PT-2026-64974

A vulnerability was identified in AstrBotDevs AstrBot up to 4.25.5. Affected is an unknown function of the file astrbot/core/astr main agent.py. The manipulation of the argument req.func tool leads to incorrect authorization. The attack may be initiated remotely. The exploit is publicly available...

PT-2026-64992

A security flaw has been discovered in AstrBotDevs AstrBot up to 4.25.5. Affected by this vulnerability is the function build handoff toolset of the file AstrBot/astrbot/core/astr agent tool exec.py of the component Subagent. The manipulation results in incorrect authorization. The attack may be...

VulnCheck KEV: CVE-2025-68686

An Exposure of Sensitive Information to an Unauthorized Actor vulnerability CWE-200 vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions may allow a remote unauthenticated attacker to bypas...

Linux Distros Unpatched Vulnerability : CVE-2026-13071

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authenticated user with read access can cause the mongod process to be terminated through certain aggregation expressions that execute server-side JavaScript...

Linux Distros Unpatched Vulnerability : CVE-2026-64215

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: drm/msm/a6xx: Check kzalloc return in a8xxhfisendperftable Check the return value of kzalloc...

Linux Distros Unpatched Vulnerability : CVE-2026-17501

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw has been found in ggml-org llama.cpp e15efe0. This vulnerability affects the function transform of the file common/json-schema-to-grammar.cpp of the...

Linux Distros Unpatched Vulnerability : CVE-2026-13056

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Using expressions that generate large arrays it is possible to craft a query that creates very large intermediate objects in memory, causing the server to crash...

Linux Distros Unpatched Vulnerability : CVE-2026-64225

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - octeontx2-af: CGX: add bounds check to cgxspeedmbps index cgxspeedmbps has 13 elements but RESPLINKSTATSPEED can yield values 0-15. If it returns a value = 13,...

Linux Distros Unpatched Vulnerability : CVE-2026-15928

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting XSS vulnerability in the error page component. CVE-2026-15928...

Linux Distros Unpatched Vulnerability : CVE-2026-64257

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: smb: client: reject overlapping data areas in SMB2 responses Commit 53b7c271f06b smb: client...

Linux Distros Unpatched Vulnerability : CVE-2026-64223

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: consume only present negotiated TTLM maps ieee80211tidtolinkmapsizeok...

Linux Distros Unpatched Vulnerability : CVE-2026-13076

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authenticated user can cause a mongod process to be terminated by the operating system under memory pressure by performing a specific data type conversion...

Linux Distros Unpatched Vulnerability : CVE-2026-64208

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: crypto/krb5, rxrpc: Fix lack of pre- decrypt/pre-verify length checks Change the krb5 crypto...

Linux Distros Unpatched Vulnerability : CVE-2026-64526

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ethtool: tsconfig: fix missing ethnlopscomplete tsconfigpreparedata calls ethnlopsbegin, we...

July Microsoft Patch Tuesday

July Microsoft Patch Tuesday. In the second week of July, I was on vacation in St. Petersburg. After that, I got caught up with a bunch of other tasks, so I'm only publishing this roundup now. Better late than never, especially considering how unusual this MSPT turned out to be. 😉 In total, 571...

kernel-nday-exploits

Linux Kernel N-Day Exploits Local privilege escalation rese...

Security update for the Linux Kernel (Live Patch 25 for SUSE Linux Enterprise 15 SP6)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150600.23.109 fixes various security issues: The following security issues were fixed: CVE-2026-23240: tls: Fix race condition in tlsswcancelworktx bsc1262404. CVE-2026-31738: vxlan: validate ND option lengths in vxlannacreate bsc1264060...

CVE-2026-17434

A flaw has been found in nanocoai NanoClaw up to 2.0.64. Affected is the function handleAddMcpServer of the file src/modules/self-mod/request.ts of the component addmcpserver. Executing a manipulation can lead to improper authorization. The attack may be launched remotely. The exploit has been...

CVE-2026-17434 nanocoai NanoClaw add_mcp_server request.ts handleAddMcpServer improper authorization

A flaw has been found in nanocoai NanoClaw up to 2.0.64. Affected is the function handleAddMcpServer of the file src/modules/self-mod/request.ts of the component addmcpserver. Executing a manipulation can lead to improper authorization. The attack may be launched remotely. The exploit has been...

CVE-2026-17434

The CVE-2026-17434 affects nanocoai NanoClaw up to version 2.0.64, specifically the function handleAddMcpServer in src/modules/self-mod/request.ts of the add_mcp_server component. The underlying issue leads to improper authorization when a manipulation is executed, with potential for remote explo...