Linux Distros Unpatched Vulnerability : CVE-2026-15114

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Out of bounds read and write in Codecs in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to potentially exploit heap corruption via a crafted...

Guzzle: Unbounded response cookies risk denial of service

Impact In affected versions, Guzzle's built-in CookieJar accepts any number of Set-Cookie header fields from one response, with no limit on the size of each field. When a later request matches the stored cookies, Guzzle places every match into one generated Cookie header without limiting the numb...

CVE-2026-47128

nono is software that allows users to run AI agents in a zero-latency sandbox. Prior to version 0.55.0, the nono Landlock/seccomp policies allow access to local Unix domain sockets concrete and abstract. This allows an easy sandbox escape by talking to the per-user systemd dbus socket. Version...

CVE-2026-47255 AgenticMail API/storage and outbound relay hardening

AgenticMail gives AI agents real email addresses and phone numbers. @agenticmail/api prior to version 0.9.32 and @agenticmail/core prior to version 0.9.10 had weakness related to validation and and binding of inactive-agent hour filtering; storage SQL identifier validation; metadata-backed...

Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)

Summary When Composer is run with -vvv debug verbosity, it could print a credential that was embedded directly in a repository or package URL, but not as a password, to its debug output. Composer already masked the password portion of such URLs, but the username portion was shown in clear text...

CVE-2026-47144 Shamefile has an arbitrary file read via shamefile.yaml in shame next

Shamefile is a linter for undocumented linter warnings. Prior to version 0.1.7, a path traversal vulnerability in shame next allows an attacker-controlled shamefile.yaml to disclose contents of files outside the repository, one line at a time, to the terminal of a user who runs the command. See...

EUVD-2026-46116

nono is software that allows users to run AI agents in a zero-latency sandbox. Prior to version 0.55.0, the nono Landlock/seccomp policies allow access to local Unix domain sockets concrete and abstract. This allows an easy sandbox escape by talking to the per-user systemd dbus socket. Version...

GHSA-G796-FGMG-93MV js-yaml: YAML merge-key chains can force quadratic CPU consumption in js-yaml

Impact This is the same report as for v3/v4, but with lower severity, because in v5, merge is off by default When merge keys 1s doc size 100K js import performance from 'node:perfhooks' import Buffer from 'node:buffer' import load, YAML11SCHEMA from 'js-yaml' const n = Numberprocess.argv2 || 4000...

js-yaml: YAML merge-key chains can force quadratic CPU consumption in js-yaml

Impact This is the same report as for v3/v4, but with lower severity, because in v5, merge is off by default When merge keys 1s doc size 100K js import performance from 'node:perfhooks' import Buffer from 'node:buffer' import load, YAML11SCHEMA from 'js-yaml' const n = Numberprocess.argv2 || 4000...

CVE-2026-44584 Paymenter doesn't reset email verification status after email change

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the email update functionality fails to invalidate the existing verification state when a user changes their email address, allowing a verified account to retain its verified statu...

Exploitation in the Wild of wp2shell

Wiz Research has identified exploitation of "wp2shell", a critical pre-auth RCE vulnerability chain impacting WordPress Core CVE-2026-63030 & CVE-2026-60137. Attackers are deploying persistent webshells on vulnerable servers. Organizations should prioritize patching or applying WAF mitigations...

Moderate: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.7 XP 6.0.5.GA release

JBoss EAP XP 6.0.5.GA release on the EAP 8.1 base. See references for release notes. This is a cumulative patch release zip for the JBoss EAP XP 6.0.5 runtime distribution for use with EAP 8.1.7. Security Fixes: kafka-clients: Apache Kafka Clients: Information disclosure and data corruption due t...

CVE-2026-64192

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject BPFMAPTYPEINODESTORAGE creation if BPF LSM is uninitialized When CONFIGBPFLSM=y is set, BPF inode storage maps BPFMAPTYPEINODESTORAGE are compiled into the kernel. However, if the BPF LSM is not explicitly enabled at...

CVE-2026-42210

Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.640, for Webmin accounts that require a second authentication factor typically TOTP, an attacker with knowledge of the username and password can bypass the 2FA requirement by using Basic authentication...

CVE-2026-33328

libvips is a fast image processing library with low memory needs. On 32-bit systems in versions before and including 8.18.0, the gifload operation could incorrectly determine dimensions leading to an integer overflow. This has been patched in version 8.18.1...

CVE-2026-32824

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, a low-privileged authenticated API user can supply forwardToUrl and...

CVE-2026-32806

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, any authenticated user can request arbitrary partials or helper-backe...

EUVD-2026-46038

Chamilo LMS versions 1.11.38 and earlier contain a stored cross-site scripting vulnerability in the user registration form that allows any unauthenticated attacker to execute arbitrary JavaScript in an administrator's browser session, leading to full platform admin account takeover. This has been...

CVE-2026-42210

Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.640, for Webmin accounts that require a second authentication factor typically TOTP, an attacker with knowledge of the username and password can bypass the 2FA requirement by using Basic authentication...

CVE-2026-42210 Webmin 2FA requirement bypass

Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.640, for Webmin accounts that require a second authentication factor typically TOTP, an attacker with knowledge of the username and password can bypass the 2FA requirement by using Basic authentication...