Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098882)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098882 advisory. In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad KVM: x86:...

MiracleLinux 9 : kernel-5.14.0-687.24.1.el9_8 (AXSA:2026-1649:67)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1649:67 advisory. kernel: net/sched: ets: Always remove class from active list before deleting in etsqdiscchange CVE-2025-71066 kernel: KVM: x86: Fix shadow paging...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098942)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098942 advisory. In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN The shadow MMU computes GFNs for...

CVE-2026-64562

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM nested virtualization nVMX feature. This vulnerability occurs because the shadow Virtual Machine Control Structure VMCS is freed prematurely while still being referenced. Due to asynchronous operations, a virtual CPU vCPU mig...

dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution

A flaw was found in DOMPurify, a tool designed to sanitize HTML, MathML, and SVG to prevent cross-site scripting XSS attacks. When performing in-place sanitization, DOMPurify could fail to properly process content within shadow DOM elements attached to a .content. This oversight allows an attacke...

CVE-2026-75019

The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cozyHoverEffect Block Attribute in all versions up to, and including, 2.2.16 due to insufficient input sanitization and output...

Security update for the Linux Kernel (Live Patch 28 for SUSE Linux Enterprise 15 SP6)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150600.23.118 fixes various security issues: The following security issues were fixed: CVE-2025-40204,CVE-2026-53224,CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIEECHO processing bsc1253437 bsc1270023 bsc1270024...

CVE-2026-42493

A flaw was found in Xen's x86 shadow paging functionality. Operations within this feature can consume excessive resources, potentially leading to a Denial of Service DoS on the affected system. This functionality has been deprecated due to its operational cost and inherent security risks...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: RDMA/IRDMA: Fixed an OOB read during CQ/MR registration. Sashiko pointed out an unrelated bug during a previous patch: https://sashiko.dev//patchset/20260512183852.614045-1-jmoroni%40google.com This change fixes the bug by...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102094)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102094 advisory. In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad KVM: x86:...

dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution

A flaw was found in DOMPurify, a tool designed to sanitize HTML, MathML, and SVG to prevent cross-site scripting XSS attacks. When performing in-place sanitization, DOMPurify could fail to properly process content within shadow DOM elements attached to a .content. This oversight allows an attacke...

Why "Shady AI" is Security's Next Big Governance Problem

In March 2026, an internal AI agent at Meta triggered a “Sev 1” incident after sensitive company and user data was exposed to employees who weren’t authorized to access it. The incident began when a Meta employee posted a technical question on an internal forum. An engineer used an approved AI...

OESA-2026-3434 unbound security update

Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most...

Malicious code in ngsw-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b427c73f093ad680033b2779c43c1c96186a71055aaff3cf44befd18c2cecbd The package's postinstall lifecycle script collects installer host identifiers hostname, platform, architecture, Node version, package/lifecycle name...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102004)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102004 advisory. In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN The shadow MMU computes GFNs for...

Stitching the Kill Chain: Detecting NTDS.dit Exfiltration with Trellix Helix Correlation

Stitching the Kill Chain: Detecting NTDS.dit Exfiltration with Trellix Helix Correlation By Adithya Chandra and Maulik Maheta · August 18, 2026 Executive Summary While attackers continuously cycle through new tooling, their underlying techniques remain remarkably consistent. Credential theft from...

ANT-2026-QRHVDRQ1 · Unicorn · Heap Buffer Overflow

heap-buffer-overflow medium Severity Claude medium · Security research firm medium · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits. ANT-2026-QRHVDRQ1: Heap buffer overflow via MIPS CP0...

CVE-2026-19900 LB-LINK X-PRO shadow hard-coded credentials

A vulnerability was identified in LB-LINK X-PRO 1.0.22-20231206. The impacted element is an unknown function of the file /etc/shadow. The manipulation leads to hard-coded credentials. It is possible to initiate the attack remotely. A high degree of complexity is needed for the attack. The...

CVE-2026-19900

A vulnerability was identified in LB-LINK X-PRO 1.0.22-20231206. The impacted element is an unknown function of the file /etc/shadow. The manipulation leads to hard-coded credentials. It is possible to initiate the attack remotely. A high degree of complexity is needed for the attack. The...

CVE-2026-19900 LB-LINK X-PRO shadow hard-coded credentials

A vulnerability was identified in LB-LINK X-PRO 1.0.22-20231206. The impacted element is an unknown function of the file /etc/shadow. The manipulation leads to hard-coded credentials. It is possible to initiate the attack remotely. A high degree of complexity is needed for the attack. The...