Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: Tracing: kprobe: Fixed a memory leak in testgenkprobe/kretprobecmd. testgenkprobecmd only frees the buffer in the “fail path”; therefore, the buffer may leak when there is no failure. Move the kfreebuf call from the “fail path...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

A memory leak flaw, along with potential division by zero and integer overflow issues, have been detected in the Linux kernel’s V4L2 and vivid test code functionality. This issue occurs when a user triggers ioctls, such as the VIDIOCSDVTIMINGS ioctl. This could allow a local user to crash the...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: mm/damon/vaddr-test: A memory leak was fixed in damondotestapplythreeregions. When CONFIGDAMONVADDRKUNITTEST=y is enabled, and CONFIGDEBUGKMEMLEAK=y and CONFIGDEBUGKMEMLEAKAUTOSCAN=y are set, the aforementioned memory leak is...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: xfrm: Reinjecting transport-mode packets through the workqueue. The following warning is displayed when the tcp6-multi-diffip11 stress test case of the LTP test suite is tested: watchdog: BUG: Soft lockup – CPU0 stuck for 22...

CVE-2026-90647

ASE/Kalkitech ASE2000 V2 Communication Test Set 2.35 through 2.37 on Windows contains an improper certificate validation vulnerability in the IEC 60870-5-104 TLS client Task Mode. This allows a network-positioned attacker to bypass certificate validation via a certificate with multiple simultaneo...

CVE-2026-90647: Improper Certificate Validation

ASE/Kalkitech ASE2000 V2 Communication Test Set 2.35 through 2.37 on Windows contains an improper certificate validation vulnerability in the IEC 60870-5-104 TLS client Task Mode. This allows a network-positioned attacker to bypass certificate validation via a certificate with multiple simultaneo...

Linux Distros Unpatched Vulnerability : CVE-2026-89749

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tracing: Fix crash passing ERRPTR to kthreadstop eventteststuff calls kthreadrun and unconditionally passes the returned taskstruct pointer to kthreadstop...

DEBIAN-CVE-2026-89749

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix crash passing ERRPTR to kthreadstop eventteststuff calls kthreadrun and unconditionally passes the returned taskstruct pointer to kthreadstop. kthreadrun returns an error pointer such as ERRPTR-ENOMEM when kthread...

CVE-2026-89749

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix crash passing ERRPTR to kthreadstop eventteststuff calls kthreadrun and unconditionally passes the returned taskstruct pointer to kthreadstop. kthreadrun returns an error pointer such as ERRPTR-ENOMEM when kthread...

test

test Reproducción de CVE-2018-17456...

PYSEC-2026-3861 LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint

BerriAI litellm =1.82.4 is vulnerable to Server-Side Template Injection SSTI, which allows unauthenticated remote attackers to execute arbitrary OS commands via a crafted dotpromptcontent parameter in the /prompts/test endpoint due to use of an unsandboxed jinja2.Environment...

Claude Fable Solves a Historical Cipher

Claude Fable 5.1 solved a 370-year-old cipher in forty-four minutes. This tracks with what I wrote about AIs doing mathematics: It's good at things that involve lots of searching and testing. EDITED TO ADD 9/14: I'm not sure if this result is correct. The blog comments have more discussion...

CVE-2026-79696

A Code Injection vulnerability in adk web in Google Cloud Agent Development Kit ADK for Python versions 2.0.0 through 2.6.0 on Python OSS, Cloud Run, and GKE environments where pytest is installed allows an unauthenticated remote attacker to execute arbitrary code using a crafted test session...

CVE-2026-79696

Google Cloud Agent Development Kit (ADK) for Python (versions 2.0.0 through 2.6.0) contains a code injection vulnerability in the adk web component caused by an incomplete standard library denylist . In environments where pytest is installed—on Python (OSS), Cloud Run, and GKE—an unauthenticated ...

EUVD-2026-74768

A Code Injection vulnerability in adk web in Google Cloud Agent Development Kit ADK for Python versions 2.0.0 through 2.6.0 on Python OSS, Cloud Run, and GKE environments where pytest is installed allows an unauthenticated remote attacker to execute arbitrary code using a crafted test session...

Malicious Package

Overview @yongot/canary-mcp-test is a malicious package. This package contains malicious code. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship. Remediation Avoid using all malicious instances ...

CVE-2026-82185

The WPLP Cookie Consent WordPress plugin (versions before 4.4.2 ) is vulnerable to a lack of capability and nonce checks on specific A/B testing actions. This security flaw allows any authenticated user, including those with low-level permissions like a subscriber , to overwrite the cookie banner...

WordPress WPLP Cookie Consent plugin < 4.4.2 - Subscriber+ Banner Settings Overwrite and A/B Test Data Reset vulnerability

Subscriber+ Banner Settings Overwrite and A/B Test Data Reset vulnerability discovered by RIA Labs in WordPress Plugin WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions 4.4.2...

Malicious code in @yongot/canary-mcp-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b93b70d19f6065f9757e39a5d7f799ca9cfff26e2c47b6e4c51012a104885578 Package @yongot/[email protected] ships beacon.js which runs execSync'id', reads os.hostname, and issues an HTTPS GET to a hardcoded webhook.site...

MAL-2026-16062 Malicious code in @yongot/canary-mcp-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b93b70d19f6065f9757e39a5d7f799ca9cfff26e2c47b6e4c51012a104885578 Package @yongot/[email protected] ships beacon.js which runs execSync'id', reads os.hostname, and issues an HTTPS GET to a hardcoded webhook.site...