RLSA-2026:69120 Moderate: unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fixes: unbound: Unbound: DNS cache poisoning via UDP source port predictability CVE-2026-50252 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and...

unbound security update

An update is available for unbound. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The unbound packages provide a validating, recursive, and caching DNS or DNSS...

Security Bulletin: IBM Quantum Safe Remediator is affected by mutiple vulnerabilities

Summary The vulnerabilities are found in the dependent open source libraries used in IBM Quantum Safe Remediator code base. IBM Quantum Safe Remediator has addressed these vulnerabilities by updating the versions of the affected libraries. Vulnerability Details CVEID:CVE-2026-41907 DESCRIPTION:...

CLEANSTART-2026-YI88599 source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2...

CVE-2026-56854 affects multiple packages. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. See references for individual vulnerability...

CVE-2026-77619: Improper Handling of Length Parameter Inconsistency

Vector is a high-performance observability data pipeline. From 0.15.0 until 0.57.0, the logstash source reads a 32-bit compressed-frame length from the network and uses it to size an in-memory buffer without an upper bound. An unauthenticated remote peer that can reach the default 0.0.0.0:5044...

Nginx Out-of-band Security Notification (July 15, 2026)

NGINX Security Advisory: NGINX Ingress Controller vulnerability CVE-2026-55723 NGINX Ingress Controller NGINX Ingress Controller vulnerability CVE-2026-52865 NGINX Ingress Controller NGINX Agent vulnerability CVE-2026-60062 NGINX Agent, NGINX Instance Manager NGINX map directive and regex matchin...

bazel-rules-python-source-2.3.3-1.1 on GA media (moderate)

bazel-rules-python-source-2.3.3-1.1 on GA media Announcement ID: openSUSE-SU-2026:11831-1 Rating: moderate Cross-References: CVE-2025-47273 CVSS scores: CVE-2025-47273 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2025-47273 SUSE : 7.7...

RockyLinux 8 : unbound (RLSA-2026:69120)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:69120 advisory. unbound: Unbound: DNS cache poisoning via UDP source port predictability CVE-2026-50252 Tenable has extracted the preceding description block directly from the...

CVE-2026-77620: Improper Handling of Highly Compressed Data (Data Amplification)

Vector is a high-performance observability data pipeline. From 0.15.0 until 0.57.0, the logstash source feeds each decompressed frame back into its decoder without limiting nested compression depth. An unauthenticated remote peer that can reach the default 0.0.0.0:5044 listener can send many nest...

PT-2026-96678

Name of the Vulnerable Software and Affected Versions WP Yelp Review Slider versions prior to 9.3 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting. The issue occurs when the plugin imports Yelp review text via t...

mitos

Mitos Computadoras aisladas y bifurcables para tus agentes de IA. Bifurcación de sandbox microVM en milisegundos en Kubernetes: bifurca una VM en ejecución en intentos paralelos y restáurala desde la memoria en decenas de milisegundos. Inicio rápido . Documentación . Características . Comparación...

CVE-2026-77516 MaxKB: Missing per-tool authorization in the agent and workflow tool-dispatch path

MaxKB is an open-source AI assistant for enterprise. From version 2.0.0 through 2.9.2, a lowest-role workspace member denied access to a tool by WorkspaceUserResourcePermission can still bind its identifier through toolids, skilltoolids, or mcptoolids and execute it through the agent or workflow...

Reliance on Untrusted Inputs in a Security Decision

Overview Affected versions of this package are vulnerable to Reliance on Untrusted Inputs in a Security Decision through the Nexus callback routing logic in chasm/lib/callback/request.go and components/callbacks/request.go. An attacker can make the History service send a state-changing internal...

Security Bulletin: Impacted IBM Optim 1.0.0, 1.1.0 and 1.2.0  by vulnerabilities in uuid

Summary Security Bulletin:Impacted IBM Optim 1.0.0, 1.1.0 and 1.2.0 by vulnerabilities in uuid, IBM Optim 2.0.0 resolves these vulnerabilities by upgrading the affected open-source dependencies to fixed versions. Vulnerability Details CVEID:CVE-2026-41907 DESCRIPTION: uuid is for the creation of...

CVE-2026-94368

A flaw was found in the signature verification logic of noobaa-core, the core component of the NooBaa Multicloud Object Gateway. The issue occurs when the service processes S3 presigned URLs using Signature Version 4 SigV4. Due to improper validation, the service fails to reject requests containi...

CVE-2026-87858

Temporal Server decided whether a Workflow completion callback was internal by reading a caller-supplied HTTP header. An authenticated caller holding only write permission in a single namespace could attach a completion callback whose URL host matched the configured callback address allowlist,...

runeward

AIエージェントのためのオープンソース・ガバナンス・ハーネス。 あらゆるAIエージェントに対して、強制可能なポリシー、人間による承認、分離された実行環境、予算、そして署名付き証跡を提供します。Runewardは、新しいモデルやオーケストレーションスタックを必要とせず、既存のエージェントやマルチエージェントフレームワークと連携して動作します。 1つのコマンドで証明する 前提条件: 稼働中のDocker/Podmanエンジンとrunewardバイナリ。 root@kitploit: runeward quickstart...

CVE-2026-94368

NooBaa-core , the core component of the NooBaa Multicloud Object Gateway , contains a flaw in its SigV4 signature verification logic. When processing S3 presigned URLs, the service drops unsigned x-amz- headers from the signature calculation instead of rejecting them. An attacker holding a valid ...

EUVD-2026-83898

A flaw was found in the signature verification logic of noobaa-core, the core component of the NooBaa Multicloud Object Gateway. The issue occurs when the service processes S3 presigned URLs using Signature Version 4 SigV4. Due to improper validation, the service fails to reject requests containi...

CVE-2026-94368 Noobaa-core: noobaa-core: presigned put url escalation to copyobject via unsigned x-amz-copy-source header

A flaw was found in the signature verification logic of noobaa-core, the core component of the NooBaa Multicloud Object Gateway. The issue occurs when the service processes S3 presigned URLs using Signature Version 4 SigV4. Due to improper validation, the service fails to reject requests containi...