NULL Pointer Dereference

Overview org.lz4:lz4-java is a Java port of the LZ4 compression algorithm and the xxHash hashing algorithm. Affected versions of this package are vulnerable to NULL Pointer Dereference and out-of-bounds read in the native XXHash implementations reached through XXHashFactory.nativeInstance, where...

kernel: KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Don't recheck L1 intercepts when completing userspace I/O When completing emulation of instruction that generated a userspace exit for I/O, don't recheck L1 intercepts as KVM has already finished that phase of instructi...

Security Bulletin: The following vulnerabilities that can affect IBM Storage Scale Cluster Export Services (CES) S3 are now addressed in 5.2.3.9 or higher and 6.0.1.0 or higher

Summary The following vulnerabilities, which can affect IBM Storage Scale IBM Storage Scale Cluster Export Services CES S3 and could provide weaker-than-expected security, are now addressed in Storage Scale 5.2.3.9 or higher or 6.0.1.0 or higher. Vulnerability Details CVEID:CVE-2026-25680...

Ray: Arbitrary code execution via ray.data.read_webdataset default decoder: pickle.loads(value) and torch.load(weights_only=False)

Summary ray.data.readwebdatasetpaths=... is a @PublicAPIstability="alpha" reader for WebDataset-format TAR files. Its default decoder=True invokes defaultdecoder on every sample's keys, which routes file extension to a decoder by extension. Two of those branches deserialize attacker-controlled...

GHSA-HHRP-GW25-JR43 Ray: Arbitrary code execution via ray.data.read_webdataset default decoder: pickle.loads(value) and torch.load(weights_only=False)

Summary ray.data.readwebdatasetpaths=... is a @PublicAPIstability="alpha" reader for WebDataset-format TAR files. Its default decoder=True invokes defaultdecoder on every sample's keys, which routes file extension to a decoder by extension. Two of those branches deserialize attacker-controlled...

Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to multiple vulnerabilitie

Summary Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to multiple vulnerabilitie CVE-2026-55602, CVE-2026-53550, CVE-2026-48710, CVE-2026-48817, CVE-2026-48818, CVE-2026-54282, CVE-2026-54283, CVE-2026-13676, CVE-2026-12208, CVE-2026-13149, CVE-2026-5988...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: rust: cargo-1.97.1-2.hum1 aarch64, x8664 clippy-1.97.1-2.hum1 aarch64, x8664 rust-1.97.1-2.hum1 aarch64, x8664 rust-analyzer-1.97.1-2.hum1 aarch64, x8664 rust-debugger-common-1.97.1-2.hum1 noarch...

httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling

Summary The httplib2 HTTP client library performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate. A malicious or compromised HTTP server can return a small compressed payload approximately 150 KB that expands to an arbitrarily large size in memory 1...

GHSA-J5G9-F88F-GFJ3 httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling

Summary The httplib2 HTTP client library performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate. A malicious or compromised HTTP server can return a small compressed payload approximately 150 KB that expands to an arbitrarily large size in memory 1...

K000162380: XPath vulnerability CVE-2026-32287

Security Advisory Description Boolean XPath expressions that evaluate to true can cause an infinite loop in logicalQuery.Select, leading to 100% CPU usage. This can be triggered by top-level selectors such as "1=1" or "true". CVE-2026-32287 Impact A local, unauthenticated attacker can exploit the...

Don’t get fooled by TikTok resin art scams

Resin art has become a popular corner of TikTok, with some videos attracting millions of views. But not every glossy, colorful post is what it claims to be. Scammers are using the look of handmade resin art to trick buyers, collectors, and even fellow artists into sending money for work that eith...

Security Bulletin: Multiple Security Vulnerabilities in the Containerized Version of IBM Guardium Key Lifecycle Manager

Summary Multiple security vulnerabilities affecting the containerized version of IBM Guardium Key Lifecycle Manager have been addressed. Vulnerability Details CVEID:CVE-2025-5278 DESCRIPTION: A flaw was found in GNU Coreutils. The sort utility's begfield function is vulnerable to a heap buffer...

K000162431: Spring Integration vulnerability CVE-2026-40987

Security Advisory Description A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem outside the configured local-directory with attacker-controlled content. Affected versions: Spring Integration 7.0.0 through 7.0.4; 6.5.0 through 6.5.8; 6.4.0...

Bing Images Flaws Let Crafted SVGs Run Commands as SYSTEM on Microsoft's Servers

A crafted SVG submitted to Bing's image search ran commands as NT AUTHORITY\SYSTEM on Microsoft's production image-processing workers, and as root on the Linux machines in the same fleet. XBOW's testing got the same result on workers across different hosts and network ranges, so the problem sat i...

Exploit for CVE-2026-65761

CVE-2026-65761 — EasyStore Joomla Pre-Auth SQL Injection filter...

Why AI Needs a “Genie Coefficient”

This essay was written with Barath Raghavan, and originally appeared inIEEE Spectrum. Major benchmarks measure what AI can do. None measure whether it does what you mean: the distance between what you ask an AI to do and the unspoken assumptions about how you want the AI to do it. We propose a ne...

Exploit for Interpretation Conflict in Wordpress

CVE-2026-63030 + CVE-2026-60137 — WP2Shell WordPress Core Pre-Au...

kernel: KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Don't recheck L1 intercepts when completing userspace I/O When completing emulation of instruction that generated a userspace exit for I/O, don't recheck L1 intercepts as KVM has already finished that phase of instructi...

Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry

Someone installed a popular AI assistant on a rented server, switched off the setting that makes it ask permission before running risky commands, and pointed it at Thailand's Ministry of Finance, which runs the country's treasury and tax collection. The agent then worked through the ministry's...

kernel: KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Don't recheck L1 intercepts when completing userspace I/O When completing emulation of instruction that generated a userspace exit for I/O, don't recheck L1 intercepts as KVM has already finished that phase of instructi...