Malware in test-logsmodule-v-zisko

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CLSA-2026-1773161124 Fix CVE(s): CVE-2021-22876, CVE-2025-15079

SECURITY UPDATE: acceptance of hosts not listed in specified knownhosts file during SSH-based transfers - debian/patches/CVE-2025-15079.patch: Set both knownhosts options to same file and fix surprises caused by libssh exposing separate KNOWNHOSTS and GLOBALKNOWNHOSTS options. - CVE-2025-15079...

CVE-2026-24316 Server-Side Request Forgery (SSRF) in SAP NetWeaver Application Server for ABAP

SAP NetWeaver Application Server for ABAP provides an ABAP Report for testing purposes, which allows to send HTTP requests to arbitrary internal or external endpoints. The report is therefore vulnerable to Server-Side Request Forgery SSRF. Successful exploitation could lead to interaction with...

CVE-2026-24316

SAP NetWeaver Application Server for ABAP provides an ABAP Report for testing purposes, which allows to send HTTP requests to arbitrary internal or external endpoints. The report is therefore vulnerable to Server-Side Request Forgery SSRF. Successful exploitation could lead to interaction with...

SAP NetWeaver Application Server for ABAP code-related vulnerabilities

SAP NetWeaver Application Server for ABAP is a core application server platform developed by the German company SAP. There is a code vulnerability in SAP NetWeaver Application Server for ABAP. This vulnerability stems from the ABAP reports used for testing, which allow sending HTTP requests to...

PT-2026-24623

Summary At the rate limit filter, if we enabled the response phase limit with apply on stream done in the rate limit configuration and the response phase limit request fails directly, it may crash Envoy. Details When both the request phase limit and response phase limit are enabled, the safe gRPC...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the OIDC token exchange process. An attacker can obtain tokens for unauthorized clients or reuse expired authorization codes by submitting a valid authorization code with a different client ID or by using an...

airflow-poetry-test (>=0.1.0, <=0.1.2) potentially affected by CVE-2026-25604 via apache-airflow-providers-amazon (3.4.0)

apache-airflow-providers-amazon PYPI version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-amazon and may be impacted: - airflow-poetry-test =0.1.0, =0.1.2 Source cves: CVE-2026-25604 Source advisory:...

CVE-2026-25070

XikeStor SKS8310-8X Network Switch firmware versions 1.04.B07 and prior contain an OS command injection vulnerability in the /goform/PingTestSet endpoint that allows unauthenticated remote attackers to execute arbitrary operating system commands. Attackers can inject malicious commands through th...

openSUSE 16 : Recommended update for shim (SUSE-SU-openSUSE-RU-2026:20325-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU- openSUSE-RU-2026:20325-1 advisory. This update for shim fixes the following issues: shim is updated to version 16.1: - shimstartimage: fix guid/handle pairing when uninstalling...

How Each Gulf Country Is Intercepting Iranian Missiles and Drones

As missiles and drones cross the region’s skies, the Gulf’s layered air-defense networks—from THAAD to Patriot batteries—are being tested in real time...

ai.catboost:catboost-spark_4.0_2.13 (1.2.10), ai.catboost:catboost-spark_4.1_2.13 (1.2.10) +1236 more potentially affected by CVE-2026-24308 via org.apache.zookeeper:zookeeper (>=3.8.0, <=3.8.5)

org.apache.zookeeper:zookeeper MAVEN version =3.8.0, =3.10.0.5, =1.0.2-slim, =1.0.2-slim, =4.9.0, =0.1.0, =0.1.1 and more Source cves: CVE-2026-24308 Source advisory: OSV:GHSA-CRHR-QQJ8-RPXC...

ai.catboost:catboost-spark_4.0_2.13 (1.2.10), ai.catboost:catboost-spark_4.1_2.13 (1.2.10) +1236 more potentially affected by CVE-2026-24281 via org.apache.zookeeper:zookeeper (>=3.8.0, <=3.8.5)

org.apache.zookeeper:zookeeper MAVEN version =3.8.0, =3.10.0.5, =1.0.2-slim, =1.0.2-slim, =4.9.0, =0.1.0, =0.1.1 and more Source cves: CVE-2026-24281 Source advisory: GHSA-7XRH-HQFC-G7QR...

ai.catboost:catboost-spark_4.0_2.13 (1.2.10), ai.catboost:catboost-spark_4.1_2.13 (1.2.10) +1236 more potentially affected by CVE-2026-24308 via org.apache.zookeeper:zookeeper (>=3.8.0, <=3.8.5)

org.apache.zookeeper:zookeeper MAVEN version =3.8.0, =3.10.0.5, =1.0.2-slim, =1.0.2-slim, =4.9.0, =0.1.0, =0.1.1 and more Source cves: CVE-2026-24308 Source advisory: GHSA-CRHR-QQJ8-RPXC...

CVE-2026-30839

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, testwebhooknotifications.php does not validate the target URL against private/reserved IP ranges, enabling full-read SSRF. The server response is returned to the caller. This issue has been patched in...

CVE-2026-30839 Wallos: SSRF via webhook test endpoint

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, testwebhooknotifications.php does not validate the target URL against private/reserved IP ranges, enabling full-read SSRF. The server response is returned to the caller. This issue has been patched in...

CVE-2026-30839 Wallos: SSRF via webhook test endpoint

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, testwebhooknotifications.php does not validate the target URL against private/reserved IP ranges, enabling full-read SSRF. The server response is returned to the caller. This issue has been patched in...

CVE-2026-30839 Wallos: SSRF via webhook test endpoint

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, testwebhooknotifications.php does not validate the target URL against private/reserved IP ranges, enabling full-read SSRF. The server response is returned to the caller. This issue has been patched in...

EUVD-2026-10092

XikeStor SKS8310-8X Network Switch firmware versions 1.04.B07 and prior contain an OS command injection vulnerability in the /goform/PingTestSet endpoint that allows unauthenticated remote attackers to execute arbitrary operating system commands. Attackers can inject malicious commands through th...

[SECURITY] Fedora 43 Update: python3.10-3.10.19-4.fc43

Python 3.10 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. The python3.10 package provides the "python3.10" executable:...