Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-006908)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006908 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: Rework long task execution when adding/deleting entries When adding/deleting...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-013351)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013351 advisory. In the Linux kernel, the following vulnerability has been resolved: fs/proc: taskmmu.c: don't read mapcount for migration entry The syzbot reported the below BUG:...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-011185)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-011185 advisory. In the Linux kernel, the following vulnerability has been resolved: iouring: wait interruptibly for request completions on exit WHen the ring exits, cleanup is done...

Unity Linux 20.1050e / 20.1070e Security Update: kernel (UTSA-2026-011095)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-011095 advisory. In the Linux kernel, the following vulnerability has been resolved: igb: Fix igbdown hung on surprise removal In a setup where a Thunderbolt hub connects to Ethernet...

CVE-2026-40337

The Sentry kernel is a high security level micro-kernel implementation made for high security embedded systems. A given task with one of the DEV or IO capability is able to interact with another task's IRQ line through the sysint syscall familly. Prior to version 0.4.7, this can lead to DoS and...

aiidalab-launch (>=2021.1001.0a0, <=2023.1019.0), config-env (>=0.0.1, <=0.0.4) +15 more potentially affected by CVE-2026-28684 via python-dotenv (0.19.1)

python-dotenv PYPI version 0.19.1 is affected by a known vulnerability. The following packages have a transitive dependency on python-dotenv and may be impacted: - aiidalab-launch =2021.1001.0a0, =0.0.1, =1.1.1, =0.1.2, =0.1.2, =0.1.0, =0.8.0.dev6, =0.58.0, =0.1.0, =2.1.7, =1.0.0, =0.0.20, =0.1.0...

PureRAT: A Multi-Stage, Fileless RAT Utilizing Image Steganography and Process Hollowing

PureRAT: A Multi-Stage, Fileless RAT Utilizing Image Steganography and Process Hollowing By Prashanth A N and Mallikarjun Wali · April 20, 2026 PureRAT is an advanced remote access trojan RAT characterized by its complex infection stages. The intrusion sequence is initiated by a malicious .LNK fi...

aind-airflow-jobs (>=0.2.1, <=0.2.6), apache-airflow-providers-snowflake (>=1.0.0b2, <=1.0.0) +2 more potentially affected by CVE-2026-25917 via apache-airflow (2.8.1)

apache-airflow PYPI version 2.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - aind-airflow-jobs =0.2.1, =1.0.0b2, =1.1.1.post0.dev6, =1.1.3.post0.dev5 Source cves: CVE-2026-25917 Source advisory: OSV:PYSEC-2026...

False Security Confidence in Benign LLM Code Generation

Prior work has demonstrated that functionally correct yet vulnerable outputs arise systematically in threat-oriented settings, where adversarial or implicit channels are used to induce security failures in code agents and automated patching workflows. This note introduces a complementary but...

CVE-2026-40337 Sentry kernel has incomplete ownership check for IRQ line manipulation

The Sentry kernel is a high security level micro-kernel implementation made for high security embedded systems. A given task with one of the DEV or IO capability is able to interact with another task's IRQ line through the sysint syscall familly. Prior to version 0.4.7, this can lead to DoS and...

CVE-2026-40337 Sentry kernel has incomplete ownership check for IRQ line manipulation

The Sentry kernel is a high security level micro-kernel implementation made for high security embedded systems. A given task with one of the DEV or IO capability is able to interact with another task's IRQ line through the sysint syscall familly. Prior to version 0.4.7, this can lead to DoS and...

JLSEC-2026-132

OpenEXR 3.1.x before 3.1.4 has a heap-based buffer overflow in Imf31::LineCompositeTask::execute called from IlmThread31::NullThreadPoolProvider::addTask and IlmThread31::ThreadPool::addGlobalTask. NOTE: db217f2 may be inapplicable...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-007363)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007363 advisory. In the Linux kernel, the following vulnerability has been resolved: parisc: led: Fix potential null-ptr-deref in starttask starttask calls createsinglethreadworkqueu...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-007430)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007430 advisory. In the Linux kernel, the following vulnerability has been resolved: fs/proc: dotaskstat: use sig-statslock to gather the threads/children stats locktasksighand can...

SUSE CVE-2026-33212

Weblate is a web based localization tool. In versions prior to 5.17, the tasks API didn't verify user access for pending tasks. This could expose logs of in-progress operations to users who don't have access to given scope. The attacker needs to brute-force the random UUID of the task, so...

Authorization Bypass Through User-Controlled Key

Overview weblate is an A web-based continuous localization system with tight version control integration Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the API for pending tasks due to missing verification of user access. An attacker can...

Weblate: Improper access control for pending tasks in API

Impact The API for tasks didn't verify user access for pending tasks. This could expose logs of in-progress operations to users who don't have access to given scope. Patches https://github.com/WeblateOrg/weblate/pull/18515 Workarounds The attacker needs to guess the random UUID of the task, so...

EUVD-2026-22997

Weblate: Improper access control for pending tasks in API...

CVE-2026-30625

Upsonic 0.71.6 contains a remote code execution vulnerability in its MCP server/task creation functionality. The application allows users to define MCP tasks with arbitrary command and args values. Although an allowlist exists, certain allowed commands npm, npx accept argument flags that enable...

EUVD-2026-23233

JWT Tokens used by tasks were exposed in logs. This could allow UI users to act as Dag Authors. Users are advised to upgrade to Airflow version that contains fix. Users are recommended to upgrade to version 3.2.0, which fixes this issue...