MobileWorldSafety: Benchmarking GUI Agent Safety against Environmental Injection Attacks in Android Apps

LLM-powered GUI agents that autonomously operate smartphones are rapidly transitioning from research prototypes to early real-world deployment. However, because these agents routinely process untrusted environmental content, they are highly vulnerable to environmental injection attacks, which...

Linux Distros Unpatched Vulnerability : CVE-2026-72419

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: nfnat: avoid invalid natnet pointer use on failed nfnatinit We ran into below KASAN splat, which is mostly uninteresting, beside for having...

Linux Distros Unpatched Vulnerability : CVE-2026-72335

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: MGMT: Fix adv monitor add failure cleanup hciaddadvmonitor publishes a new advmonitor in hdev-advmonitorsidr before the powered MSFT setup step. The...

Linux Distros Unpatched Vulnerability : CVE-2026-72478

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fs/ntfs3: add bounds check to rungethighestvcn rungethighestvcn parses a packed NTFS mapping- pairs buffer without any length bound, relying solely on a 0x00...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-101992)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101992 advisory. In the Linux kernel, the following vulnerability has been resolved: sched/rt: Have RTPUSHIPI be default off for non PREEMPTRT RT migration is done aggressively. When...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102132)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102132 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: ignore explicit helper on new expectations Use the existing master conntrac...

Linux Distros Unpatched Vulnerability : CVE-2026-72183

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - landlock: Fix LANDLOCKSCOPESIGNAL bypass on the SIGIO path LANDLOCKSCOPESIGNAL must prevent a sandboxed process from signaling processes outside its Landlock...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-101967)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101967 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/edid: fix OOB read in drmparsetiledblock drmparsetiledblock casts the DisplayID block to a...

Linux Distros Unpatched Vulnerability : CVE-2026-72408

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - geneve: gate GRO hint in genevegrocomplete on gs-grohint genevegroreceive reads the GRO hint through geneveskgrohintoff, which honours it only when the socket...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-101981)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101981 advisory. In the Linux kernel, the following vulnerability has been resolved: audit: Fix data races of skbqueuelen readers on auditqueue Multiple readers access auditqueue.qle...

Linux Distros Unpatched Vulnerability : CVE-2026-72353

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid stale runlist element dereference in fallocate ntfsattrfallocate allocates holes...

PT-2026-77030

Dolibarr contains an authorization bypass vulnerability in the clonetasks mass action that allows authenticated users with project creation permissions to clone tasks into private projects they are not authorized to access. An inverted boolean condition in the private-project membership check...

memdumper macOS EDR Process Attribution Evasion

memdumper is a macOS process memory inspection utility that injects a dynamic library into an existing signed binary possessing Apple debugger and DYLD-related entitlements. The injected library uses the entitled process to obtain a target task port, search or dump readable process memory, attach...

CVE-2026-72110

A flaw was found in the Linux kernel's BPF/fork component. A local user, by initiating a fork operation from a process within a task storage map, can trigger a condition where the bpfstorage is not properly initialized. This can lead to a Use-After-Free UAF vulnerability, which occurs when the...

CVE-2026-72086

A flaw was found in the Linux kernel's scsi: xen: scsiback component. A pvSCSI guest can trigger a resource leak by issuing specific SCSI Small Computer System Interface requests when a task management operation fails. This vulnerability allows the guest to leak command tags associated with a...

CVE-2026-75529

Pandora is affected by a stored cross-site scripting vulnerability in the PDF download functionality. The /task-download//.../pdf endpoint verifies that the submitted file is a PDF using Pandora's content-based file-type detection, but previously returned the file using sendfiletask.file.path...

CVE-2026-75109

Determined fails to authorize requests on the generic task kill, pause, and unpause endpoints in the API handlers. Authenticated attackers can disrupt other users' workloads by terminating, pausing, or unpausing tasks they do not own...

EUVD-2026-60458

Pandora is affected by a stored cross-site scripting vulnerability in the PDF download functionality. The /task-download//.../pdf endpoint verifies that the submitted file is a PDF using Pandora's content-based file-type detection, but previously returned the file using sendfiletask.file.path...

CVE-2026-75529 Stored Cross-Site Scripting via MIME-Type Confusion in PDF Downloads of Pandora

Pandora is affected by a stored cross-site scripting vulnerability in the PDF download functionality. The /task-download//.../pdf endpoint verifies that the submitted file is a PDF using Pandora's content-based file-type detection, but previously returned the file using sendfiletask.file.path...

CVE-2026-75529 Stored Cross-Site Scripting via MIME-Type Confusion in PDF Downloads of Pandora

Pandora is affected by a stored cross-site scripting vulnerability in the PDF download functionality. The /task-download//.../pdf endpoint verifies that the submitted file is a PDF using Pandora's content-based file-type detection, but previously returned the file using sendfiletask.file.path...