Exploit for Unrestricted Upload of File with Dangerous Type in Rsjoomla Rsfiles\!

CVE-2026-57827 — RSFiles! Joomla Component Unauthenticated File...

xalgorix v4.5.100

Xalgorix — Open-source AI pentester that proves vulnerabilities Most scanners detect. Xalgorix proves. An autonomous LLM agent works a full pentest methodology, then an independent verifier re-exploits every finding before it's reported — so you get proof, not a pile of maybes to triage...

@aulazero/task (>=0.0.1, <=0.7.2), @aulazero/task-2 (>=2.0.1, <=2.0.5) +271 more potentially affected by CVE-2026-54705 via mathlive (>=0.25.0, <=0.109.2)

mathlive NPM version =0.25.0, =0.0.1, =2.0.1, =1.17.3, =0.2.6, =0.0.1, =0.1.0, =0.1.0, =0.5.0, =1.20.0, =11.25.1, =1.0.0, =0.1.0, =0.1.0-alpha.1, =0.1.0, =0.2.0 and more Source cves: CVE-2026-54705 Source advisory: OSV:GHSA-FM7P-GW32-828P...

@aulazero/task (>=0.0.1, <=0.7.2), @aulazero/task-2 (>=2.0.1, <=2.0.5) +271 more potentially affected by CVE-2025-29049 +1 more via mathlive (>=0.25.0, <=0.109.2)

mathlive NPM version =0.25.0, =0.0.1, =2.0.1, =1.17.3, =0.2.6, =0.0.1, =0.1.0, =0.1.0, =0.5.0, =1.20.0, =11.25.1, =1.0.0, =0.1.0, =0.1.0-alpha.1, =0.1.0, =0.2.0 and more Source cves: CVE-2025-29049, CVE-2026-54705 Source advisory: SNYK:JS-MATHLIVE-18508174...

AZL-94148 CVE-2026-64560 affecting package kernel for versions less than 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by non-leader exec race Wongi and Jungwoo decoded and reported a non-leader exec related race which can result in an UAF: systimerdelete exec posixcputimerdel // Observes old leader p =...

CVE-2026-64560

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by non-leader exec race Wongi and Jungwoo decoded and reported a non-leader exec related race which can result in an UAF: systimerdelete exec posixcputimerdel // Observes old leader p =...

DEBIAN-CVE-2026-64560

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by non-leader exec race Wongi and Jungwoo decoded and reported a non-leader exec related race which can result in an UAF: systimerdelete exec posixcputimerdel // Observes old leader p =...

UBUNTU-CVE-2026-64560

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by non-leader exec race Wongi and Jungwoo decoded and reported a non-leader exec related race which can result in an UAF: systimerdelete exec posixcputimerdel // Observes old leader p =...

CVE-2026-64560

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by non-leader exec race Wongi and Jungwoo decoded and reported a non-leader exec related race which can result in an UAF: systimerdelete exec posixcputimerdel // Observes old leader p =...

CVE-2026-64262

A flaw was found in the fuse-uring component of the Linux kernel. When iouring task work is canceled, the system fails to properly end a fusereq FUSE request. This can cause the originating system call thread to block indefinitely, leading to a Denial of Service DoS for the affected system...

Measuring the Tendency of AI Agents to Go Rogue

This essay was written with Barath Raghavan, and originally appeared inThe Guardian. In July, Hugging Face, a company that hosts much of the world's AI software and open-source AI models, was hacked. A malicious dataset had been used to run code on one of its servers. Whoever was behind it captur...

EUVD-2026-50417

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by non-leader exec race Wongi and Jungwoo decoded and reported a non-leader exec related race which can result in an UAF: systimerdelete exec posixcputimerdel // Observes old leader p =...

CVE-2026-64560 posix-cpu-timers: Prevent UAF caused by non-leader exec() race

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by non-leader exec race Wongi and Jungwoo decoded and reported a non-leader exec related race which can result in an UAF: systimerdelete exec posixcputimerdel // Observes old leader p =...

CVE-2026-64560

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by non-leader exec race Wongi and Jungwoo decoded and reported a non-leader exec related race which can result in an UAF: systimerdelete exec posixcputimerdel // Observes old leader p =...

CVE-2026-64560

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by non-leader exec race Wongi and Jungwoo decoded and reported a non-leader exec related race which can result in an UAF: systimerdelete exec posixcputimerdel // Observes old leader p =...

CVE-2026-64560 posix-cpu-timers: Prevent UAF caused by non-leader exec() race

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by non-leader exec race Wongi and Jungwoo decoded and reported a non-leader exec related race which can result in an UAF: systimerdelete exec posixcputimerdel // Observes old leader p =...

CVE-2026-64560

CVE-2026-64560 documents a Linux kernel issue in posix-cpu-timers that can cause a Use-After-Free when a timer is deleted during a non-leader exec() race. The vulnerability arises as sys_timer_delete() may observe an old leader while a leader change occurs, leading to a freed posix timer object b...

Easy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend user rebind a peer provider's Google sync

Summary Google::oauth at application/controllers/Google.php:278 stores its URL-supplied providerid in the session, and oauthcallback saves the issued Google OAuth token against that row without checking the caller owns the provider. Any logged-in backend user admin, provider, or secretary rebinds...

GHSA-8HM4-R66F-29WR Easy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend user rebind a peer provider's Google sync

Summary Google::oauth at application/controllers/Google.php:278 stores its URL-supplied providerid in the session, and oauthcallback saves the issued Google OAuth token against that row without checking the caller owns the provider. Any logged-in backend user admin, provider, or secretary rebinds...

Easy!Appointments has server-side request forgery in CalDAV connection test that exposes the deployment's internal network

Summary Caldav::connecttoserver at application/controllers/Caldav.php:60 hands the request's caldavurl to a Guzzle REPORT call without scheme or host validation. A logged-in backend user admin, provider, or secretary reaches loopback, RFC1918, and link-local hosts on the deployment's network. The...