CVE-2026-59142: Out-of-bounds Read

Data::HashMap::Shared versions before 0.14 for Perl allow an out-of-bounds read via an unvalidated arena offset and length in shmstrcopy. The attach-time validator shmvalidateheader checks the header scalars and region layout against the file size, but does not validate the array contents it then...

CVE-2026-59145: Out-of-bounds Read

Data::Intern::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated slot, reverse and arena indices in siidxfind. The attach-time validator sivalidateheader is thorough about the header and layout magic, version, section offsets, totalsize, count and arenaused but does...

EUVD-2026-46110

NextCRM is open-source customer relationship management CRM software. The CRM product catalog is an organization-wide business object. Normal application server actions restrict product creation, update, and deletion to manager and admin roles. However, in version 0.12.1, the MCP product tools...

CVE-2026-63831

A flaw was found in the Linux kernel's mac802154 IEEE 802.15.4 MAC security component. This vulnerability allows for data corruption and potential kernel crashes when cryptographic transformations are performed on shared network packet data without proper isolation. A remote attacker could exploi...

undici: Undici: Information disclosure due to improper cache-control header parsing

A flaw was found in Undici. The cache interceptor in shared-cache mode incorrectly classifies certain responses as cacheable due to improper handling of whitespace-padded Cache-Control header field names. This vulnerability allows an unauthenticated attacker to access authenticated user data from...

Trusted Credentials, Untrusted Behavior: Benchmarking LLM-Agent Security in High-Performance Computing

Large language model LLM agents are starting to take on routine work in high-performance computing HPC, including monitoring Slurm jobs, diagnosing failed builds, inspecting simulation output, and coordinating scientific workflows. To do this work, an agent commonly acts under its user's...

Medium: credentials-fetcher

Issue Overview: On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open"symlink/"' will open "symlink" even when "symlink" is a symboli...

Medium: golang

Issue Overview: On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open"symlink/"' will open "symlink" even when "symlink" is a symboli...

Medium: golang-github-burntsushi-toml-test

Issue Overview: On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open"symlink/"' will open "symlink" even when "symlink" is a symboli...

Windows Audio Service Privilege Escalation

The vulnerability of the Windows Audio service on Windows operating systems is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to gain increased privileges...

Windows Privilege Escalation

The vulnerability of Windows operating systems is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to increase their privileges...

Windows WinRT Privilege Escalation

The vulnerability of the WinRT runtime in Windows operating systems is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to gain increased privileges...

Microsoft Defender for Endpoint for Mac Privilege Escalation

The vulnerability of Microsoft Defender for Endpoint for Mac is related to synchronization errors when using a shared resource “Race Situation”. Exploiting this vulnerability can allow an attacker to increase their privileges...

ROS-20260720-73-0043

The vulnerability of the MHTML component in Google Chrome relates to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to disclose confidential information remotely...

Amazon Linux 2023 : credentials-fetcher (ALAS2023-2026-1975)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1975 advisory. On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /...

TencentOS Server 3: cups (TSSA-2026:0630)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0630 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

Amazon Linux 2023 : golang-github-burntsushi-toml-test, golang-github-burntsushi-toml-test-devel (ALAS2023-2026-1977)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1977 advisory. On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /...

Linux Distros Unpatched Vulnerability : CVE-2026-64081

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Validate framework notification message layout Framework notifications car...

Amazon Linux 2023 : golang, golang-bin, golang-misc (ALAS2023-2026-1979)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1979 advisory. On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /...

SUSE CVE-2026-63831

In the Linux kernel, the following vulnerability has been resolved: mac802154: llsec: add skbcowdata before in-place crypto llsecdoencryptunauth, llsecdoencryptauth, llsecdodecryptunauth, and llsecdodecryptauth all perform in-place cryptographic transformations on skb data. They build a scatterli...