67 matches found
Attackers Steal METR API Key and Consume AI Credits Worth About $600,000
METR short for Model Evaluation and Threat Research and pronounced "Meter", a research non-profit that evaluates frontier artificial intelligence AI models for their ability to carry out long-horizon, agentic tasks, disclosed that it suffered "two notable security incidents" where external actors...
CVE-2026-17431 PDF::WebKit versions through 1.2 for Perl allow OS command injection via a 2-arg open() of the output path in to_pdf and of stylesheet paths in _style_tag_for
PDF::WebKit versions through 1.2 for Perl allow OS command injection via a 2-arg open of the output path in topdf and of stylesheet paths in styletagfor. topdf reads the generated PDF back from its path argument, and styletagfor reads each entry of the stylesheets list, by assigning the path to a...
The vulnerability of the hidraw_open() function in the drivers/hid/hidraw.c module of the Linux kernel’s device subsystem allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the hidrawopen function in the drivers/hid/hidraw.c module of the Linux device subsystem driver module is related to errors during link counters updates. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of t...
Apache Camel: KeycloakSecurityPolicy has Improper Authentication, Missing Authentication for Critical Function and Failing Open Vulnerabilities
Improper Authentication, Missing Authentication for Critical Function, Not Failing Securely 'Failing Open' vulnerability in Apache Camel Keycloak Component. The KeycloakSecurityPolicy of camel-keycloak guards a route by running KeycloakSecurityProcessor.beforeProcess, which performs three checks ...
RHEL 9 : python3.14 (RHSA-2026:28247)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:28247 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level...
Important: python3.14 security, bug fix, and enhancement update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...
Fedora 42 : perl-Crypt-DSA (2026-ffe3625a50)
The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ffe3625a50 advisory. This update fixes a couple of security issues: Replace two arg open CVE-2026-8704 Replace rand with a cryptographically-secure source of random data...
RockyLinux 8 : python3.11 (RLSA-2026:11062)
The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:11062 advisory. python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules CVE-2026-6100 python: cpython: Python:...
CVE-2026-41377 OpenClaw < 2026.3.31 - Fail-Open Security Scan Bypass in Plugin Installation
OpenClaw before 2026.3.31 contains a fail-open vulnerability in the plugin installation flow where security scan failures do not block installation. Attackers can exploit scan failures to install untrusted plugins when operators proceed despite visible scan warnings...
RHEL 9 : python3.11 (RHSA-2026:9042)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:9042 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic dat...
RockyLinux 9 : python3.11 (RLSA-2026:6286)
The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:6286 advisory. python: Python: Command-line option injection in webbrowser.open via crafted URLs CVE-2026-4519 Tenable has extracted the preceding description block directly fro...
MiracleLinux 8 : python3-3.6.8-75.el8_10.ML.1 (AXSA:2026-407:04)
The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-407:04 advisory. python: Python: Command-line option injection in webbrowser.open via crafted URLs CVE-2026-4519 Tenable has extracted the preceding description block directly...
Not Failing Securely ('Failing Open')
Overview authlib is a library in building OAuth and OpenID Connect servers. Affected versions of this package are vulnerable to Not Failing Securely 'Failing Open' via the verifyhash function in authlib/oidc/core/claims.py. An attacker can substitute an access token or authorization code undetect...
OESA-2026-1441 libtiff security update
This provides support for the Tag Image File Format TIFF, a widely used format for storing image data. The latest version of the TIFF specification is available on-line in several different formats.And contains command-line programs for manipulating TIFF format image files using the libtiff...
The vulnerability of the __fbnic_open() function in the drivers/net/ethernet/meta/fbnic/fbnic_netdev.c file of the Linux kernel’s network adapter driver allows a hacker to cause a service failure.
The vulnerability of the fbnicopen function in the drivers/net/ethernet/meta/fbnic/fbnicnetdev.c file of the Linux kernel’s network adapter driver module is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to cause a service failure...
The vulnerability of the function tcp_fastopen_active_disable_ofo_check() in the net/ipv4/tcp_fastopen.c module, as part of the IPv4 protocol implementation in Linux kernel, allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the function tcpfastopenactivedisableofocheck in the net/ipv4/tcpfastopen.c module, which is part of the IPv4 protocol implementation in Linux kernel, relates to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise...
CVE-2023-29053
A vulnerability has been identified in JT Open All versions V11.3.2.0, JT Utilities All versions V13.3.0.0. The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted JT files. This could allow an attacker to execute code in the...
kernel: Linux kernel: Privilege escalation or Denial of Service via TCP Fast Open vulnerability
A flaw was found in the Linux kernel. A local attacker with low privileges could exploit a memory corruption vulnerability, specifically a use-after-free and double-free, within the TCP Fast Open TFO socket processing. This occurs when a listener is closed while a TFO socket is being processed in...
Structured Extraction of Vulnerabilities in OpenVAS and Tenable WAS Reports Using LLMs
This paper proposes an automated LLM-based method to extract and structure vulnerabilities from OpenVAS and Tenable WAS scanner reports, converting unstructured data into a standardized format for risk management. In an evaluation using a report with 34 vulnerabilities, GPT-4.1 and DeepSeek...
