Our Analyses
What it means for your servers
The security stories that matter, explained by our team — with the concrete steps to take.
The security stories that matter, explained by our team — with the concrete steps to take.
Collected every two hours from specialised publications — each link leads to the original article.
Use after free of paging structures in EPT [XSA-480, CVE-2026-23554] Xenstored DoS by unprivileged domain [XSA-481, CVE-2026-23555]
Fix scope path boundary validation to deny sibling-prefix authorization bypasses Reject parent-directory traversal in scope paths, including encoded traversal …
Fix scope path boundary validation to deny sibling-prefix authorization bypasses Reject parent-directory traversal in scope paths, including encoded traversal …
Fix scope path boundary validation to deny sibling-prefix authorization bypasses Reject parent-directory traversal in scope paths, including encoded traversal …
Several vulnerabilities were discovered in libyaml-syck-perl, a Perl module providing a fast, lightweight YAML loader and dumper, which may result in denial of…
Jul Blobul discovered that SPIP, a website engine for publishing, is prone to a privilege escalation vulnerability. For the stable distribution (trixie), this …
Update to 146.0.7680.80 * CVE-2026-3909: Out of bounds write in Ski
Remove legacy parent SciToken chaining behavior from token initialization and claim handling Harden Enforcer scope path traversal validation (including encoded…
Update to 5.12.0. This release updates the license field in the Python metadata and fixes a buffer overflow/infinite loop from indent handling.
Remove legacy parent SciToken chaining behavior from token initialization and claim handling Harden Enforcer scope path traversal validation (including encoded…
Update to 5.12.0. This release updates the license field in the Python metadata and fixes a buffer overflow/infinite loop from indent handling.
CVE-2026-3497: Fix information disclosure or denial of service due to uninitialized variables in gssapi-keyex
Louis Moureaux discovered that incorrect packet processing in the game server of Freeciv, a free clone of the turn based strategy game Civilization, could resu…
An update that solves one vulnerability can now be installed.
An update that solves one vulnerability can now be installed.
The following vulnerabilities have been discovered in the WebKitGTK web engine: CVE-2025-43214 shandikri discovered that processing maliciously crafted web con…
CVE-2026-3497: Fix information disclosure or denial of service due to uninitialized variables in gssapi-keyex
Upstream announcements: WordPress 6.9.2 Release WordPress 6.9.3 and 7.0 beta 4 WordPress 6.9.4 Release
Update to 1.73.3; Fixes: RHBZ#2426392, RHBZ#2415186
Update to 0.37.1 (rbhz#2445943) Fixes Denial of Service via malformed Content-Length header (CVE-2026-31870 Reenables 32-bit build Update to 0.37.0 (rhbz#24416…
Add patch for CVE-2026-1539 (Also remove Proxy-Authorization header on cross origin redirect)
Add patch for CVE-2026-0988 (Integer overflow in g_buffered_input_stream_peek() leads to segmentation fault)
Upstream announcements: WordPress 6.9.2 Release WordPress 6.9.3 and 7.0 beta 4 WordPress 6.9.4 Release
Update to 1.73.3; Fixes: RHBZ#2426392, RHBZ#2415186
