CVE-2026-75109 Determined Missing Authorization Check on Generic Task Endpoints

Determined fails to authorize requests on the generic task kill, pause, and unpause endpoints in the API handlers. Authenticated attackers can disrupt other users' workloads by terminating, pausing, or unpausing tasks they do not own...

CVE-2026-75109 Determined Missing Authorization Check on Generic Task Endpoints

Determined fails to authorize requests on the generic task kill, pause, and unpause endpoints in the API handlers. Authenticated attackers can disrupt other users' workloads by terminating, pausing, or unpausing tasks they do not own...

GHSA-8R8V-XF7Q-RCPR New API: Integer overflow in quota billing yields negative charges (self-crediting)

Summary Multiple billing paths multiplied user-controlled quantity parameters into the quota calculation without an upper bound or overflow-safe integer conversion. A crafted extreme value e.g. image n = 18446744073686646784, a wrapped-negative accepted by a uint field makes conversions like...

New API: Integer overflow in quota billing yields negative charges (self-crediting)

Summary Multiple billing paths multiplied user-controlled quantity parameters into the quota calculation without an upper bound or overflow-safe integer conversion. A crafted extreme value e.g. image n = 18446744073686646784, a wrapped-negative accepted by a uint field makes conversions like...

SUSE CVE-2026-68128

In the Linux kernel, the following vulnerability has been resolved: ice: reject out-of-range ptype in iceparserprofileinit setbitrslt-ptype, prof-ptypes operates on a DECLAREBITMAP of ICEFLOWPTYPEMAX 1024 bits. Nothing prevents a malicious VF from providing ptype = 1024 through VIRTCHNL, resultin...

SUSE CVE-2026-68150

In the Linux kernel, the following vulnerability has been resolved: fs/super: fix emergency thaw double-unlock of sumount dothawall iterates over all superblocks via iteratesupers with SUPERITEREXCL, which acquires sumount exclusively before calling the callback and releases it afterwards. Howeve...

CVE-2026-72483

A flaw was found in the Linux kernel's USB host driver, specifically in the max3421hubcontrol function. A malicious userspace task with access to the root hub can trigger a shift-out-of-bounds vulnerability by issuing a crafted USBDEVFSCONTROL ioctl. This can lead to arbitrary bit corruption of t...

CVE-2026-74529

A flaw was found in the Linux kernel's Bluetooth Host Controller Interface HCI synchronization component. This vulnerability, a Use-After-Free UAF, occurs when a connection object is prematurely released while the hcisync task is still active. A local attacker could potentially exploit this to...

pgbackrest release/2.59.1

pgBackRest Reliable PostgreSQL Backup & Restore Introduction pgBackRest is a reliable backup and restore solution for PostgreSQL that seamlessly scales up to the largest databases and workloads. pgBackRest v2.59.1 is the current stable release. Release notes are on the Releases page. Please give ...

How MCP Servers Can Expose Enterprise Secrets

MCP servers can expose enterprise secrets through plaintext configuration files, over-permissioned access and prompt injection, often before security teams even know the server is running. As more organizations adopt AI agents into their systems, that exposure can silently become a major gap in M...

Fake TikTok rewards promise cash you’ll never get

TikTok-branded "rewards" pages are promising users cash for checking in every day, completing small tasks, and earning points. Those points supposedly convert into real money, and the balances look enormous. A countdown timer usually warns that your balance is about to expire. But when you try to...

AI-Infra-Guard v4.5.2

📖 Documentation | 🌐 🇨🇳 中文 · 🇯🇵 日本語 · 🇪🇸 Español · 🇩🇪 Deutsch · 🇫🇷 Français · 🇰🇷 한국어 · 🇧🇷 Português · 🇷🇺 Русский 🚀 AI Red Teaming Platform by Tencent Zhuque Lab A.I.G AI-Infra-Guard integrates capabilities such as ClawScanOpenClaw Security Scan, Agent Scan，AI infra vulnerability scan, MCP Server &...

BIT-AIRFLOW-2026-68970 Apache Airflow: Values of a list-shaped Variable are not masked in task logs and the Rendered Templates UI

Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cleartext in task logs and in the Rendered Templates UI. Masking was applied only when the deserialized value was a string or a dict; a list at the top level...

avicii-ghostlock

CVE-2026-43499 — Linux Kernel Futex PI Use-After-Free Bug...

hate_crack v2.28.1

root@kitploit: / | \ / | \ \ | | / \ \ / \ / \ /\ \ \ / | |/ / \ Y // | | \ / \ | | // \ | \ /|| /\ | \ / / // / / / / Installation Installing from source is the only supported path. hatecrack is not distributed on PyPI: pip install hate-crack resolves to a 0.0.0 placeholder that...

PT-2026-76811

Pandora is affected by a stored cross-site scripting vulnerability in the PDF download functionality. The /task-download//.../pdf endpoint verifies that the submitted file is a PDF using Pandora's content-based file-type detection, but previously returned the file using send filetask.file.path...

389-ds:1.4 security update

1.4.3.39-26 - Bump version to 1.4.3.39-26 - Resolves: RHEL-183073 - EMBARGOED CVE-2026-11770 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check rhel-8.10.z - Resolves: RHEL-190782 - CVE-2026-11788 389-ds-base: 389-ds-base: NULL pointer dereference in deref contro...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099911)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099911 advisory. In the Linux kernel, the following vulnerability has been resolved: USB: core: Limit the length of unkillable synchronous timeouts The usbcontrolmsg, usbbulkmsg, and...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100359)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100359 advisory. In the Linux kernel, the following vulnerability has been resolved: net: prevent skb corruption on frag list segmentation Ian reported several skb corruptions...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099977)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099977 advisory. In the Linux kernel, the following vulnerability has been resolved: ext4: publish jinode after initialization ext4inodeattachjinode publishes ei-jinode to concurrent...