Important: Red Hat Security Advisory: nodejs:22 security update

An update for the nodejs:22 module is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

CVE-2026-19381

creationtimestamp| type| source ---|---|--- 2026-08-10 01:30:29+00:00| seen| https://infosec.exchange/users/offseq/statuses/117068623277375334 2026-08-10 01:30:31+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3msoxaf46yl2v 2026-08-10 02:00:02+00:00| seen|...

PT-2026-69565

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description DAMON core logic assumes that zero length regions do not exist. However, certain API callers, including DAMON SYSFS, DAMON RECLAIM, and DAMON LRU SORT, allow users to set empty monitorin...

CVE-2026-68350: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: carl9170: fix OOB read from off-by-two in TX status handler The bounds check in carl9170txprocessstatus uses i cmd-hdr.len / 2 + 1 which is off by two, allowing 2 extra iterations past valid txstatus entries when the...

PT-2026-69750

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the carl9170 tx process status function. The issue is caused by an off-by-two error in the bounds check, which uses the comparison i cmd-hdr.len / 2 + 1...

Linux Distros Unpatched Vulnerability : CVE-2026-68350

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: carl9170: fix OOB read from off-by-two in TX status handler The bounds check in carl9170txprocessstatus uses i cmd-hdr.len / 2 + 1 which is off by two,...

CVE-2026-65542

creationtimestamp| type| source ---|---|--- 2026-08-09 23:16:09+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3msopq4olk62f 2026-08-09 23:16:10+00:00| seen| https://bsky.app/profile/potato.software/post/3msopq62hwg2i 2026-08-10 19:16:08+00:00| seen|...

CVE-2026-19348

creationtimestamp| type| source ---|---|--- 2026-08-09 12:00:26+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3msnjxultsu2k 2026-08-09 12:00:36+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msnjy52jnm23 2026-08-09 16:00:46+00:00| seen|...

Streaming AEAD does not authenticate stream structure

In all published versions of dcrypt-symmetric before 2.0.0, version-1 GCM and ChaCha20-Poly1305 streams used unauthenticated terminator, counter, and length fields. Decryptors trusted transmitted counters, allocated from unbounded lengths, and discarded plaintext that did not fit a caller's singl...

RUSTSEC-2026-0238 Low-level GCM ignores the operation nonce

In all published versions of dcrypt-algorithms before 2.0.0, the low-level Gcm builder required an operation nonce but derived J0 from the nonce captured by the original Gcm constructor. Multiple operations could therefore silently reuse a nonce even when callers supplied distinct values,...

CVE-2026-17014

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public REST endpoint actions, allowing unauthenticated users to delete the generated album export ZIP archives it stores...

CVE-2026-71992

creationtimestamp| type| source ---|---|--- 2026-08-09 03:00:24+00:00| seen| https://infosec.exchange/users/offseq/statuses/117063314524225568 2026-08-09 03:00:28+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3msmlsamc5x24...

CVE-2026-71990

creationtimestamp| type| source ---|---|--- 2026-08-09 00:18:16+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msmcmg62vl2u 2026-08-09 01:00:31+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msmf3rxura2a 2026-08-09 04:30:28+00:00| seen|...

CVE-2026-71952

creationtimestamp| type| source ---|---|--- 2026-08-08 17:14:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mslkzripjp27 2026-08-08 18:13:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/jyuesx3qptyww 2026-08-09 05:01:17+00:00| seen|...

CVE-2026-16578

The Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection WordPress plugin before 1.4.0 does not perform any capability check on one of its REST API endpoints, allowing unauthenticated attackers to retrieve the full list of registered users including their usernames, ema...

N-able Issues N-central Hotfix 2 as Attackers Reach Managed Systems and Persist

N-able has released a fresh round of hotfixes for N‑central as part of its investigation into ongoing exploitation of a recently disclosed security flaw in the Remote Monitoring and Management RMM product. "We are proactively expanding protections in response to ongoing monitoring of threat actor...

EUVD-2026-54737

The Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection WordPress plugin before 1.4.0 does not perform any capability check on one of its REST API endpoints, allowing unauthenticated attackers to retrieve the full list of registered users including their usernames, ema...

CVE-2026-16578 Admin Safety Guard < 1.4.0 - Unauthenticated User Data Disclosure via 2fa/app/users REST Route

The Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection WordPress plugin before 1.4.0 does not perform any capability check on one of its REST API endpoints, allowing unauthenticated attackers to retrieve the full list of registered users including their usernames, ema...

CVE-2026-16578

The Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection WordPress plugin before 1.4.0 does not perform any capability check on one of its REST API endpoints, allowing unauthenticated attackers to retrieve the full list of registered users including their usernames, ema...

CVE-2026-16578

The Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection WordPress plugin, in versions before 1.4.0 , is vulnerable to unauthenticated user data disclosure. The root cause is a missing capability check on the 2fa/app/users REST API endpoint. This flaw allows unauthentic...