The vulnerability of the AdjRib.Update() function in the control module for the Adj-RIB BGP protocol of the GoBGP border gateway allows a attacker to cause a service failure.

The vulnerability of the AdjRib.Update function in the Adj-RIB BGP protocol control module of the GoBGP border gateway is related to the handling of the zero pointer. Exploiting this vulnerability could allow a malicious actor to cause service failure...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-107264)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-107264 advisory. In the Linux kernel, the following vulnerability has been resolved: md: Don't register syncthread for reshape directly Currently, if reshape is interrupted, then...

Linux Distros Unpatched Vulnerability : CVE-2026-89147

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Net-SNMP through 5.9.5.2 contains a denial of service vulnerability in the SMUX module where smuxaccept performs an unauthenticated blocking read without timeou...

PT-2026-90272

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Linux kernel where the elf validity cache sechdrs function validates section sizes and offsets except for sections of type SHT NULL or SHT NOBITS. Subsequently, th...

kernel security update

6.12.0-211.54.1 - Add new Oracle Linux Driver Signing key 1 certificate Orabug: 37985782 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list...

CVE-2026-17176 OS Command Injection Vulnerability in Deco Devices

An OS command injection vulnerability in the TDDP module of Deco BE11000 and Deco M9 Plus allows an adjacent network attacker to execute arbitrary commands with root privileges by sending a crafted UDP packet. Successful exploitation may lead to complete device compromise, including unauthorized...

CVE-2026-17176 OS Command Injection Vulnerability in Deco Devices

An OS command injection vulnerability in the TDDP module of Deco BE11000 and Deco M9 Plus allows an adjacent network attacker to execute arbitrary commands with root privileges by sending a crafted UDP packet. Successful exploitation may lead to complete device compromise, including unauthorized...

CVE-2026-17176

TP-Link Deco BE11000 is affected by an OS command injection vulnerability in its TDDP module . An attacker on the adjacent network can exploit this by sending a crafted UDP packet , executing arbitrary commands with root privileges without any prior authentication. Successful exploitation may lea...

Exploit for CVE-2026-63642

SSRF in MagicMirror² Calendar Module A proof-of-concept explo...

openssl openssl-4.1.0-alpha1

Welcome to the OpenSSL Project !openssl logowww.openssl.org !github actions ci badgegithub actions ci OpenSSL is a robust, commercial-grade, full-featured Open Source Toolkit for the Transport Layer Security TLS, formerly SSL, Datagram TLS DTLS, and QUIC protocols. The protocol implementations ar...

rsyslog: A configuration-dependent issue in rsyslog's optional imptcp input module can allow an unauthenticated remote peer to crash rsyslogd

A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during oversize-frame recovery can cause an invalid internal message length and terminate rsyslogd. No confidentiality or integrity impact, privilege escalation, or code...

Important: Red Hat Security Advisory: rsyslog security update

An update for rsyslog is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...

kernel: net: bridge: stop fast-leave after deleting a port group

A flaw was found in the Linux kernel's network bridge module. When handling multicast fast-leave, a vulnerability exists where the system may attempt to access a port group after it has been deleted. This can occur if multicast-to-unicast was previously enabled and then disabled, leading to a sta...

PYSEC-2026-3945 WsgiDAV MySQL provider has a blind SQL injection

Summary The sample MySQLBrowserProvider builds its SQL queries by concatenating strings, and the record key from the request URL goes straight into the WHERE clause with no escaping. Any user who can reach a share backed by this provider can inject SQL through the URL. Since these read shares are...

PYSEC-2026-3891 PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code

Summary PraisonAI's workflow include implementation implicitly imports and executes an included recipe's tools.py file even when the documented tools.py autoload opt-in is unset. This bypasses the hardening added for the prior automatic tools.py RCE advisory family. A workflow that includes an...

CVE-2026-56864

A flaw was found in golang.org/x/mod/sumdb. A malicious Go checksum database GOSUMDB can serve arbitrary module content that is not recorded in the transparency log. This allows a coordinated Go proxy GOPROXY and GOSUMDB to deliver malicious module content to a client, which cannot be detected by...

CVE-2026-15820

The Builderall for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Photo Module 'attributes' Setting in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-15820 Builderall for WordPress <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Photo Module 'attributes' Setting

The Builderall for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Photo Module 'attributes' Setting in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

EUVD-2026-75239

The Builderall for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Photo Module 'attributes' Setting in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-15820

Builderall for WordPress (versions up to and including 3.0.2 ) is vulnerable to an Authenticated Stored Cross-Site Scripting flaw in the Photo Module 'attributes' Setting , caused by insufficient input sanitization and output escaping . An attacker with Contributor-level access or above can injec...