CVE-2022-36946

CVE-2022-36946 Reported-by: Domingo Dirutigliano and Nicola Guerrera While we were working on firegex, our application firewall for CTF Attack-Defence competitions, we stumbled upon a few kernel panics. This strange behavour was than isolated and anlayzed, leading to the discovery of this potenti...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: Rejects the immediate NFQUEUE verdict. The nftqueue is always used by the user-space nftables to deliver the NFQUEUE verdict. Immediate emission of the NFQUEUE verdict is never used by the user-space nft tool...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: bpf: fix recursive lock when verdict program return SKPASS When the streamverdict program returns SKPASS, it places the received skb into its own receive queue. However, a recursive lock occurs eventually, leading to an operating...

ALIBI: Adversarial Legitimacy Injection in Binary Input against LLM Malware Analyzers

Large language models are being integrated into malware triage workflows as reasoning components that summarize static evidence and produce analyst-facing verdicts. This paper shows that the same reasoning capability introduces a new attack surface. We present ALIBI, a semantic cover story attack...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fixed repeated calls to sockput when msg has moredata In the tcpbpfsendverdict redirection, the eval variable is assigned to SKREDIRECT after the applybytes data is sent. If msg has moredata, sockput will be called...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlinkqueue: A fix was made for the issue where an entry leak occurred in the “bridge verdict error path”. The nfqnlrecvverdict function calls finddequeueentry to remove the queue entry from the queue data structure...

CVE-2026-89519 sched_ext: Replace SCX_RQ_BAL_KEEP with a dispatch verdict return

In the Linux kernel, the following vulnerability has been resolved: schedext: Replace SCXRQBALKEEP with a dispatch verdict return SCXRQBALKEEP tells the pick to keep running the previous task, a leftover from when balancing and picking were separate operations. An rq-level flag only works while...

PT-2026-90235

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the sched ext component where the use of the SCX RQ BAL KEEP flag can lead to incorrect task execution. This occurs because the flag is set at the run-queue rq level,...

kernel: netfilter: nf_tables: don't skip expired elements during walk

A flaw was found in the Linux kernel. Improper management of the lifecycle of some nftables objects could result in consumption of all system memory. An attacker who can create nftables rules could use this to effect a Denial of Service...

CVE-2026-78629 Improper Authentication Verification in the Okta Hyperdrive Agent MFA Response Handling

The Okta Hyperdrive agent plugin returns a success response without a signed SAML assertion when the organization's policy requires no MFA for a given user. The response contains only a bare boolean validation indicator with no cryptographic artifact, resulting in an unverifiable authentication...

PT-2026-88439

Name of the Vulnerable Software and Affected Versions Okta Hyperdrive agent plugin affected versions not specified Description The Okta Hyperdrive agent plugin returns a success response without a signed SAML assertion when the organization's policy requires no MFA for a given user. The response...

EUVD-2026-70225

claude-skill-antivirus fails to analyze executable files when scanning local skill directories, reading only SKILL.md while ignoring Python source, bytecode, and other artifacts in the scripts directory. Attackers can distribute skills with malicious code in non-manifest files that receive a SAFE...

SUSE CVE-2026-72416

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftcompat: ebtables emulation must reject non-bridge targets xtables targets return netfilter verdicts: NFACCEPT, NFDROP, and so on. ebtables targets return incompatible verdicts: EBTACCEPT, EBTDROP, ... We cannot allo...

nah v1.4.0

expensive mistakes stop here a guard that blocks catastrophic agent actions nahguard.ai • what it blocks • how it compares • how it decides • install • extend • threat model claude code · codex · cursor · pi · + 11 more nah is a guard that sits in your coding agent's hook path and reads tool call...

CVE-2026-84810: Protection Mechanism Failure

claude-skill-antivirus fails to analyze executable files when scanning local skill directories, reading only SKILL.md while ignoring Python source, bytecode, and other artifacts in the scripts directory. Attackers can distribute skills with malicious code in non-manifest files that receive a SAFE...

CVE-2026-14696

When Ethernet bridging is enabled CONFIGNETETHERNETBRIDGE, ethbridgeinputprocess in subsys/net/l2/ethernet/bridge/bridgeinput.c decides how each frame received on a bridge member interface is handled. For frames that must also be delivered to the local stack, the code called ethbridgehandlelocall...

CVE-2026-14696

Zephyr RTOS Ethernet bridging contains an RX packet leak in eth_bridge_input_process() (subsys/net/l2/ethernet/bridge/bridge_input.c). When Ethernet bridging is enabled (CONFIG_NET_ETHERNET_BRIDGE), frames delivered to the local stack via eth_bridge_handle_locally() return NET_OK without actually...

CVE-2026-14696 Ethernet bridge RX packet leak enables denial of service via RX buffer-pool exhaustion

When Ethernet bridging is enabled CONFIGNETETHERNETBRIDGE, ethbridgeinputprocess in subsys/net/l2/ethernet/bridge/bridgeinput.c decides how each frame received on a bridge member interface is handled. For frames that must also be delivered to the local stack, the code called ethbridgehandlelocall...

PYSEC-2026-3960

openssl-encrypt pip package, versions = 1.4.8 fails to sanitize filenames read from untrusted drive data outside the AES-GCM authenticated manifest before printing them in the verify-usb command's output. An attacker can plant filenames containing terminal cursor-movement and erase-line control...

CVE-2026-81694 verify-usb before 1.4.9 Output Injection via Unsanitized Filenames

openssl-encrypt pip package, versions = 1.4.8 fails to sanitize filenames read from untrusted drive data outside the AES-GCM authenticated manifest before printing them in the verify-usb command's output. An attacker can plant filenames containing terminal cursor-movement and erase-line control...