CVE-2026-69306: Not Failing Securely

Not failing securely 'failing open' in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-21399: Heap-based Buffer Overflow

Heap-based buffer overflow for the IntelR Open Volume Kernel Library IntelR Open VKL library maintained by intelR before version 2.0.2 within Ring 3: User Applications may allow a denial of service. System software adversary with an authenticated user combined with a low complexity attack may...

CVE-2026-19078: URL Redirection to Untrusted Site

A flaw was found in the oauth-server component. This open redirect vulnerability occurs when the 'then' parameter in the grant approval handler is not properly validated. A remote attacker can craft a malicious URL that, when approved or denied by an authenticated user, redirects them to an...

CVE-2026-19518: Improper Validation of Specified Quantity in Input

Improper Validation of Specified Quantity in Input vulnerability in Samsung Open Source rlottie allows Input Data Manipulation...

PT-2026-70324

Name of the Vulnerable Software and Affected Versions IntelR Open Volume Kernel Library IntelR Open VKL versions prior to 2.0.2 Description A heap-based buffer overflow exists within Ring 3: User Applications. A heap-based buffer overflow occurs when a program writes more data to a heap memory...

ALSA-2026:53845 Important: iscsi-initiator-utils security, bug fix, and enhancement update

The iscsi-initiator-utils packages provide the server daemon for the Internet Small Computer System Interface iSCSI protocol, as well as the utility programs used to manage it. The iSCSI protocol is a protocol for distributed disk access using SCSI commands sent over Internet Protocol IP networks...

agilerl (>=0.1.6, <=2.0.6), aihandler (>=1.8.15, <=1.10.2) +8 more potentially affected by CVE-2026-69112 via accelerate (0.18.0)

accelerate PYPI version 0.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on accelerate and may be impacted: - agilerl =0.1.6, =1.8.15, =1.8.17, =1.8.14, =0.0.1rc2, =0.0.1rc4 - open-gpts 0.0.1rc1 - pytorch-accelerated 0.1.45 Source cves: CVE-2026-691...

Malicious code in bigtime (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d14cc45326877547d5297956e4c2b5719122bcef140db0d7959e1b4da94e58d7 The package presents itself as a time module wrapper, but its init.py invokes qwe900.init, which performs two exfiltration behaviors on import. First...

MAL-2026-13712 Malicious code in bigtime (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d14cc45326877547d5297956e4c2b5719122bcef140db0d7959e1b4da94e58d7 The package presents itself as a time module wrapper, but its init.py invokes qwe900.init, which performs two exfiltration behaviors on import. First...

testkube v2.12.1

The Open Testing Platform for AI-driven Engineering Teams Testkube provides a single platform for defining, running and analyzing automated tests, using your existing testing tools/scripts, running in your Kubernetes infrastructure...

GHSA-8CJM-8MP7-R2XF vulnerabilities

Vulnerabilities for packages: openstack-horizon-2026.1, openstack-horizon-2026.1-fips...

CVE-2026-48587 vulnerabilities

Vulnerabilities for packages: openstack-horizon-2026.1, openstack-horizon-2026.1-fips...

⚡ Weekly Recap: AI Goes Rogue, Metabase 0-Day, MCP Supply-Chain Attacks, and Router Backdoors

A lot of security problems still begin with someone doing a completely normal thing. Cloning a repo. Answering a call. Leaving a box exposed. Trusting the default. That pretty much covers the mood this week. Old bugs are back, supply chains are getting stranger, and some exploit paths are so shor...

CVE-2026-72689

A broken object-level authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read complete contract records via the getDocument Parse cloud function. The function fetches documents using useMasterKey, bypassing the object ACL, and...

CVE-2026-72688

A missing authentication vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read arbitrary stored documents via the fileupload Parse cloud function. The function mints MASTERKEY-signed file access tokens for any caller-supplied URL without...

CVE-2026-68178

In the Linux kernel, the following vulnerability has been resolved: misc: nsm: pin the module while the device is open miscopen installs a misc driver's file operations with fopsget, which pins fileoperations::owner before replacing the file's fop. The NSM misc device leaves nsmdevfops.owner unse...

CVE-2026-68146

In the Linux kernel, the following vulnerability has been resolved: ftrace: Add global mutex to serialize traceparser access In ftrace, the traceparser structure is allocated and initialized when a trace file is opened, and is subsequently used across write and release handlers to parse user inpu...

CVE-2026-68123

In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix GSO userspace truncation underflow OVSACTIONATTRTRUNC currently stores a delta from the original skb length in OVSCBskb-cutlen. When a later userspace action segments a GSO skb, queuegsopackets reuses that delta...

CVE-2026-64941

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in phoenixframework phoenixliveview allows an attacker to send a victim's browser to an origin of the attacker's choosing via a :to value containing ASCII tab, LF or CR. redirect/2 validates :to through the private validatelocalurl!/...

EUVD-2026-55617

A flaw was found in StackRox/RHACS Central's Auth Machine-to-Machine M2M token exchange. When an administrator configures M2M role mappings, the system uses unanchored regular expressions for matching claim values. This allows an attacker with a valid OpenID Connect OIDC token, whose claim value ...