Malicious Package

Overview @crysnovax/baileys-stable is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Fedora 44 : kernel (2026-0d885c0533)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-0d885c0533 advisory. The 7.1.13 stable kernel update contains a number of important fixes across the tree. We are now specifying all kernel updates as security because upstream...

GNU Privacy Guard 2.5.22

GnuPG the GNU Privacy Guard or GPG is GNU's tool for secure communication and data storage. It can be used to encrypt data and to create digital signatures. It includes an advanced key management facility and is compliant with the proposed OpenPGP Internet standard as described in RFC2440. As suc...

Fedora 44 : kernel (2026-92c9a5d8bc)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-92c9a5d8bc advisory. The 7.1.12 stable kernel update contains a single fix for CVE-2026-80590. ---- The 7.1.11 stable kernel updates contain a number of important fixes across th...

Fedora 43 : kernel (2026-f04e0d4d9d)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-f04e0d4d9d advisory. The 7.1.12 stable kernel update contains a single fix for CVE-2026-80590. ---- The 7.1.11 stable kernel updates contain a number of important fixes across th...

CVE-2026-82288

Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v1/cmd-flags endpoint that returns parsed command-line arguments including gradioauth and apiauth values in cleartext. Unauthenticated attackers can access this endpoint to retrieve configured...

CVE-2026-82288 Stable Diffusion WebUI Credential Disclosure via /sdapi/v1/cmd-flags

Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v1/cmd-flags endpoint that returns parsed command-line arguments including gradioauth and apiauth values in cleartext. Unauthenticated attackers can access this endpoint to retrieve configured...

CVE-2026-82288 Stable Diffusion WebUI Credential Disclosure via /sdapi/v1/cmd-flags

Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v1/cmd-flags endpoint that returns parsed command-line arguments including gradioauth and apiauth values in cleartext. Unauthenticated attackers can access this endpoint to retrieve configured...

EUVD-2026-67819

Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v1/cmd-flags endpoint that returns parsed command-line arguments including gradioauth and apiauth values in cleartext. Unauthenticated attackers can access this endpoint to retrieve configured...

CVE-2026-82288

Stable Diffusion WebUI through version 1.10.1 is affected by a credential disclosure vulnerability in the /sdapi/v1/cmd-flags API endpoint. The endpoint returns parsed command-line arguments—including gradio_auth and api_auth values—in cleartext, allowing unauthenticated network attackers to retr...

CVE-2026-82288

Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v1/cmd-flags endpoint that returns parsed command-line arguments including gradioauth and apiauth values in cleartext. Unauthenticated attackers can access this endpoint to retrieve configured...

CVE-2026-82288 Stable Diffusion WebUI Credential Disclosure via /sdapi/v1/cmd-flags

Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v1/cmd-flags endpoint that returns parsed command-line arguments including gradioauth and apiauth values in cleartext. Unauthenticated attackers can access this endpoint to retrieve configured...

PT-2026-83311

Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v1/cmd-flags endpoint that returns parsed command-line arguments including gradio auth and api auth values in cleartext. Unauthenticated attackers can access this endpoint to retrieve configured...

CVE-2026-82288: Insufficiently Protected Credentials

Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v1/cmd-flags endpoint that returns parsed command-line arguments including gradioauth and apiauth values in cleartext. Unauthenticated attackers can access this endpoint to retrieve configured...

PT-2026-86562

Three removal and replacement paths destroy an initialized value before committing the metadata change that removes it. Destruction runs T::drop, which is user code and may panic. If it does, the commit is skipped and the container still claims ownership of the already-destroyed value, so its own...

Fedora 44 : kernel (2026-73acdf12db)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-73acdf12db advisory. The 7.1.10 stable kernel update contains a number of important fixes across the tree. We are now specifying all kernel updates as security because upstream...

Stable Channel Update for Desktop

The Chrome team is delighted to announce the promotion of Chrome 152 to the stable channel for Windows, Mac and Linux. This will roll out over the coming days/weeks. Chrome 152.0.7977.64 Linux 152.0.7977.64/.65 Windows/Mac contains a number of fixes and improvements -- a list of changes is...

Fedora 43 : kernel (2026-6d18f005f1)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-6d18f005f1 advisory. The 7.1.10 stable kernel update contains a number of important fixes across the tree. We are now specifying all kernel updates as security because upstream...

RUSTSEC-2026-0267 Panic-safety unsoundness in `BitVecCore::clear` (double-free / use-after-free)

BitVecCore::clear drops every occupied element with dropinplace and only afterwards clears the occupancy bits and resets len. If an element's Drop panics, those metadata updates are skipped, so the slot of the already-dropped element stays marked as occupied. BitVecCore::drop calls clear again,...

Panic-safety unsoundness in `BitVecCore::clear` (double-free / use-after-free)

BitVecCore::clear drops every occupied element with dropinplace and only afterwards clears the occupancy bits and resets len. If an element's Drop panics, those metadata updates are skipped, so the slot of the already-dropped element stays marked as occupied. BitVecCore::drop calls clear again,...