A Systematic Study of Security Enforcement at Android Inter-Component Boundaries

Android's inter-process communication IPC mechanisms Activities, Services, BroadcastReceivers, ContentProviders, and URI scheme handlers form the primary interface between applications and between applications and the system. We present a systematic study of security enforcement comprising 120...

Linux Distros Unpatched Vulnerability : CVE-2026-105516

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - nfs-ganesha - None Ubuntu Linux - nfs-ganesha: 9P TWALK component count stack buffer overflow CVE-2026-105516 Note that Nessus relies on the...

Rocky Linux 9.6 [TuxCare] Security Update: python3.11 / python3.11-debug / python3.11-devel / python3.11-idle / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1791530000)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791530000 advisory. - A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its snicallback assigns a...

WS-2026-0157

vllm 0.10.2 - 0.24.0: the Nemotron-VL processor modules set Image.MAXIMAGEPIXELS = None at import, disabling Pillow's decompression-bomb guard process-wide so a crafted image can exhaust worker memory GHSA-mm38-5g96-7j6x...

PT-2026-117589

Summary An admin who revokes or downgrades a non-admin user's permissions through pyLoad's own documented /api/ RPC surface — e.g. POST /api/set user permission or its legacy alias /api/setUserPermission — updates the target's database row but never invalidates that user's existing Flask cookie...

PT-2026-117124

Description Summary In Vikunja v2.6.0 the project-permission engine resolves a user's effective permission on a project as the MAX over the entire reachable project subtree. As a result, when a user has been granted a higher permission on a parent project and the owner explicitly shares a child...

The Limits of Query Monitoring against Distributed Model Extraction

Model providers now face distillation campaigns run through thousands of accounts, each of which looks like an ordinary user. When network and payment metadata cannot link those accounts, the only evidence left is what they ask. We study what a provider can and cannot learn from those queries...

PT-2026-117590

Summary pyLoad determines the "client IP" used for its rate-limiting decorator and for its security/audit logging by reading the client-supplied X-Forwarded-For XFF HTTP header and taking the leftmost value. No trusted-proxy configuration exists the Cheroot WSGI server faces clients directly, and...

PT-2026-117588

Summary Api.getUserData legacy and Api.get userdata are declared with @permissionPerms.ANY and are reachable at /api/getUserData and /api/get userdata. Because Perms.ANY == 0 and pyLoad's permission check is a bitmask AND, that gate is a no-op: every authenticated account passes, including one...

Wireshark 1.12.x < 1.12.5 Multiple Vulnerabilities (macOS)

The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 1.12.5. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-1.12.5 advisory. - The detectversion function in wiretap/logcat.c in the Android Logcat file parser in Wireshark 1.12.x...

PT-2026-109165

ssl.SSLContext.wrap bio didn't require the server hostname argument to not be None if ssl.SSLContext.check hostname was set. Due to a missing parameter check in SSLObject, if the server hostname argument isn't supplied then hostname verification would be silently skipped. This defect could lead t...

PT-2026-109167

ssl.SSLContext.wrap bio didn't require the server hostname argument to not be None if ssl.SSLContext.check hostname was set. Due to a missing parameter check in SSLObject, if the server hostname argument isn't supplied then hostname verification would be silently skipped. This defect could lead t...

Unbreakable Enterprise kernel security update

5.15.0-325.221.6.1 - x86/kexec: Add EFI config table identity mapping for kexec kernel Tao Liu Orabug: 40127851 - KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page Sean Christopherson Orabug: 40127747 CVE-2026-80726 5.15.0-325.221.6 - scsi: qla2xxx: Preserve PURLS head o...

A Robust Digital Receiver Architecture for Continuous-Variable Quantum Key Distribution

Continuous-variable quantum key distribution utilizes advanced digital signal processing techniques to mitigate channel impairments, driving the progress of high-performance quantum secure communications. Specifically, digital heterodyne receivers are commonly implemented using down-conversion...

AlmaLinux 9.2 [TuxCare] Security Update: python3.11 / python3.11-debug / python3.11-devel / python3.11-idle / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1791572599)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1791572599 advisory. - A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its snicallback assigns a differen...

AlmaLinux 9.6 [TuxCare] Security Update: python3.11 / python3.11-debug / python3.11-devel / python3.11-idle / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1791530000)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791530000 advisory. - A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its snicallback assigns a differen...

Linux Distros Unpatched Vulnerability : CVE-2026-105517

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - nfs-ganesha - None Ubuntu Linux - Unknown description CVE-2026-105517 Note that Nessus relies on the presence of the package as reported by the...

Security Bulletin: Multiple Vulnerabilities in Hyper-Converged Database 1.2

Summary Multiple vulnerabilities were addressed in Hyper-Converged Database version 1.2.7 Vulnerability Details CVEID:CVE-2026-42583 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Lz4FrameDecoder allocates a ByteBuf of...

Security Bulletin: IBM i is Affected By An Improper Neutralization of Input Vulnerability in HTTP Server Administration GUI [CVE-2026-93886]

Summary IBM i is vulnerable to allowing a remote user to execute script code due to improper validation CVE-2026-93886 in HTTP Server Administration Graphical User Interface GUI as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-93886 DESCRIPTION: IBM i could...

A heap buffer overflow vulnerability in rsyslog impacts AIX

IBM SECURITY ADVISORY First Issued: Thu Oct 8 23:26:42 CDT 2026 The most recent version of this document is available here: http://aix.software.ibm.com/aix/efixes/security/rsyslogadvisory2.asc Security Bulletin: A heap buffer overflow vulnerability in rsyslog impacts AIX...