CVE-2026-0294

A privilege escalation PE vulnerability in the Palo Alto Networks Prisma® Access Agent app on Windows and macOS devices enables a local user to execute code with elevated privileges. The Prisma Access Agent on Linux, iOS, Android, and ChromeOS is not affected...

CVE-2026-0294 Prisma Access Agent: Local Privilege Escalation

A privilege escalation PE vulnerability in the Palo Alto Networks Prisma® Access Agent app on Windows and macOS devices enables a local user to execute code with elevated privileges. The Prisma Access Agent on Linux, iOS, Android, and ChromeOS is not affected...

CVE-2026-0291

CVE-2026-0291 affects Palo Alto Networks Prisma Access Agent on Linux. It is an improper link resolution before file access vulnerability that enables a local, low-privilege user to delete system files in a limited scope and disable the Prisma Access Agent. Affected: Linux; not affected on macOS,...

CVE-2026-0290

CVE-2026-0290 is an information disclosure vulnerability in the Account Protection feature of Palo Alto Networks Prisma Browser . A local attacker with low privileges can view sensitive data exposed by the feature. The NVD assigns a CVSS 3.1 score of 5.5 (Medium) , while Palo Alto Networks' own C...

Palo Alto Networks PAN-OS 10.2.x < 10.2.8 / 11.1.x < 11.1.16-h1 Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is 10.2.x prior to 10.2.8 or 11.1.x prior to 11.1.16-h1. It is, therefore, affected by a vulnerability. An information disclosure vulnerability in the URL Filtering feature of Palo Alto Networks PAN-OS software enables an...

USN-8633-1 linux, linux-aws, linux-aws-fips, linux-azure-4.15, linux-azure-fips, linux-fips, linux-gcp-4.15, linux-gcp-fips, linux-kvm vulnerabilities

Siebe Devroe, Héloïse Gollier, and Mathy Vanhoef discovered that the WiFi implementation in the Linux kernel did not properly handle aggregated frames in mesh networks, due to an incorrect fix for CVE-2020-24588. A physically proximate attacker could use this issue to inject packets. CVE-2025-275...

PT-2026-71100

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description Credentials for a deleted user may remain valid for a short period under specific conditions. Recommendations At the moment, there is no information about a new...

CVE-2026-68301

In the Linux kernel, the following vulnerability has been resolved: net: hsr: fix memory leak on slave unregistration by removing synced VLANs When an HSR master device is brought UP, it auto-adds VLAN 0 via vlanvid0add, which propagates VID 0 to its slave devices slave A and B. If a slave device...

EUVD-2026-55619

Use of Hard-coded Credentials vulnerability in Zyxel Networks WAH7601 allows Read Sensitive Constants Within an Executable. This issue affects WAH7601: through 20.07.2026...

CVE-2026-68301

The CVE-2026-68301 entry details a Linux kernel net: hsr memory leak where, on slave unregistration, VLAN IDs synced to the slave (including VID 0) are not deleted, leaving vlan_info/vlan_vid_info refs and causing a leak when the slave is destroyed. The fix adds vlan_vids_del_by_dev(port-&gt;dev,...

CVE-2026-68301 net: hsr: fix memory leak on slave unregistration by removing synced VLANs

In the Linux kernel, the following vulnerability has been resolved: net: hsr: fix memory leak on slave unregistration by removing synced VLANs When an HSR master device is brought UP, it auto-adds VLAN 0 via vlanvid0add, which propagates VID 0 to its slave devices slave A and B. If a slave device...

CVE-2026-72581 duhow xiaoai-patch - Server-Side Request Forgery in /auth Endpoint

A server-side request forgery SSRF vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to make the Xiaomi smart speaker perform HTTP requests to arbitrary internal or external URLs. The /auth endpoint in api/main.py uses the user-supplied url POST parameter to...

Nmap Port Scanner 7.991

Nmap is a utility for port scanning large networks, although it works fine for single hosts. Sometimes you need speed, other times you may need stealth. In some cases, bypassing firewalls may be required. Not to mention the fact that you may want to scan different protocols UDP, TCP, ICMP, etc...

F5 Networks BIG-IP : NLnet Labs Unbound vulnerability (K000162784)

The version of F5 Networks BIG-IP installed on the remote host is prior to 17.1.3.5 / 17.5.1.9 / 21.1.0.2. It is, therefore, affected by a vulnerability as referenced in the K000162784 advisory. NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the jostle logic that cou...

CVE-2026-62857

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. From version 1.2.0 through the affected 1.9, 1.10, 2.0, 2.1, 2.2, and 2.3 maintenance lines, getNodeInfo follows an attacker-controlled links.href value from /.well-known/nodeinfo without scheme, redirect, o...

Johnson Controls Inc. TL280

ADVISORY SUMMARY Successful exploitation of this vulnerability could allow an attacker to access sensitive information on the device. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Minimize network exposure for...

CVE-2026-55524

PraisonAI is a multi-agent teams system. In versions prior to 1.6.58, the webcrawl tool performs its SSRF check only on the initially supplied URL, allowing the protection to be bypassed so the tool connects to attacker-chosen internal destinations. The check resolves the hostname once with...

Malicious code in bnpl-blocks-atom-bnpl-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5510d446112b9ad4b6de3da9fa7128566dc13de6707bc0d627940344f8c7322d On require of this package, runtime.js downloads a platform-specific executable from string-split-obfuscated hosts under oob-worker.cf10x-.workers.de...

SUSE CVE-2026-49258

Nebula Mesh is a self-hosted control plane for the Slack Nebula mesh VPN. In versions 0.3.5 and below, the web UI /ui/ does not apply the per-operator CA scoping employed by the JSON API. This was partially addressed by GHSA-598g-h2vc-h5vg, but the changes were not implemented in the web...

SUSE CVE-2026-55391

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.63.0, datamodel-code-generator validates a URL host once in src/datamodelcodegenerator/http.py through...