Apache Shiro input validation vulnerability (CNVD-2026-26205)

Apache Shiro is a security and permission framework that is open-source under the Apache Foundation in the United States. There is an input validation vulnerability in Apache Shiro. This vulnerability stems from the lack of escaping of special characters according to RFC 2253 in the...

PT-2026-55062

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a structural flaw was identified in DefaultCertValidator::verifySubjectAltName where the extracted DNS SAN string is cast to a C-style string using .c str before...

RHEL 8 : gnutls and libtasn1 (RHSA-2026:33125)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:33125 advisory. The gnutls packages provide the GNU Transport Layer Security GnuTLS library, which implements cryptographic algorithms and protocols such a...

PT-2026-57133

This update for sg3 utils fixes the following issue Update to version 1.44763+20.e416e091: - sg inq: --export output conformance for SCSI name string and ATA fields bsc1267823...

PT-2026-57137

This update for sg3 utils fixes the following issue Update to version 1.47+16.aad0b411: - sg inq: --export output conformance for SCSI name string and ATA fields bsc1267823...

PT-2026-55060

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.37.0 until 1.37.5 and 1.38.3, when the %REQUESTED SERVER NAMEX:Y% is used in log format and host related options is specified, like HOST FIRST, SNI FIRST, it's possible to crash Envoy when the specified...

Dell PowerFlex Manager encryption vulnerability (CNVD-2026-26082)

Dell PowerFlex Manager is a software-defined storage management platform developed by the American company Dell. Versions of Dell PowerFlex Manager prior to 4.5.1.1 contained security vulnerabilities. Attackers could exploit these vulnerabilities to carry out man-in-the-middle attacks using DNS...

PT-2026-53816

Name of the Vulnerable Software and Affected Versions Export User Data versions prior to 2.2.7 Description Insufficient file path validation in the unserialize function allows authenticated attackers with subscriber-level access or higher to delete arbitrary files on the server. This occurs when ...

PT-2026-53911

Name of the Vulnerable Software and Affected Versions Zephyr version 4.3.0 Zephyr version 4.4.0 Description The DNS resolver in subsys/net/lib/dns fails to properly validate the rdlength of resource records in DNS responses within the dns unpack answer function. This allows the acceptance of an...

Linux Distros Unpatched Vulnerability : CVE-2026-11703

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing SNI/ALPN binding on stateful session-ID resumption, which previously skipped the binding check performed for ticket-based resumption. A cached session...

Linux Distros Unpatched Vulnerability : CVE-2026-6731

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - X.509 name constraint bypass via the Subject Common Name when treated as a DNS-type name. A certificate whose Subject CN violates an issuing CA's DNS name...

Linux Distros Unpatched Vulnerability : CVE-2026-7532

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iPAddress name constraints bypass when WOLFSSLIPALTNAME is not defined. IP address name constraints are not enforced in that configuration, allowing a certifica...

Security update for unbound (important)

openSUSE security update: security update for unbound ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21083-1 Rating: important References: bsc1265578 bsc1265580 bsc1265581 bsc1265582 bsc1265583 bsc1265584 bsc1265585 bsc1265586 bsc1265587 bsc1265588...

Linux Distros Unpatched Vulnerability : CVE-2026-10592

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Certificates with wildcard DNS SANs e.g. .example.com bypassed CA name-constraint checks. A certificate with a wildcard DNS SAN that should be rejected by the...

cifs-utils: local privilege escalation via forged cifs.spnego key description in cifs.upcall

A flaw was found in the cifs-utils package where the cifs.upcall helper fails to securely drop its root privileges before looking up user information inside a user-controlled environment. A local, low privileged attacker can exploit this by using a crafted requestkey payload to trick the root-own...

mariadb: MariaDB Server: Arbitrary code execution via wsrep_notify_cmd

A flaw was found in MariaDB server. When the wsrepnotifycmd feature is enabled, a remote attacker could exploit this vulnerability by embedding shell commands in the name of a joiner node. This could lead to arbitrary code execution on the server, allowing the attacker to take full control of the...

CVE-2026-57951

Mythic before 3.4.0.60 contains a broken hasura permission filter on the payloadbuildstep table with an always-satisfied or condition that bypasses operation-scoped access controls. Authenticated operators and spectators can query payloadbuildstep to read stepstdout, stepstderr, stepname, and...

CVE-2026-13676

A flaw was found in fast-uri. This vulnerability occurs because fast-uri fails to properly convert Unicode Internationalized Domain Name - IDN hostnames for HTTP-family URLs. This can lead to a situation where security policies, such as denylists or redirect validations, are bypassed when...

EUVD-2026-40168

Mythic before 3.4.0.60 contains a broken hasura permission filter on the payloadbuildstep table with an always-satisfied or condition that bypasses operation-scoped access controls. Authenticated operators and spectators can query payloadbuildstep to read stepstdout, stepstderr, stepname, and...

Malicious code in @postidigital-feature/oneaccount-orgadmin-front (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4060c39db80353eb81ccea4c782c16b519931e13da0c78633fabd465d31df052 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...