Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: MGMT: Fixed possible UAFs This attempt to fix possible UAFs is due to the fact that the struct mgmtpending is freed while it is still being processed, as seen in the following trace. To address this issue,...

CVE-2024-33288

Prison Management System Using PHP v1.0 contains a SQL injection vulnerability within the username parameter on the Admin login page. An attacker can exploit this flaw to interfere with database queries and perform an authentication bypass to gain unauthorized administrative access. Proof-of-conc...

CVE-2024-33724

The SOPlanning project management software, version 1.52.00 , is vulnerable to a Reflected Cross-Site Scripting (XSS) attack via the groupe_id parameter in the process/groupe_save.php endpoint. A remote unauthenticated attacker can exploit this to hijack the sessions or credentials of authenticat...

PT-2026-39252

Name of the Vulnerable Software and Affected Versions free5GC versions prior to 4.2.2 Description The Network Exposure Function NEF in free5GC contains a nil-pointer dereference issue within the PatchIndividualApplicationPFDManagement function. This occurs when a PATCH request is sent to the...

CVE-2023-42343

Alkacon OpenCms versions prior to 10.5.1 are vulnerable to a Cross-Site Scripting (XSS) vulnerability via the cmis-online/type module. The root cause is a lack of sufficient measures to protect the website structure, specifically allowing unauthenticated attackers to inject malicious JavaScript t...

CVE-2026-43862

In mutt before 2.3.2, the imapauthgss security level is mishandled...

HUSTOJ Zip-Slip v26.01.24 - RCE

Exploit Title: HUSTOJ Zip-Slip v26.01.24 - RCE Date: 2026-02-14 Exploit Author: Marshall Whittaker / oxagast Vendor Homepage: https://github.com/zhblue/hustoj Software Link: http://123.158.38.129:8090/livecd/HUSTOJ25.05.iso LiveCD, or see above git repo Version: Before v26.01.24 Tested on: Ubuntu...

Poster: ClawdGo: Endogenous Security Awareness Training for Autonomous AI Agents

Autonomous AI agents deployed on platforms such as OpenClaw face prompt injection, memory poisoning, supply-chain attacks, and social engineering, yet existing defences address only the platform perimeter, leaving the agent's own threat judgement entirely untrained. We present ClawdGo, a framewor...

CVE-2026-40179 vulnerabilities

Vulnerabilities for packages: mcp-grafana, loki, splunk-otel-collector, aws-otel-collector, tempo, minio-operator, mc, cloud-sql-proxy, karma, jaeger, keda, certificate-transparency, minio-object-browser, trillian, telegraf, minio, datadog-agent, grafana-pyroscope, istio, prometheus-pushgateway...

GHSA-VFFH-X6R8-XX99 vulnerabilities

Vulnerabilities for packages: mcp-grafana, loki, splunk-otel-collector, aws-otel-collector, tempo, minio-operator, mc, cloud-sql-proxy, karma, jaeger, keda, certificate-transparency, minio-object-browser, trillian, telegraf, minio, datadog-agent, grafana-pyroscope, istio, prometheus-pushgateway...

MINI-PM25-G6XV-V9WW

Bulletin has no description...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: mcp-grafana, cadvisor, falcoctl, argocd-image-updater, emissary, kubernetes-csi-driver-hostpath, opentofu, apache-exporter, memcached-exporter, opa-envoy, vexctl, kubescape-operator, k8s-device-plugin, net-kourier, apisix-ingress-controller, sftpgo-plugin-eventsearch...

MINI-W522-6PX2-5VJW

Bulletin has no description...

CVE-2026-5863

A high-severity vulnerability exists in the V8 engine of Google Chrome prior to version 147.0.7727.55 due to an inappropriate implementation. A remote attacker could exploit this flaw by hosting a crafted HTML page to achieve arbitrary code execution inside a sandbox. Remediation is available in ...

CVE-2026-34979

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, there is a heap-based buffer overflow in the CUPS scheduler when building filter option strings from job attribute. At time of publication, there are no publicly...

Zabbix 6.0.x < 6.0.41 / 7.0.x < 7.0.18 / 7.2.x < 7.2.12 / 7.4.x < 7.4.2 Multiple Vulnerabilities

The version of Zabbix Server installed on the remote host is prior to 6.0.41, 7.0.18, 7.2.12, 7.4.2. It is, therefore, affected by multiple vulnerabilities : - An issue exists due to the LDAP 'Bind password' value being leaked when a Super Admin changes the LDAP 'Host' to a rogue LDAP server. An...

CLEANSTART-2026-KR58137 Security fixes for CVE-2025-68121, CVE-2026-25679, CVE-2026-27137, CVE-2026-27138, CVE-2026-27139, CVE-2026-27142, ghsa-6v2p-p543-phr9 applied in versions: 0.8.19-r0, 0.8.19-r1, 0.8.19-r2

Multiple security vulnerabilities affect the node-problem-detector package. These issues are resolved in later releases. See references for individual vulnerability details...

CVE-2026-4200

A security flaw has been discovered in glowxq glowxq-oj up to 6f7c723090472057252040fd2bbbdaa1b5ed2393. This affects the function uploadTestcaseZipUrl of the file business/business-oj/src/main/java/com/glowxq/oj/problem/controller/ProblemCaseController.java. Performing a manipulation results in...

Threat Research Report: The Broken Physics of Remediation

The race most security programs are built around — patch faster than the attacker can exploit — was designed for a threat landscape that no longer exists. The data shows defenders are falling behind in the vast majority of cases. Across the most critical, actively weaponized vulnerabilities of th...

This is all it takes to stop a train (Lock and Code S07E06)

This week on the Lock and Code podcast … Forget the runaway train thrillingly shot in Buster Keaton's 1926 film "The General," and never mind the charging locomotive rescued by actors Denzel Washington and Chris Pine in the 2010 film "Unstoppable," as there's a far more frequent and far less...