single stream. An attacker could exploit this by sending specially crafted TCP packets, leading to issue...

Inefficient Algorithmic Complexity

Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the OverlappingFieldsCanBeMerged validation process. An attacker can cause excessive CPU usage and resource exhaustion by submitting queries containing thousands of repeated fields with the sam...

HTTP Response Splitting

Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to HTTP Response Splitting via the parseTokens header processing path in lib/core/AxiosHeaders.js. An attacker can smuggle HTTP requests or inject arbitrary...