Important: Red Hat Security Advisory: bind9.16 security, bug fix, and enhancement update

An update for bind9.16 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

PT-2026-108131

Name of the Vulnerable Software and Affected Versions Docker Sandboxes affected versions not specified Description Docker Sandboxes may fail open when masking credentials in protected proxy responses. This occurs when a response-body read returns data simultaneously with an error, causing affecte...

Important: bind security update

The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server is operating correctly. Security Fixes:...

GHSA-V3XR-G6P2-FVGV Ghost: Stored XSS via oEmbed Photo Responses

Impact Embedding a URL from an attacker-controlled website could result in untrusted scripts being stored in post content. These scripts could run in the Ghost editor, on the published site, and in newsletter emails, possibly resulting in compromise of a staff user's admin session. Vulnerable...

Ghost: Stored XSS via oEmbed Photo Responses

Impact Embedding a URL from an attacker-controlled website could result in untrusted scripts being stored in post content. These scripts could run in the Ghost editor, on the published site, and in newsletter emails, possibly resulting in compromise of a staff user's admin session. Vulnerable...

NPM: Ghost: Stored XSS via oEmbed Photo Responses

NPM: Ghost: Stored XSS via oEmbed Photo Responses vulnerability discovered by ? in WordPress Npm ghost versions = 2.5.0, 6.64.0...

CVE-2026-92543

Docker Engine is vulnerable to a security bypass where a registry hostname can be incorrectly classified as insecure. The loadInsecureRegistries() function injects 127.0.0.0/8 and ::1/128 as insecure CIDRs by default. The isCIDRMatch function returns true if any resolved address matches these CID...

CVE-2026-92543 Docker Engine insecure-registry fallback via malicious DNS responses

Docker Engine classifies a registry hostname as insecure using an any-match DNS check. loadInsecureRegistries injects 127.0.0.0/8 and ::1/128 as insecure CIDRs by default. isCIDRMatch resolves all of the hostname's addresses and returns true if a single address is in the insecure CIDR list. Becau...

CVE-2026-98349

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject too-short beacon and probe responses libipwprocessproberesponse and the libipwnetworkinit call it makes assume the frame contains the full 36-byte beacon and probe response prefix, but the ipw2100 and ipw2200...

CVE-2026-98349

The Linux kernel contains a vulnerability in the wifi: libipw component within the libipw_process_probe_response() and libipw_network_init() functions. The root cause is an integer underflow where the code assumes a 36-byte beacon/probe response prefix, but the ipw2100 and ipw2200 receive paths o...

CVE-2026-98348

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject too-short association responses libipwhandleassocresp reads the capability, status and aid fields of the 30-byte association response prefix and then computes the information element length as stats-len -...

CVE-2026-55255-Lab

CVE-2026-55255 - Langflow의 /api/v1/responses IDOR 취약점 핵심 요약 이 저장소는 Langflow의 OpenAI 호환 Responses API에 영향을 미치는 안전하지 않은 직접 객체 참조IDOR 취약점인 CVE-2026-55255를 재현하고 검증하기 위한 로컬 Docker 랩을 포함합니다. Langflow는 AI 기반 에이전트와 워크플로우를 구축하고 배포하기 위한 오픈소스 플랫폼입니다. 취약한 동작은 /api/v1/responses 엔드포인트에 영향을 미치며, 인증된 공격자가 다른 사용자...

RLSA-2026:75767 Important: bind security update

The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server is operating correctly. Security Fixes:...

Security Bulletin: The following vulnerabilities that can affect IBM Storage Scale Install Toolkit are now fixed in 5.2.3.9 or higher and 6.0.1.1 or higher

Summary The following vulnerabilities that can affect IBM Storage Scale Install Toolkit are now fixed in 5.2.3.9 or higher and 6.0.1.1 or higher Vulnerability Details CVEID:CVE-2026-14375 DESCRIPTION: IBM Storage Scale does not validate or improperly validates TLS certificate validation when...

ColonelClustered

Colonel Clustered - 응답 유사도 클러스터링 v1.0.1 HTTP 응답을 클러스터링하여 이상치를 찾기 위한 Burp Suite 확장 기능. 소개 이것은 내가 수년 동안 만들려고 생각해 온 플러그인입니다. 단순히 Burp intruder에서 퍼징 공격 결과를 분석하는 방식에 다소 짜증이 났기 때문입니다. 우리는 일반적으로 퍼징 공격에서 서버 응답의 변화를 찾습니다. 그리고 상태 코드, 응답 시간, 응답 크기를 보고 그러한 차이를 찾습니다. 이 모든 것은 응답 내용에 대한 간접적인 측정치입니다. 물론 펜테스터로서 우...

PentagridResponseOverview

PentagridResponseOverview BurpSuite용 응답 개요 확장 기능 작성자: Tobias "floyd" Ospelt, @floydch, http://www.floyd.ch Pentagrid AG, https://www.pentagrid.ch 응답 본문을 그룹화하여 색다른 응답 찾기 응답 개요 이 확장 기능은 모든 응답 본문을 유사도에 따라 그룹화하고, 그룹당 하나의 요청/응답으로 요약을 보여줍니다. 이 확장 기능을 사용하면 테스터가 모든 도구스캐너, 프록시 등에서 테스트한 웹사이트의 응답을 한눈에 파악할 수...

EUVD-2026-92842

vLLM: Harmony tool continuations drop cachesalt — restoring a cross-tenant prefix-cache membership oracle...

The vulnerability of the ipinfo_lookup() function in the MTR network diagnostic and monitoring utility allows a hacker to cause a service failure.

The vulnerability of the ipinfolookup function in the MTR network diagnostic and monitoring utility is related to the operation that exceeds the buffer boundaries in memory when processing DNS responses. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

CVE-2026-105752

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, Harmony tool continuations submitted through "POST /v1/responses" requests rebuild the next-turn engine input without preserving the cachesalt value, placing the continuation prefix in the global unsalted cache...

CVE-2026-105752 vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, Harmony tool continuations submitted through "POST /v1/responses" requests rebuild the next-turn engine input without preserving the cachesalt value, placing the continuation prefix in the global unsalted cache...