Linux Distros Unpatched Vulnerability : CVE-2026-72134

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - spi: imx: reconfigure for PIO when DMA cannot be started When spiimxcandma selects DMA, the ECSPI is configured for DMA: spiimxsetupxfer sets CTRL.SMC and clear...

Linux Distros Unpatched Vulnerability : CVE-2026-72014

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drbd: reject data replies with an out-of-range payload size recvdlessread receives a PDATAREPLY from a peer into the bio of an outstanding read request. The...

Linux Distros Unpatched Vulnerability : CVE-2026-74398

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv6: addrconf: bail out of dadfailure when state is no longer POSTDAD addrconfdadfailure transitions ifp-state from DAD to POSTDAD via addrconfdadend, which...

Linux Distros Unpatched Vulnerability : CVE-2026-72139

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tcp: defer md5siginfo kfree past RCU grace period in tcpconnect The md5+ao reconciliation in tcpconnect net/ipv4/tcpoutput.c has two symmetric branches: if...

PT-2026-77274

Kraken agents fail to verify peer-to-peer downloaded blobs against their requested SHA-256 digest before committing to the content-addressable cache, relying only on CRC32 checksums for piece validation. Attackers on the agent-to-agent path or malicious peers can supply substituted content with...

Linux Distros Unpatched Vulnerability : CVE-2026-72422

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ksmbd: fix use-after-free of conn-preauthinfo in concurrent SMB2 NEGOTIATE conn-preauthinfo is shared connection state struct preauthintegrityinfo, kmalloc-96...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102135)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102135 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nftct: add seqadj extension for natted connections Sequence adjustment may be required...

CVE-2026-9693

Mattermost versions 10.11.x = 10.11.20, 11.7.x = 11.7.5 Mattermost fails to remove thread membership records when a user is removed from or leaves a team, which allows a previously removed user who is later re-invited to the team to view private channel thread root post content and metadata via t...

qwen3.8-9b-cyber-exploit-agent-uncensored

Qwen3.8-9B Cyber Exploit Agent — UNCENSORED Identical fine-tu...

CVE-2026-72123

A use-after-free flaw was found in the Linux kernel's CAN BCM Broadcast Manager subsystem. During RX operation teardown, a concurrent receive handler can race and re-arm the throttle timer after the operation has been scheduled for deallocation. When the deallocation completes, the timer is still...

CVE-2026-72116

A flaw was found in the Linux kernel's Broadcom Controller Area Network CAN bus driver. When a CAN device is removed, the driver may fail to properly manage its receive and transmit operations. This can lead to receive filters not being correctly re-enabled after updates, preventing expected data...

CVE-2026-72112

A flaw was found in the Linux kernel's iouring/bpf-ops component. This vulnerability allows a local attacker with specific capabilities CAPBPF and CAPPERFMON to re-register an already-bound operation, leading to a use-after-free of freed executable memory. This could result in arbitrary code...

CVE-2026-64849

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/id/test endpoint calls validatewebhookurl in mlflow/utils/validation.py only for the original URL while...

CVE-2026-9693

Mattermost 10.11.x (≤10.11.20) and 11.7.x (≤11.7.5) fail to delete thread membership records when a user leaves or is removed from a team. A previously removed user who is later re-invited can access private channel thread root post content and metadata via the team threads API, causing low confi...

CVE-2026-9693 Mattermost thread memberships persist after team removal, exposing private channel thread metadata on re-invite

Mattermost versions 10.11.x = 10.11.20, 11.7.x = 11.7.5 Mattermost fails to remove thread membership records when a user is removed from or leaves a team, which allows a previously removed user who is later re-invited to the team to view private channel thread root post content and metadata via t...

CVE-2026-9693

Mattermost versions 10.11.x = 10.11.20, 11.7.x = 11.7.5 Mattermost fails to remove thread membership records when a user is removed from or leaves a team, which allows a previously removed user who is later re-invited to the team to view private channel thread root post content and metadata via t...

CVE-2026-9693 Mattermost thread memberships persist after team removal, exposing private channel thread metadata on re-invite

Mattermost versions 10.11.x = 10.11.20, 11.7.x = 11.7.5 Mattermost fails to remove thread membership records when a user is removed from or leaves a team, which allows a previously removed user who is later re-invited to the team to view private channel thread root post content and metadata via t...

CVE-2026-9693 Mattermost thread memberships persist after team removal, exposing private channel thread metadata on re-invite

Mattermost versions 10.11.x = 10.11.20, 11.7.x = 11.7.5 Mattermost fails to remove thread membership records when a user is removed from or leaves a team, which allows a previously removed user who is later re-invited to the team to view private channel thread root post content and metadata via t...

GHSA-7GWP-5PFP-969J MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)

Summary The default MLflow Tracking Server mlflow server, no authentication, default SQLite backend exposes the model-registry webhooks API unauthenticated, including a synchronous POST /api/2.0/mlflow/webhooks/id/test endpoint that returns the upstream response status and body to the caller. The...

MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)

Summary The default MLflow Tracking Server mlflow server, no authentication, default SQLite backend exposes the model-registry webhooks API unauthenticated, including a synchronous POST /api/2.0/mlflow/webhooks/id/test endpoint that returns the upstream response status and body to the caller. The...