SkillShield: Prompt-Space Security Skills for LLM Coding Agents

A coding agent edits files and executes shell commands with its developer's privileges, allowing malicious requests to translate directly into harmful actions or functional malware. Existing defenses have complementary limitations: weight-level alignment is unavailable to API-only deployers,...

Linux Distros Unpatched Vulnerability : CVE-2026-80528

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ceph: avoid fs reclaim while using current-journalinfo handlereply stores a cephmdsrequest pointer in current-journalinfo while filling the inode and dentry cac...

CVE-2026-80565: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: crypto: qce - fix error path in devmqceregisteralgs If ops-registeralgs fails, the error path repeatedly calls the same ops-unregisteralgs from the failed registration. Use the loop index to unregister the previously registered...

CVE-2026-75325

DWSurvey v6.14.0 is vulnerable to an authentication bypass flaw. The vulnerability can be triggered via the '/api/dwsurvey/none/' and '/api/dwsurvey/up/ '** parameters. This flaw allows unauthorized access to restricted functionality. No specific remediation, exploit details, or in-the-wild explo...

Linux Distros Unpatched Vulnerability : CVE-2026-63676

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - libyaml-perl - None Ubuntu Linux - backtracking leading to exponential load time CVE-2026-63676 Note that Nessus relies on the presence of the...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098710)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098710 advisory. In the Linux kernel, the following vulnerability has been resolved: NFSD: fix race between nfsd registration and exportsproc As of now nfsd calls...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-bleach (UTSA-2026-093655)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093655 advisory. A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea,...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-104531)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104531 advisory. In the Linux kernel, the following vulnerability has been resolved: ipvs: use parsed transport offset in SCTP state lookup setsctpstate reads the SCTP chunk header...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098699)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098699 advisory. In the Linux kernel, the following vulnerability has been resolved: net: Fix null-ptr-deref by socklockinitclassandname and rmmod. When I ran the repro 0 and waited...

Low: mingw-openssl security update

The OpenSSL toolkit provides support for secure communications between machines. OpenSSL includes a certificate management tool and shared libraries which provide various cryptographic algorithms and protocols. This package contains Windows MinGW libraries and development tools. Security Fixes:...

PT-2026-82359

Name of the Vulnerable Software and Affected Versions OpenStack Keystone versions prior to 29.0.3 Description An authenticated user with the role:reader role on any project can list all project-scoped role assignments under any domain. This occurs when a domain ID is passed as scope.project.id wi...

System-Velocity

System-Velocity Proxy-level security and maintenance for Veloci...

CVE-2026-45018

Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST /mcp endpoint without requiring authentication. For stdio transport, the...

GHSA-HVFH-5MJ3-5F3J Chainlist has SSRF via MCP SSE and streamable-http transports that allows unauthenticated internal network access

Am I affected? Only if your deployment sets features.mcp.enabled = true in .chainlit/config.toml. MCP has been disabled by default since v2.7.0, so most Chainlit deployments are not affected. No authentication is required: /mcp is reachable by any client that can open a session. Summary When MCP ...

Chainlist has SSRF via MCP SSE and streamable-http transports that allows unauthenticated internal network access

Am I affected? Only if your deployment sets features.mcp.enabled = true in .chainlit/config.toml. MCP has been disabled by default since v2.7.0, so most Chainlit deployments are not affected. No authentication is required: /mcp is reachable by any client that can open a session. Summary When MCP ...

Chainlit has command injection via MCP stdio transport that allows unauthenticated remote code execution

Am I affected? Only if your deployment sets features.mcp.enabled = true in .chainlit/config.toml. MCP has been disabled by default since v2.7.0, so most Chainlit deployments are not affected. No authentication is required: /mcp is reachable by any client that can open a session. Summary When MCP ...

GHSA-W3FX-MC44-MF6J Chainlit has command injection via MCP stdio transport that allows unauthenticated remote code execution

Am I affected? Only if your deployment sets features.mcp.enabled = true in .chainlit/config.toml. MCP has been disabled by default since v2.7.0, so most Chainlit deployments are not affected. No authentication is required: /mcp is reachable by any client that can open a session. Summary When MCP ...

CVE-2026-45018 Chainlit: Command injection via MCP stdio transport allows unauthenticated remote code execution

Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST /mcp endpoint without requiring authentication. For stdio transport, the...

EUVD-2026-65737

Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST /mcp endpoint without requiring authentication. For stdio transport, the...

CVE-2026-45018 Chainlit: Command injection via MCP stdio transport allows unauthenticated remote code execution

Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST /mcp endpoint without requiring authentication. For stdio transport, the...