PT-2026-81364

Name of the Vulnerable Software and Affected Versions rclone versions 1.72.0 through 1.74.4 Description Multiple denial-of-service issues exist in the archive backend's SquashFS parser, which utilizes the github.com/diskfs/go-diskfs dependency. The parser does not validate attacker-controlled...

EulerOS Virtualization 2.13.1 : libsolv (EulerOS-SA-2026-3180)

According to the versions of the libsolv packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in libsolv. A stack-based buffer overflow vulnerability exists in the PGP verification component due to incorrect...

PT-2026-81354

An authorization weakness in JFrog Artifactory Composer repository handling may allow an authenticated user, under specific conditions, to read package metadata from repositories they are not authorized to read. The issue affects confidentiality and has been addressed in fixed Artifactory version...

CVE-2026-79659: Server-Side Request Forgery (SSRF)

Ech0 before 4.7.3 contains a server-side request forgery vulnerability in the fetchPeerConnectInfo function that uses unvalidated HTTP requests instead of safe request methods with URL validation. Authenticated attackers can supply arbitrary URLs to access internal services and cloud metadata...

CVE-2026-79783: Incorrect Permission Assignment for Critical Resource

rclone before 1.74.4 fails to mask special permission bits when applying source-supplied mode metadata in the local backend, allowing attackers to set setuid/setgid bits on attacker-controlled files. When copying with metadata preservation from an untrusted remote, attackers can plant a setuid...

CVE-2026-45019: Server-Side Request Forgery (SSRF)

Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST /mcp endpoint without requiring authentication. For sse and streamable-http...

Linux Distros Unpatched Vulnerability : CVE-2026-63075

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC...

EulerOS Virtualization 2.13.0 : libsolv (EulerOS-SA-2026-3220)

According to the versions of the libsolv packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in libsolv. A stack-based buffer overflow vulnerability exists in the PGP verification component due to incorrect...

CVE-2026-55525: Server-Side Request Forgery (SSRF)

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the webcrawl function validates only the initial URL before crawlwithhttpx uses httpx.Clientfollowredirects=True. Redirect targets are not revalidated, so an attacker who influences a crawl target can redirect a public URL ...

PT-2026-81256

Name of the Vulnerable Software and Affected Versions Apache Hive versions prior to 4.2.1 Description An authenticated remote attacker with CREATE TABLE privileges can execute a Server-Side Request Forgery SSRF during Avro SerDe schema resolution. By setting the avro.schema.url table property on ...

CVE-2026-79671: Server-Side Request Forgery (SSRF)

Ech0 before 4.4.3 contains a server-side request forgery vulnerability in the validateWebhookURL function webhooksettingservice.go, which only validates literal IP addresses via net.ParseIP and fails to reject hostnames that DNS-resolve to private or internal IPs e.g., 169.254.169.254.nip.io. An...

CVE-2026-59230

creationtimestamp| type| source ---|---|--- 2026-08-24 21:00:04+00:00| seen| Telegram/8ioC0-GS3hqaK0vZF92ZaP06wwac1xjhQxJkXlFfEhMVG4 2026-08-25 00:00:09+00:00| published-proof-of-concept| Telegram/8ioC0-GS3hqaK0vZF92ZaP06wwac1xjhQxJkXlFfEhMVG4...

CVE-2026-76073

creationtimestamp| type| source ---|---|--- 2026-08-24 19:01:36+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mttyiqsg6x27 2026-08-25 05:50:03+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtv4qclb4k2p...

CVE-2026-74710

A flaw was found in the Linux kernel's AFXDP eXpress Data Path component. This vulnerability arises because the AFXDP mechanism accepts a transmit TX metadata length that is smaller than required, allowing the kernel to read beyond its designated memory area. An attacker could potentially exploit...

CVE-2026-74709

A flaw was found in the Linux kernel's xsk AFXDP sockets component. A local attacker, by manipulating metadata flags after request processing, could cause the kernel to write a timestamp into the metadata area even when not explicitly requested. This could lead to unintended data modification...

CVE-2026-74707

A flaw was found in the Linux kernel's xsk AFXDP sockets component. This vulnerability allows a local user to bypass security validation by modifying transmission TX metadata after it has been initially checked but before it is used to prepare hardware requests. This could lead to unexpected syst...

Malicious code in paypal-business-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 556bfd93652f806523495944dc8a441624c9a2dae4f76eadeefa9650f57091a1 The package's npm preinstall lifecycle script collects the installer's OS username, hostname, current working directory, and walks up to 15 parent...

CVE-2026-66007

A flaw was found in datasets. This path traversal vulnerability allows a remote attacker to read arbitrary local files. By providing specially crafted file names in the metadata, an attacker can trick the system into including sensitive local files when datasets are saved or published, leading to...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: btrfs: Zoned: Fixed a deadlock between metadata writeback and transaction commit. When writing out metadata extent buffers in a zoned filesystem, btreewritepages holds fsinfo-zonedmetaiolock throughout the entire writeback loop,...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: net/sched: actct: Preserve tcskbcb during defragmentation. tcfcthandlefragments calls nfcthandlefragments without saving and restoring skb-cb. The defragmentation helper clears IPCB/IP6CB, which aliases the tcskbcb/qdiscskbcb...