SUSE CVE-2026-53074

In the Linux kernel, the following vulnerability has been resolved: bpf: reject short IPv4/IPv6 inputs in bpfprogtestrunskb bpfprogtestrunskb calls ethtypetrans first and then uses skb-protocol to initialize sk family and address fields for the test run. For IPv4 and IPv6 packets, it may access...

PT-2026-55145

Summary A memory-safety vulnerability in Open Babel's GRO parser caused an uninitialized pointer dereference when reading a crafted input file. Details The flaw was in the residue handling of the GRO reader. A malformed record caused the parser to use a residue pointer that had never been...

BIT-APPSMITH-2026-49979 Appsmith: SSRF via `POST /api/v1/admin/send-test-email` — JavaMail Bypasses WebClient IP Filter

Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.99, the POST /api/v1/admin/send-test-email endpoint accepts attacker-controlled smtpHost and smtpPort values and establishes a raw JavaMail TCP connection without any IP validation. This completely bypasses...

Sigstore Java has a vulnerability with bundle verification of integratedTime

Summary Regression: Verification of integratedTime from Rekor V1 Log Entry against Fuclio Certificate validity was missing Details - PR 1008 erroneously removed verification of the integrated Rekor entry time against the Fulcio certificate. - PR 1185 re-added this verification with enhancements...

cossacks-back-to-war-exploit

⚠️ Disclaimer The code in this repository is provided as-i...

CVE-2026-13316 Foreman: ssrf to cloud metada service through unvalidated test_url parameters in foreman config

A flaw has been found in foreman when HTTP parameters are modified in httpproxiescontroller and httpproxy files. Attackers can perform an SSRF attack and steal cloud metadata service on AWS/GCP/Azure environment through foreman component...

PoCE

POCE 1. Here we have combined all the frameworks to run in a s...

PT-2026-55058

Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.99, the POST /api/v1/admin/send-test-email endpoint accepts attacker-controlled smtpHost and smtpPort values and establishes a raw JavaMail TCP connection without any IP validation. This completely bypasses...

PT-2026-54439

Name of the Vulnerable Software and Affected Versions sigstore-java version 2.0.0 Description A regression occurred where the verification of the integrated time Rekor entry time against the Fulcio certificate was erroneously removed. This allows a malicious actor who has exfiltrated a temporary...

Moderate: Red Hat Security Advisory: glibc security, bug fix, and enhancement update

An update for glibc is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

vulns-2026-fatfs-chance

ELM FatFs Vulnerability Research This repository documents se...

Malicious Package

Overview test-nonmal-pkg-5 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @flipbit2-bb/scope-test is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

Malicious Package

Overview @flipbit2-bb/test-auth-state is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious code in @flipbit2-bb/scope-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 21b4b4d5e8e72141828bf6df5afe2300f5b9496d22f8b05491623fd699496603 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-53296

A flaw was found in the Linux kernel, specifically within the mailbox-test component. This vulnerability occurs when channels are not correctly released during a probe error, leading to a memory leak and a Use-After-Free UAF condition. A Use-After-Free UAF is a memory corruption vulnerability tha...

Malicious code in express-mocha-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01d87351be0d9f68d73ec05867e55fe5712d4885fa76c70c5ec9b003ef512825 [email protected] declares a postinstall lifecycle hook that loads the package's main module, which calls fetch against an anonymous...

MAL-2026-6568 Malicious code in express-mocha-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01d87351be0d9f68d73ec05867e55fe5712d4885fa76c70c5ec9b003ef512825 [email protected] declares a postinstall lifecycle hook that loads the package's main module, which calls fetch against an anonymous...

Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: net: atm: fix crash due to unvalidated vcc pointer in sigdsend CVE-2026-31411 kernel: tcp: fix potential race in tcpv6synrecvsock CVE-2026-43198 Bug Fixes and Enhancements: AlmaLinux 9.8...

ALSA-2026:33285 Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: net: atm: fix crash due to unvalidated vcc pointer in sigdsend CVE-2026-31411 kernel: tcp: fix potential race in tcpv6synrecvsock CVE-2026-43198 Bug Fixes and Enhancements: AlmaLinux 9.8...