EUVD-2026-46305

PraisonAI is a multi-agent teams system. Prior to version 4.6.40, hidden metadata in a webpage causes PraisonAI agents to write attacker-controlled content to arbitrary paths. writefile skips path validation when workspace=None always None in production. Version 4.6.40 fixes the issue...

slopguard

--- Your AI writes code faster than you can read it. That is th...

Minima-private

Minima Minima is a blockchain with an emphasis on every user...

Security Bulletin: This Power System update is being released to address CVE-2026-11885

Summary A carefully crafted OS hypervisor call can cause the PowerVM hypervisor to crash or compromise system or OS memory integrity. Vulnerability Details CVEID:CVE-2026-11885 DESCRIPTION: A carefully crafted OS hypervisor call can cause the PowerVM hypervisor to crash or compromise OS memory...

Security Bulletin: Vulnerabilities in Apache Tomcat affect IBM SAN Volume Controller, IBM Storwize, IBM Storage Virtualize and IBM FlashSystem products

Summary Vulnerabilities in Apache Tomcat affect the product's management GUI could cause confidentiality, integrity and availability impacts. The CLI is unaffected. CVE-2025-48976 CVE-2025-48988 CVE-2025-49125 CVE-2025-53506 CVE-2025-52434 CVE-2025-55752 CVE-2025-61795. Vulnerability Details...

Security Bulletin: Vulnerability in netty-codec-http affects IBM SAN Volume Controller, IBM Spectrum Virtualize and IBM FlashSystem products

Summary A vulnerability in netty-codec-http affects IBM Storage Virtualize products and could cause an integrity impact. CVE-2025-67735. Vulnerability Details CVEID:CVE-2025-67735 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.129.Final...

Security update for php7

This update for php7 fixes the following issue CVE-2026-14355: The AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw bsc1270351. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypp...

SUSE-SU-2026:3165-1 Security update for php7

This update for php7 fixes the following issue - CVE-2026-14355: The AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw bsc1270351...

Security update for php8

This update for php8 fixes the following issues Update to version 8.3.32. CVE-2026-12184: Failure to setup TLS with a remote server can result in a remote DoS bsc1270712. CVE-2026-14355: The AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw bsc1270351...

SUSE-SU-2026:3164-1 Security update for php8

This update for php8 fixes the following issues - Update to version 8.3.32 - CVE-2026-12184: Failure to setup TLS with a remote server can result in a remote DoS bsc1270712. - CVE-2026-14355: The AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw bsc12703...

Security Bulletin: Vulnerabilities in multiple components affect IBM SAN Volume Controller, IBM Spectrum Virtualize and IBM FlashSystem products

Summary Vulnerabilities in openssh, libssh, kernel and gnutls components affect IBM Storage Virtualize products and could cause confidentiality, integrity and availability impacts. CVE-2026-35387 CVE-2026-35414 CVE-2025-5372 CVE-2022-50865 CVE-2025-39971 CVE-2025-14831. Vulnerability Details...

Security Bulletin: IBM DataPower Gateway affected by multiple CVEs in OS kernel

Summary The following CVEs in the OS kernel may affect IBM DataPower Gateway Vulnerability Details CVEID:CVE-2025-38180 DESCRIPTION: In the Linux kernel, the following vulnerability has been resolved: net: atm: fix /proc/net/atm/lec handling /proc/net/atm/lec must ensure safety against devlec...

Zimbra Patches Critical SNMP Command Injection and Four XSS Vulnerabilities

Zimbra has rolled out fixes to address multiple critical security issues, including a command injection flaw in the Simple Network Management Protocol SNMP monitoring component. As many as nine security vulnerabilities have been patched in Zimbra 10.1.20. Topping the list is a command injection...

SUSE CVE-2026-16221

Impact: fast-uri versions from 2.3.1 through 4.1.0 including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2 do not treat a literal backslash character U+005C as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the...

SUSE CVE-2026-63877

In the Linux kernel, the following vulnerability has been resolved: serial: dz: Convert to use a platform device Prevent a crash from happening as the first serial port is initialised: Console: switching to colour frame buffer device 160x64 tgafb: SFB+ detected, rev=0x02 fb0: Digital ZLX-E1 frame...

SUSE CVE-2026-64049

In the Linux kernel, the following vulnerability has been resolved: drm/msm/adreno: fix userspace-triggered crash on a2xx-a4xx Before a5xx Adreno driver will not try fetching UBWC params because those generations didn't support UBWC anyway, however it's still possible to query UBWC-related params...

SUSE CVE-2026-64091

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix TOCTOU race for reported vlans The local TT based TVLV is generated by first checking the number of VLANs which have at least one TT entry. A new buffer with the correct size for the VLANs is then allocated...

SUSE CVE-2026-64174

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: advance loop vars in cfg80211mergeprofile cfg80211mergeprofile reassembles a Multi-BSSID non-transmitted BSS profile that has been split across multiple consecutive MBSSID elements. Its while-loop calls...

SUSE CVE-2026-64187

In the Linux kernel, the following vulnerability has been resolved: xfs: fail recovery on a committed log item with no regions If the first op of a transaction is a bare transaction header len == sizeofstruct xfstransheader, xlogrecoveraddtotrans adds an item but no region, leaving it on ritemq...

Open-Source Android AI Agents Could Let Invisible Screen Text Run Code on Host PCs

An Android app that can draw over other windows and write to shared storage can slip instructions to the AI agent driving that phone, in text no human eye will ever see. Two more steps, and the same app is running commands on the PC driving the agent. Researchers demonstrated that chain, plus six...