p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing

A flaw was found in p11-kit. The RPC message attribute parsing functions p11rpcmessagegetattribute and p11rpcmessagegetattributearrayvalue form a mutually-recursive call chain with no recursion depth limit when processing nested CKAWRAPTEMPLATE, CKAUNWRAPTEMPLATE, and CKADERIVETEMPLATE attributes...

curl: Heap use-after-free (write) in mev_forget_socket() via reentrant curl_easy_pause() — incomplete fix for CVE-2026-9080

lib/multiev.c keeps a hash table multi-ev.shentries of per-socket bookkeeping structs struct mevshentry used to decide when to notify the application's socket callback CURLMOPTSOCKETFUNCTION about interest changes on a socket. CVE-2026-9080 "multi: handle pause in multi socket callback", commit...

PT-2026-67489

Name of the Vulnerable Software and Affected Versions Socket.IO versions prior to 4.2.7 Socket.IO versions prior to 3.4.5 Socket.IO versions prior to 3.3.6 Description A specially crafted Socket.IO packet can force the server to wait for and buffer an excessive number of binary attachments. This...

vault-conductor v0.3.1

🗝️ vault-conductor An SSH Agent that provides SSH keys stored in Bitwarden Secret Manager as secrets. Supports SSH authentication and Git commit signing. Demo Features It implements the SSH Agent Protocol as a Unix domain socket server, acting as a secure bridge between your SSH clients and...

VulnCheck KEV: CVE-2026-53576

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authentication filter for the REST API @Filter"/api/v1/" treats any request whose path ends in /configs as the public instance-config endpoint and forwards it without a credential check. kestra addresse...

kernel: net: sched: UAF via missing handler for TC_ACT_CONSUMED in tcf_qevent_handle

A flaw was found in the Linux kernel's traffic control TC classifier application programming interface API. The tcfqeventhandle function does not properly handle a consumed socket buffer skb when it is processed by the defragmentation engine. This can lead to a Use-After-Free UAF vulnerability,...

kernel: net: sched: UAF via missing handler for TC_ACT_CONSUMED in tcf_qevent_handle

A flaw was found in the Linux kernel's traffic control TC classifier application programming interface API. The tcfqeventhandle function does not properly handle a consumed socket buffer skb when it is processed by the defragmentation engine. This can lead to a Use-After-Free UAF vulnerability,...

kernel: net: sched: UAF via missing handler for TC_ACT_CONSUMED in tcf_qevent_handle

A flaw was found in the Linux kernel's traffic control TC classifier application programming interface API. The tcfqeventhandle function does not properly handle a consumed socket buffer skb when it is processed by the defragmentation engine. This can lead to a Use-After-Free UAF vulnerability,...

CVE-2026-17350

The per-tool permission system custom roles / role-based tool permissions, introduced in pgAdmin 4 9.3 did not enforce its permission check consistently. In SERVER mode, pgAdmin 4 gates each tool behind a per-tool Flask-Security permission, but the permission decorator permissionsrequired was...

CVE-2026-17350 pgAdmin 4: Tool permission bypass via backend routes and Socket.IO handlers

The per-tool permission system custom roles / role-based tool permissions, introduced in pgAdmin 4 9.3 did not enforce its permission check consistently. In SERVER mode, pgAdmin 4 gates each tool behind a per-tool Flask-Security permission, but the permission decorator permissionsrequired was...

CVE-2026-17350 pgAdmin 4: Tool permission bypass via backend routes and Socket.IO handlers

The per-tool permission system custom roles / role-based tool permissions, introduced in pgAdmin 4 9.3 did not enforce its permission check consistently. In SERVER mode, pgAdmin 4 gates each tool behind a per-tool Flask-Security permission, but the permission decorator permissionsrequired was...

CVE-2026-17350 pgAdmin 4: Tool permission bypass via backend routes and Socket.IO handlers

The per-tool permission system custom roles / role-based tool permissions, introduced in pgAdmin 4 9.3 did not enforce its permission check consistently. In SERVER mode, pgAdmin 4 gates each tool behind a per-tool Flask-Security permission, but the permission decorator permissionsrequired was...

CVE-2026-17350

Summary: CVE-2026-17350 affects pgAdmin 4 in SERVER mode (9.3–9.17). The per-tool permission system did not consistently enforce tool-level permissions; only the front-door route used a permissions_required decorator, while other backend routes and Socket.IO handlers relied on authentication chec...

kernel: net: sched: UAF via missing handler for TC_ACT_CONSUMED in tcf_qevent_handle

A flaw was found in the Linux kernel's traffic control TC classifier application programming interface API. The tcfqeventhandle function does not properly handle a consumed socket buffer skb when it is processed by the defragmentation engine. This can lead to a Use-After-Free UAF vulnerability,...

SUSE-SU-2026:23075-1 Security update for perl

This update for perl fixes the following issues - CVE-2025-15649: IO:Uncompress:Unzip propagates uncaught exception when parsing zip header with malformed DOS date bsc1266361. - CVE-2026-8376: heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds...

PT-2026-66775

Name of the Vulnerable Software and Affected Versions pgAdmin 4 versions 9.3 through 9.16 Description In SERVER mode, the per-tool permission system fails to consistently enforce permission checks. While a permissions required decorator is used on the initial route of a tool, subsequent backend...

FreeBSD : NetBird -- Local Privilege Escalation via Unauthenticated IPC Socket (ef71114e-8c1c-11f1-a221-3c7c3fba4204)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ef71114e-8c1c-11f1-a221-3c7c3fba4204 advisory. The NetBird Team reports: The NetBird client daemon exposes its gRPC control interface to any local...

SUSE SLES12: PackageKit / PackageKit-backend-zypp / PackageKit-devel / etc (SUSE-SU-2026:3405-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:3405-1 advisory. This update for PackageKit fixes the following issue: - CVE-2026-10294: manipulation of the argument frontend-socket can lead to improper authorization...

SUSE SLED15: PackageKit / PackageKit-backend-zypp / PackageKit-devel / etc (SUSE-SU-2026:3404-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3404-1 advisory. - CVE-2026-10294: manipulation of the argument frontend-socket can lead to improper authorization bsc1267250. Tenable h...

openssh security update

8.0p1-30.0.1 - Update upstream references Orabug: 36587718 8.0p1-30 - CVE-2026-55653: Fix double free in openssh DH-GEX client path during FIPS known-group validation that leads to client-side denial of service Resolves: RHEL-185775 - CVE-2026-55655: Fix MITM of X11 forwarding via abstract UNIX...