Astra Linux – Vulnerability in Intel Microcode

A protection mechanism failure in some third- and fourth-generation IntelR XeonR processors, when using IntelR SGX or IntelR TDX, may allow a privileged user to potentially enable privilege escalation through local access...

Astra Linux – Vulnerability in Intel Microcode

Incorrect calculations in the microcode keying mechanism of certain IntelR XeonR D processors with IntelR SGX may allow a privileged user to potentially enable information disclosure through local access...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: x86/EFI: Fixed handling of graceful page faults after changes to the FPU softirq. Since commit d02198550423 “x86/FPU: Improved crypto performance by making the kernel-mode FPU reliably usable in softirqs”, the kernelfpubegin...

MAL-2026-6185 Malicious code in conversa-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector baaff1de63d44fd5f6b4fb1c5d3ebb4e9509d7581ff9afa5f339acad8f57aed0 On npm install, postinstall.js unconditionally reads the installer's /.npmrc which typically contains //registry.npmjs.org/:authToken=... along with...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: dotnet9.0: aspnetcore-runtime-9.0-9.0.17-1.hum1 aarch64, x8664 aspnetcore-runtime-dbg-9.0-9.0.17-1.hum1 aarch64, x8664 aspnetcore-targeting-pack-9.0-9.0.17-1.hum1 aarch64, x8664...

[SECURITY] Fedora 44 Update: perl-GD-2.86-1.fc44

This is a auto-loadable interface module for GD, a popular library for creating and manipulating PNG files. With this library you can create PNG images on the fly or modify existing files...

CVE-2026-8100

Impact A security issue has been identified in Chef 360 that could allow unauthorized access to protected API endpoints under specific conditions. This issue is due to improper handling of URL-encoded paths during request processing. In certain scenarios, an authenticated request may bypass...

@0xwork/connect (>=0.1.0, <=0.1.7), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +23 more potentially affected by CVE-2026-53850 via openclaw (>=2026.3.22, <=2026.4.24)

openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.0, =0.1.1, =0.2.18 - @xmoxmo/bncr 0.0.8 and more Source cves: CVE-2026-53850 Source advisory: OSV:GHSA-MPC8-JXJH-QPGH...

Incorrect Default Permissions

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Default Permissions via the config recovery process. An attacker can gain unauthorized access to sensitive configuration data by reading the openclaw.json file with overly broad...

@theia/ai-chat-ui (>=1.46.0-next.241, <=1.70.2), @theia/ai-claude-code (>=1.65.0, <=1.70.2) +8 more potentially affected by CVE-2026-46580 via @theia/ai-chat (>=1.46.0-next.241, <=1.70.2)

@theia/ai-chat NPM version =1.46.0-next.241, =1.46.0-next.241, =1.65.0, =1.67.0-next.56, =0.0.1, =1.62.0, =1.59.0-next.62, =1.57.0-next.37, =1.46.0-next.241, =1.46.0-next.241, =1.58.5 Source cves: CVE-2026-46580 Source advisory: OSV:GHSA-M973-PR9R-HP2W...

Improper Authentication

Overview PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent...

Arbitrary Command Injection

Overview praisonaiagents is a Praison AI agents for completing complex tasks with Self Reflection Agents Affected versions of this package are vulnerable to Arbitrary Command Injection via unsanitized input in the searchemails, replyemail, and archiveemail functions. An attacker can execute...

UBUNTU-CVE-2026-42489

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. To create and manage guests, domctl operations are used by the control domain, a possible Xenstore domain, or by a domain controlling a particular guest. Some of these...

EUVD-2026-37882

UBB.threads is vulnerable to Stored XSS via user posts and user profile fields. The application fails to properly sanitize user input, allowing low privileged attackers to inject arbitrary JavaScript that executes in a victim's browser upon viewing. Because vendor contact attempts were...

CVE-2026-48988

markdown-it is affected by a Denial-of-Service vulnerability (CVE-2026-48988) when typographer: true is enabled. Versions 14.1.1 and earlier process smartquotes with a quadratic time complexity due to repeated uses of replaceAt(), causing high CPU usage on quote-heavy inputs. The issue can degrad...

Important: Red Hat Security Advisory: RHOAI 3.5-ea.1 - Red Hat OpenShift AI

Updated images are now available for Red Hat OpenShift AI. Release of RHOAI 3.5-ea.1 provides these changes:...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition in the HTTP/1.1 client when an attacker-controlled upstream server injects an unsolicited response onto an idle keep-alive...

@01.software/cli (>=0.1.1, <=0.2.0), @01.software/sdk (>=0.0.1-251008.90016, <=0.3.0) +719 more potentially affected by CVE-2026-6733 via undici (>=7.0.0, <=7.27.2)

undici NPM version =7.0.0, =0.1.1, =0.0.1-251008.90016, =0.0.6, =0.18.1, =0.18.4, =0.18.4, =0.1.0, =0.0.33, =0.1.8, =0.0.1, =1.0.0, =0.1.7, =21.0.0-rc.2, =21.0.0-rc.2, =21.2.17 and more Source cves: CVE-2026-6733 Source advisory: SNYK:JS-UNDICI-17372752...

@01.software/cli (>=0.1.1, <=0.2.0), @01.software/sdk (>=0.0.1-251008.90016, <=0.3.0) +719 more potentially affected by CVE-2026-9678 via undici (>=7.0.0, <=7.27.2)

undici NPM version =7.0.0, =0.1.1, =0.0.1-251008.90016, =0.0.6, =0.18.1, =0.18.4, =0.18.4, =0.1.0, =0.0.33, =0.1.8, =0.0.1, =1.0.0, =0.1.7, =21.0.0-rc.2, =21.0.0-rc.2, =21.2.17 and more Source cves: CVE-2026-9678 Source advisory: SNYK:JS-UNDICI-17372697...

NPM: Multer vulnerable to Denial of Service via deeply nested field names

NPM: Multer vulnerable to Denial of Service via deeply nested field names vulnerability discovered by ? in WordPress Npm multer versions = 1.0.0, 2.2.0...