SUSE CVE-2026-72300

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: topology: validate vendor array size before parsing sofparsetokensets reads array-size while iterating over topology private data. The loop condition only checks that some data remains, so a malformed topology with a...

CVE-2026-80675

A flaw was found in libbpf, a library for working with eBPF extended Berkeley Packet Filter programs in the Linux kernel. This vulnerability occurs when the signed loader fails to ensure that metadata maps are exclusive during verification. A hostile host could exploit this by omitting exclusivit...

PT-2026-84269

Name of the Vulnerable Software and Affected Versions OTP versions 17.0 through 27.3.4.16 OTP versions 28.0 through 28.5.0.5 OTP versions 29.0 through 29.0.5 erts versions 6.0 through 15.2.7.12 erts versions 16.0 through 16.4.0.5 erts versions 17.0 through 17.0.5 Description An attacker connectin...

PT-2026-89928

An attacker that connects to an open Erlang TCP port that uses the inet driver with packet,4 mode can use a signed overflow in an incorrect packet length calculation to overflow the receive buffer into the VM allocator area and beyond up to about 2 GB. This would easily trash the allocated block'...

MiracleLinux 8 : pcp-5.3.7-22.el8_10.5 (AXSA:2026-1724:03)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1724:03 advisory. PCP: PCP linuxsockets PMDA: Arbitrary Command Execution via Command Injection CVE-2026-16524 PCP: PCP: Privilege escalation to root via linuxsockets...

CVE-2026-82906

A flaw has been found in sdcb chats up to 1.12.0. This impacts the function DownloadPublic of the file src/BE/web/Controllers/Chats/Files/FileController.cs of the component Signed File Download Endpoint. This manipulation causes missing authentication. Remote exploitation of the attack is possibl...

CVE-2026-82906 sdcb chats Signed File Download Endpoint FileController.cs DownloadPublic missing authentication

A flaw has been found in sdcb chats up to 1.12.0. This impacts the function DownloadPublic of the file src/BE/web/Controllers/Chats/Files/FileController.cs of the component Signed File Download Endpoint. This manipulation causes missing authentication. Remote exploitation of the attack is possibl...

CVE-2026-82906

A flaw has been found in sdcb chats up to 1.12.0. This impacts the function DownloadPublic of the file src/BE/web/Controllers/Chats/Files/FileController.cs of the component Signed File Download Endpoint. This manipulation causes missing authentication. Remote exploitation of the attack is possibl...

CVE-2026-82906 sdcb chats Signed File Download Endpoint FileController.cs DownloadPublic missing authentication

A flaw has been found in sdcb chats up to 1.12.0. This impacts the function DownloadPublic of the file src/BE/web/Controllers/Chats/Files/FileController.cs of the component Signed File Download Endpoint. This manipulation causes missing authentication. Remote exploitation of the attack is possibl...

CVE-2026-82906

A missing authentication flaw in sdcb chats versions up to 1.12.0 affects the Signed File Download Endpoint , specifically the DownloadPublic function in src/BE/web/Controllers/Chats/Files/FileController.cs. An unauthenticated remote attacker with high complexity can exploit this to achieve low c...

CLSA-2026-1788194548 Fix CVE(s): CVE-2026-57433

SECURITY UPDATE: denial of service via signed integer overflow when deserializing a crafted Storable blob - debian/patches/CVE-2026-57433.patch: reject a hook data item count of I32MAX in retrievehookcommon in dist/Storable/Storable.xs before it is incremented and passed to avextend; backported...

BIT-KEYCLOAK-2026-16093 Keycloak-services: keycloak-services: required signed-jwt assertion policy can be bypassed with unsigned assertion headers

Keycloak provides a mechanism called Client Policies to enforce security requirements on clients, such as requiring them to use signed JWTs for authentication. A flaw was discovered where this enforcement can be bypassed. An attacker with valid client credentials can provide a fake, unsigned...

CLSA-2026-1788175535 Fix CVE(s): CVE-2026-57433

SECURITY UPDATE: signed integer overflow when deserializing a crafted Storable SXHOOK record - debian/patches/CVE-2026-57433.patch: reject a hook data item count of I32MAX in retrievehook in dist/Storable/Storable.xs before it is incremented and passed to avextend - CVE-2026-57433...

CLSA-2026-1788170819 Fix CVE(s): CVE-2021-4156, CVE-2022-33065, CVE-2025-52194

SECURITY UPDATE: multiple signed integer overflows in the AU, MAT4/MAT5, AVR, SDS, AIFF, IRCAM, RF64, PCM and IMA-ADPCM header parsers allow denial of service via a crafted file ELSCVE-171688 - debian/patches/CVE-2022-33065/CVE-2022-33065-1..8,11..13.patch: widen the overflowing dataend, blockwid...

ValleyRAT masquerading as adware

Attackers typically try to pass off malware as legitimate applications or as potentially unwanted programs that users deliberately search for and download, such as cheats or cracks. They often rely on ad and affiliate networks to deliver their creations to victims' devices. This post examines a...

[SECURITY] [DLA 4762-1] libarchive security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4762-1 [email protected] https://www.debian.org/lts/security/ Abhijith PA August 31, 2026 https://wiki.debian.org/LTS -...

PT-2026-83983

Name of the Vulnerable Software and Affected Versions sdcb chats versions prior to 1.12.1 Description A flaw in the Signed File Download Endpoint component allows remote exploitation due to missing authentication. The issue resides in the DownloadPublic function within the...

CVE-2026-82906: Missing Authentication for Critical Function

A flaw has been found in sdcb chats up to 1.12.0. This impacts the function DownloadPublic of the file src/BE/web/Controllers/Chats/Files/FileController.cs of the component Signed File Download Endpoint. This manipulation causes missing authentication. Remote exploitation of the attack is possibl...

Linux Distros Unpatched Vulnerability : CVE-2026-80675

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: libbpf: Reject non-exclusive metadata maps in the signed loader The loader verifies map-sha...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-001398)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-001398 advisory. In the Linux kernel, the following vulnerability has been resolved: bpf: fix OOB devmap writes when deleting elements Jordy reported issue against XSKMAP which also...