CVE-2026-72419

A flaw was found in the Linux kernel's netfilter component. This vulnerability arises from a type confusion due to an invalid pointer use within the nfnat module when its initialization fails. A local attacker could exploit this issue by triggering the failed initialization, potentially causing a...

CVE-2026-75839

ArcadeDB com.arcadedb:arcadedb-server versions = 26.7.3 contain an insecure direct object reference IDOR vulnerability in the Raft cluster-info endpoints GetClusterHandler and PostBootstrapStateHandler, which authenticate but do not authorize access. On an ArcadeDB HA cluster only reachable when...

16 Typosquatted RubyGems Packages Steal Browser Credentials and Crypto Wallets

Cybersecurity researchers have flagged a new typosquatting campaign targeting RubyGems users with a Windows-based information stealer. OpenSourceMalware, which discovered the activity on August 15, 2026, is tracking the threat under the moniker StubMaker. The complete list of packages published a...

CVE-2026-75839 ArcadeDB before 26.8.1 Information Disclosure via Cluster Endpoints

ArcadeDB com.arcadedb:arcadedb-server versions = 26.7.3 contain an insecure direct object reference IDOR vulnerability in the Raft cluster-info endpoints GetClusterHandler and PostBootstrapStateHandler, which authenticate but do not authorize access. On an ArcadeDB HA cluster only reachable when...

CVE-2026-75839 ArcadeDB before 26.8.1 Information Disclosure via Cluster Endpoints

ArcadeDB com.arcadedb:arcadedb-server versions = 26.7.3 contain an insecure direct object reference IDOR vulnerability in the Raft cluster-info endpoints GetClusterHandler and PostBootstrapStateHandler, which authenticate but do not authorize access. On an ArcadeDB HA cluster only reachable when...

EUVD-2026-60603

ArcadeDB com.arcadedb:arcadedb-server versions = 26.7.3 contain an insecure direct object reference IDOR vulnerability in the Raft cluster-info endpoints GetClusterHandler and PostBootstrapStateHandler, which authenticate but do not authorize access. On an ArcadeDB HA cluster only reachable when...

CVE-2026-75839

ArcadeDB com.arcadedb:arcadedb-server versions = 26.7.3 contain an insecure direct object reference IDOR vulnerability in the Raft cluster-info endpoints GetClusterHandler and PostBootstrapStateHandler, which authenticate but do not authorize access. On an ArcadeDB HA cluster only reachable when...

CVE-2026-75839 ArcadeDB before 26.8.1 Information Disclosure via Cluster Endpoints

ArcadeDB com.arcadedb:arcadedb-server versions = 26.7.3 contain an insecure direct object reference IDOR vulnerability in the Raft cluster-info endpoints GetClusterHandler and PostBootstrapStateHandler, which authenticate but do not authorize access. On an ArcadeDB HA cluster only reachable when...

CVE-2026-75839

ArcadeDB com.arcadedb:arcadedb-server versions = 26.7.3 contain an insecure direct object reference IDOR vulnerability in the Raft cluster-info endpoints GetClusterHandler and PostBootstrapStateHandler, which authenticate but do not authorize access. On an ArcadeDB HA cluster only reachable when...

CVE-2026-72167

A flaw was found in the mtd: rawnand: pl353 component of the Linux kernel. During the probe function, the devmioremap call incorrectly uses the parent device instead of the pl35x device for resource allocation. This oversight prevents the register area from being properly released when the module...

CVE-2026-72418

A flaw was found in the Linux kernel's netfilter connection tracking module. When a new network connection attempts to reuse a socket that is in a temporary waiting state after closing, the system incorrectly identifies it as an already confirmed connection. This misidentification causes the...

CVE-2026-72433

A flaw was found in the Linux kernel's netfilter component, specifically within the nftmetabridge module. This vulnerability, a stack leak, occurs due to improper handling of return values, which fails to test for nonzero results. An attacker could potentially exploit this issue to gain access to...

CVE-2026-72242

A flaw was found in the Linux kernel's SELinux module. When handling Stream Control Transmission Protocol SCTP connections, a specific function attempts to access a network socket that may not exist. This can lead to a system crash, resulting in a Denial of Service DoS for affected systems...

CVE-2024-58375

A flaw was found in OpenTofu. When users enable static evaluation of module sources, versions, and backend configurations, the software does not properly restrict sensitive variables and locals. This oversight can lead to the exposure of values intended to be sensitive through these configuration...

CVE-2026-72231

A flaw was found in the batman-adv Better Approach To Mobile Ad-hoc Networking module of the Linux kernel. An incorrect check during the handling of TT Topology Table requests can prevent the proper cleanup of request nodes when send buffer allocation fails. This can lead to a remote attacker...

Exploit for Incomplete List of Disallowed Inputs in Fastgpt

fastgpt-sandbox-audit FastGPT Python sandbox escape chain aud...

pipewire: PipeWire: Sandbox escape and arbitrary code execution via malicious library loading

A flaw was found in PipeWire, a multimedia server. This vulnerability allows an attacker to escape sandboxed applications, such as Flatpak, by exploiting PipeWire's PulseAudio compatibility layer. An attacker with minimal permissions within a sandboxed environment can load a malicious library,...

BIT-AIRFLOW-2026-67587 Apache Airflow: DAG-author remote code execution on the Scheduler via a Serde `Callback` deserialization gadget

Apache Airflow's Task SDK rebuilt a Callback object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because SyncCallback is itself an Airflow class it passes the default alloweddeserializationclasses allow-list, so tightening that...

BIT-AIRFLOW-2026-67260 Apache Airflow: DAG-author remote code execution on the Scheduler via awaiting_input next_kwargs deserialization

Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new awaitinginput task state swept by the scheduler. That sweep deserializes the task instance's nextkwargs without an allow-list, so a Dag author — who controls that value through the task execution API — can cause an...

CVE-2026-72285

A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine TDX Trust Domain Extensions module. A local attacker, by concurrently modifying the CPUID entry count during the initialization of a virtual machine, could cause the CPUID parsing to access memory beyond the intended...