CVE-2026-46405

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, in OpenBao's Kerberos auth method on the GET handler, or when an Authorization: Negotiate header is supplied, the response is includes a logical.Auth object in addition to an error message. This results in...

CVE-2026-46405 OpenBao's Kerberos Auth Method Accumulates Unaccessible Tokens

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, in OpenBao's Kerberos auth method on the GET handler, or when an Authorization: Negotiate header is supplied, the response is includes a logical.Auth object in addition to an error message. This results in...

Malicious code in bnpl-blocks-desktop-bnpl-breadcrumbs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f8ce63dd4b425c2f9650dd82df1d5b1f66ef56dd6f85ca6a99ff078f1f203b6 On require of the package, index.js loads support.js whose top-level init detects the host platform linuxx64, linuxarm64, darwin, win32, downloads a...

MAL-2026-13051 Malicious code in boxy-lazy-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5305d4b9e5c2859a6d53cc43cff86663c35902910301d561a4958b21c807d75 On require, index.js loads ext.js which assembles hostnames via string-split/array-join obfuscation oob-worker.cf100,1,2-.workers.dev, with a DNS-TXT...

MAL-2026-12171 Malicious code in bigops-informer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 324bb851ecf14c623080e07471bd23a7ea505bc6db244c654895a1cce71bf7e8 On require, index.js loads bootstrap.js which reconstructs a set of destination hostnames from string-array joins resolving to...

[SECURITY] Fedora 43 Update: valkey-8.1.9-1.fc43

Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing s...

[SECURITY] Fedora 44 Update: valkey-9.0.5-1.fc44

Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing s...

CVE-2026-64531

CVE-2026-64531 describes a Linux kernel issue in net/openvswitch: generated flow actions stored as nlattrs can exceed the 16-bit nla_len, allowing an oversized container to be closed with a truncated length. The fix preserves large total-action streams but rejects nested action containers that do...

CVE-2026-64223

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: consume only present negotiated TTLM maps ieee80211tidtolinkmapsizeok validates negotiated TTLM elements against the number of link-map entries indicated by linkmappresence. ieee80211parsenegttlm must consume the...

SUSE CVE-2026-64223

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: consume only present negotiated TTLM maps ieee80211tidtolinkmapsizeok validates negotiated TTLM elements against the number of link-map entries indicated by linkmappresence. ieee80211parsenegttlm must consume the...

Linux Distros Unpatched Vulnerability : CVE-2026-42955

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the 'ghost domain names' family of attacks was found ...

Open WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs key_builder= misuse)

Summary The getallmodels handlers in routers/openai.py and routers/ollama.py intended to cache their permission-filtered model lists per user, but the @cached decorator was misconfigured: it passed a key= lambda instead of keybuilder=. In aiocache 0.12.3 the pinned version, key= is a static cache...

Use of Cache Containing Sensitive Information

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information in the getallmodels process due to improper cache key configuration, which causes permission-filtered model lists to be shared across users. An attacker can acces...

DEBIAN-CVE-2026-64223

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: consume only present negotiated TTLM maps ieee80211tidtolinkmapsizeok validates negotiated TTLM elements against the number of link-map entries indicated by linkmappresence. ieee80211parsenegttlm must consume the...

CVE-2026-64223

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: consume only present negotiated TTLM maps ieee80211tidtolinkmapsizeok validates negotiated TTLM elements against the number of link-map entries indicated by linkmappresence. ieee80211parsenegttlm must consume the...

PT-2026-64338

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the mac80211 module of the Linux kernel. The ieee80211 parse neg ttlm function incorrectly advances its cursor for every Traffic Identifier TID, regardles...

CVE-2026-52684

If the auth responds very slowly and the records expire in between, the capping of TTLs is not enforced for lack of data. This does not happen on regular resolve as then then the child records are used immediately if not expired and thus valid, or the records are expired, and in that case not use...

Extra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a one-time 'ghost domain' delegation renewal via glue records

...

EUVD-2026-47932

If the auth responds very slowly and the records expire in between, the capping of TTLs is not enforced for lack of data. This does not happen on regular resolve as then then the child records are used immediately if not expired and thus valid, or the records are expired, and in that case not use...

CVE-2026-52684

If the auth responds very slowly and the records expire in between, the capping of TTLs is not enforced for lack of data. This does not happen on regular resolve as then then the child records are used immediately if not expired and thus valid, or the records are expired, and in that case not use...