Linux Distros Unpatched Vulnerability : CVE-2026-68388

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb/client: handle overlapping allocated ranges in fallocate smb3simplefallocaterange can skip holes when an allocated range returned by the server starts befor...

Linux Distros Unpatched Vulnerability : CVE-2026-68165

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mm/damon/core: validate ranges in damonsetregions DAMON core logic assumes zero length regions don't exist. However, a few DAMON API callers including DAMONSYSF...

Linux Distros Unpatched Vulnerability : CVE-2026-68254

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/i915/vrr: require valid min/max vfreq for VRR Ensure the EDID provided min/max vfreq are valid. Most scenarios are already covered by coincidence through th...

Linux Distros Unpatched Vulnerability : CVE-2026-68106

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdgpu: fix division by zero with invalid uvd dimensions When width or height is less than 16, widthinmb or heightinmb becomes 0, leading to fsinmb being 0...

Linux Distros Unpatched Vulnerability : CVE-2026-68297

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tipc: fix u16 MTU truncation in media and bearer MTU validation Both TIPCNLMEDIASET and TIPCNLBEARERSET accept user-supplied MTU values but only enforce a minim...

Linux Distros Unpatched Vulnerability : CVE-2026-68164

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mm/damon/core: disallow overlapping input ranges for damonsetregions damonsetregions assumes the input ranges are sorted by the address and don't overlap each...

EUVD-2026-54909

A weakness has been identified in anubissbe ProjectHub-Mcp up to 5.0.0. This affects an unknown function of the file backend-fix/completebackend.js of the component Webhooks API. This manipulation of the argument url causes server-side request forgery. Remote exploitation of the attack is possibl...

DEBIAN-CVE-2026-17510

Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in printattribute via a zero length BMPSTRING attribute. printattribute sizes the destination buffer for a BMPSTRING attribute from its declared byte length with Renewattribute, length, char. A zero length...

CVE-2026-17510 Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in print_attribute via a zero length BMPSTRING attribute

Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in printattribute via a zero length BMPSTRING attribute. printattribute sizes the destination buffer for a BMPSTRING attribute from its declared byte length with Renewattribute, length, char. A zero length...

CVE-2026-17510

CVE-2026-17510 affects Crypt::OpenSSL::PKCS12 for Perl prior to 1.98. The vulnerability is a NULL pointer dereference in print_attribute when processing a zero-length BMPSTRING attribute in PKCS#12 data, potentially crashing any process that ingests an untrusted PKCS#12 via info_as_hash(). The is...

EUVD-2026-54850

Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in printattribute via a zero length BMPSTRING attribute. printattribute sizes the destination buffer for a BMPSTRING attribute from its declared byte length with Renewattribute, length, char. A zero length...

CVE-2026-17510

Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in printattribute via a zero length BMPSTRING attribute. printattribute sizes the destination buffer for a BMPSTRING attribute from its declared byte length with Renewattribute, length, char. A zero length...

EUVD-2026-54259

CTI-Transmute contains a stored cross-site scripting vulnerability caused by insufficient neutralization of Vue template expression delimiters in server-rendered user-controlled data. An unauthenticated attacker can create a public conversion whose name or description contains a malicious Vue...

Not an A11y: How Android Accessibility Exposes Mobile AI Agents to Indirect Prompt Injection

The rise of autonomous AI agents represents a major paradigm shift in how users interact with mobile devices. Frameworks such as MobileRun and Mobile-Use can autonomously navigate Android applications and execute complex multi-step tasks. To interpret user interfaces, these frameworks rely...

Linux Distros Unpatched Vulnerability : CVE-2026-17510

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in printattribute via a zero length BMPSTRING attribute. printattribute...

Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication

Metabase has warned that a maximum-severity security flaw impacting its business intelligence and data visualization software package has been exploited in the wild as a zero-day. The vulnerability CVSS score: 10.0, which does not carry a CVE identifier, allows an unauthenticated remote attacker ...

N-able Issues N-central Hotfix 2 as Attackers Reach Managed Systems and Persist

N-able has released a fresh round of hotfixes for N‑central as part of its investigation into ongoing exploitation of a recently disclosed security flaw in the Remote Monitoring and Management RMM product. "We are proactively expanding protections in response to ongoing monitoring of threat actor...

CVE-2026-16282

The Appointment Hour Booking WordPress plugin before 1.5.88 does not validate a client-supplied booking price against the server-side configured service price, allowing unauthenticated users to submit an arbitrary final price including zero or negative that is stored as the authoritative booking...

CVE-2026-33817

Index out-of-range when encountering a branch page with zero elements in go.etcd.io/bbolt Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to...

EulerOS 2.0 SP11 : python-pillow (EulerOS-SA-2026-3147)

According to the versions of the python-pillow packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the...