CVE-2026-76336 Improper Access Control through the REST API in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2 and 10.2.6, a user who does not hold the "admin" or "power" Splunk roles could delete all Search Processing Language 2 SPL2 modules across all apps and users on the instance through the SPL2 module management Representational State Transfer REST API. Thi...

CVE-2026-76336

Splunk Enterprise versions below 10.4.2 (mainline) and 10.2.6 (LTS) are affected: the SPL2 module management REST API lacks sufficient authorization and validation on module deletion, letting any non-admin/non-power user delete all SPL2 modules instance-wide, wiping exported datasets/functions, c...

CVE-2026-76336 Improper Access Control through the REST API in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2 and 10.2.6, a user who does not hold the "admin" or "power" Splunk roles could delete all Search Processing Language 2 SPL2 modules across all apps and users on the instance through the SPL2 module management Representational State Transfer REST API. Thi...

USN-8563-4: nginx regression

USN-8563-3 fixed a vulnerability in nginx. The fix introduced a regression in certain environments. This update reverts the fix for CVE-2026-42533 pending further investigation. We apologize for the inconvenience. Original advisory details: It was discovered that nginx incorrectly handled certain...

USN-8563-4 nginx regression

USN-8563-3 fixed a vulnerability in nginx. The fix introduced a regression in certain environments. This update reverts the fix for CVE-2026-42533 pending further investigation. We apologize for the inconvenience. Original advisory details: It was discovered that nginx incorrectly handled certain...

CVE-2026-74260

A flaw was found in the Linux kernel's netfilter component, specifically within the nfdupnetdev module. This vulnerability arises from an imbalanced decrementation of recursion counters when network packets are transmitted, particularly during a possible migration to a different CPU. This imprope...

CVE-2026-74255

A flaw was found in the Linux kernel's Transparent Inter-Process Communication TIPC module. This use-after-free vulnerability occurs when the tipcdisablel2media function calls synchronizenet before properly invalidating a media pointer. This timing issue allows concurrent readers to access a memo...

Contentful MCP Server: export_space/import_space tools pass LLM-controlled `host`/`proxy` args to CMA client, redirecting server PAT to attacker-controlled endpoint

Summary exportspace and importspace tools in @contentful/mcp-tools accept LLM-controlled host and proxy parameters that are spread directly into the options object passed to contentful-export / contentful-import. These libraries pass the merged options — including the attacker-controlled host — t...

GHSA-2XHG-73J7-RRGX Contentful MCP Server: export_space/import_space tools pass LLM-controlled `host`/`proxy` args to CMA client, redirecting server PAT to attacker-controlled endpoint

Summary exportspace and importspace tools in @contentful/mcp-tools accept LLM-controlled host and proxy parameters that are spread directly into the options object passed to contentful-export / contentful-import. These libraries pass the merged options — including the attacker-controlled host — t...

Copier has a trust-prefix bypass via path traversal that runs tasks unprompted

Copier: trust-prefix bypass via path traversal runs tasks unprompted Summary In copier = 9.5.0, = 9.15.1, the trust setting's prefix match copier/settings.py compares the template URL against a trusted prefix with a raw str.startswith and no path normalization, while the URL is normalized when th...

GHSA-9GMC-JQMH-3RVM Copier has a trust-prefix bypass via path traversal that runs tasks unprompted

Copier: trust-prefix bypass via path traversal runs tasks unprompted Summary In copier = 9.5.0, = 9.15.1, the trust setting's prefix match copier/settings.py compares the template URL against a trusted prefix with a raw str.startswith and no path normalization, while the URL is normalized when th...

CVE-2026-74563

A flaw was found in the Linux kernel's Reliable Datagram Sockets RDS TCP module. The rdstcpladdrcheck function fails to hold the Read-Copy-Update RCU lock across an IPv6 address check. This allows a race condition where a network device can be freed while still being referenced, leading to a...

CVE-2026-72491

A flaw was found in the Linux kernel's net/9p RDMA transport module. An inconsistent locking mechanism around the rdma-state field allows for a race condition during connection teardown. This can lead to lost state transitions, corrupting the connection state machine. Consequently, a use-after-fr...

Security update for openssl-3-livepatches

This update for openssl-3-livepatches fixes the following issues: HollowByte: DoS vector against OpenSSL TLS ClientHello via remote, attacker-controlled memory allocations bsc1271712, bsc1271713. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like Ya...

CVE-2026-47219

A flaw was found in find-my-way, a routing module for Node.js. A remote attacker could exploit this vulnerability when find-my-way is used with Node's HTTP/2 server. By sending specially crafted HTTP/2 method values, an attacker can cause the application to crash, leading to a Denial of Service...

lamda v10.6

FIRERPA Android ｜ AI-Powered Automation An all-in-one Android automation framework that combines on-device services, AI-ready agents, and extensible tool invocation. Documentation | 使用文档 | TELEGRAM | QQ Group | SKILLS | llms-full.txt | 中文版本 FIRERPA is an all-in-one Android device control platform...

CVE-2026-72479

A flaw was found in the Linux kernel's iio: accel: mma8452 module. When an I2C read operation fails, the mma8452read function incorrectly returns a success status. This can lead to the mma8452readraw function using uninitialized stack memory, potentially resulting in information disclosure...

CVE-2026-72717

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a $... expression or backtick in a schema default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits...

CVE-2026-72716

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a $... expression or backtick in a query parameter default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permit...

CVE-2026-71868

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a $... expression or backtick in an enum default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits...