● Live advisory feed
Security advisories from 24 sources — CISA, CERT-EU, NCSC-UK, BSI, CERT-FR, NCSC-NL, JPCERT/CC, JVN, HKCERT, the Canadian Cyber Centre, NVD, GitHub, Microsoft, Cisco, Fortinet, Palo Alto Networks and more — normalized, translated to English and flagged against the CISA KEV catalog. One global feed for CSIRTs, SOCs and defenders.
Multiple vulnerabilities have been discovered in the Red Hat Linux kernel. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation, and remote denial of service.
Multiple vulnerabilities have been discovered in the Ubuntu Linux kernel. Some of them allow an attacker to cause privilege escalation, a breach of data confidentiality, and a breach of data integrity.
Multiple vulnerabilities have been discovered in the SUSE Linux kernel. Some of them allow an attacker to cause a breach of data confidentiality, a breach of data integrity, and a bypass of security policies.
Multiple vulnerabilities have been discovered in Google Chrome. They allow an attacker to cause an unspecified security issue by the vendor.
Two vulnerabilities were discovered in Exim, a mail transport agent, which may result in privilege escalation for a local attacker. https://security-tracker.debian.org/tracker/DSA-6400-1
Multiple vulnerabilities have been discovered in Microsoft Edge. They allow an attacker to cause an unspecified security issue by the vendor.
Multiple vulnerabilities have been discovered in the Debian LTS Linux kernel. They allow an attacker to cause privilege escalation, a breach of data confidentiality, and a breach of data integrity.
Multiple vulnerabilities have been discovered in ESET products. They allow an attacker to cause privilege escalation.
A vulnerability has been discovered in NetApp ONTAP 9. It allows an attacker to cause a remote denial of service, a breach of data confidentiality, and a breach of data integrity.
Multiple vulnerabilities have been discovered in MongoDB. They allow an attacker to bypass security policies, cause a denial of service, and an unspecified security issue by the vendor.
Multiple vulnerabilities have been discovered in the Debian Linux kernel. They allow an attacker to cause privilege escalation, a breach of data confidentiality, and a breach of data integrity.
A vulnerability has been discovered in Moxa products. It allows an attacker to cause privilege escalation.
Multiple vulnerabilities have been discovered in IBM products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation, and remote denial of service.
Bulletin ID: 2026-065-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 07/23/2026 13:00 PM PDT Description: The AWS Bedrock AgentCore Python SDK (bedrock-agentcore) provides tools for building AI agents, including a Code Interpreter client that instal…
Summary JSON.dump(obj, io) and JSON::State#generate(obj, io) can write past the internal JSON generator buffer when a streamed object contains an attacker-controlled string near 16 KB. The issue is a heap out-of-bounds write in the IO-streaming path and is demonstrated as a reli…
Impact The JDBC spec defines the interface DataSource, with a method called getConnection(), and ConnectionPoolDataSource, with a method called getPooledConnection(). These methods are potentially dangerous. One way or another they trigger calls into JDBC drivers, which themselv…
This is a follow up to CVE-2025-68470. React Router was alerted to certain scenarios in which the fix there was incomplete so there still existed some scenarios where attacker supplied paths passed to navigation mechanisms could result in unexpected external navigations.
Applications with open redirects could permit attacker crafted links to result in redirects to unexpected external location or XSS vectors.
This is a follow up to https://github.com/remix-run/react-router/security/advisories/GHSA-8646-j5j9-6r62. React Router was alerted of a code path in the (unstable) RSC error handling path in which redirects from untrusted sources could still result in an XSS vector via attacker-s…
If application code allows attacker supplied input to overwrite certain aspects of errors caught by the SSR process, then it was possible for attacker to trigger unexpected constructor execution on the client which would trigger outbound network traffic. This is only possible wit…
In the MNG decoder there is a possible heap information disclosure because part of the pixels are left unchanged.
Impact Remotely triggerable DoS in find-my-way when it is used with Node's HTTP/2 server. The short version is that lookup() passes req.method into find(), and find() indexes this.trees[method]. Since this.trees is a normal object, HTTP/2 method values like constructor, toString…
Bulletin ID: 2026-064-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 07/23/2026 11:30 AM PDT Description: Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering t…
It was discovered that libinput did not properly escape device properties. A local attacker could possibly use this issue to inject arbitrary udev properties and execute arbitrary code as root.
Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page with a not terminated inline image, as done when extracting the page text for example. It only affects the ASCII85 and ASCIIHex filt…
Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page with a not terminated inline image, as done when extracting the page text for example. Patches This has been fixed in pypdf==6.14.…
Bulletin ID: 2026-063-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 07/23/2026 08:30 AM PDT Description: The AWS API MCP Server (awslabs.aws-api-mcp-server) is an open-source MCP server that lets AI assistants execute AWS CLI commands against a use…
Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with repeated malformed cross-reference streams. Patches This has been fixed in pypdf==6.14.0. Workarounds If you cannot upgrade yet, consider a…
Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires loading images where the declared size values are much too large compared to the actual data. Patches This has been fixed in pypdf==6.14.0. Workarounds If you cann…
Summary PostCSS's PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host proce…
Summary PhpSpreadsheet's OLE reader follows sector chains from attacker-controlled XLS/OLE metadata without detecting cycles or enforcing a maximum chain length. A tiny malformed .xls/OLE file can set the small-block depot sector chain to point back to itself. During normal XLS …
Summary PhpSpreadsheet's Gnumeric reader reads attacker-supplied .gnumeric files into memory and, when the file starts with gzip magic bytes, calls gzdecode() on the full compressed contents without enforcing a decompressed-size limit. A very small compressed .gnumeric file can …
Summary The domain whitelist introduced in PhpSpreadsheet 5.4.0 for the WEBSERVICE() formula function can be bypassed via HTTP redirect. The whitelist validates only the initial URL's hostname, but file_get_contents() follows 302/301 redirects by default without re-validating th…
Impact next-auth (Auth.js) v5 applications that gate access by checking only for the existence of the auth object — the pattern shown in the official session management / protecting resources guide — are affected. When the Auth.js configuration produces a server-side error, the…
It was discovered that PAM had a timing discrepancy in the pam_userdb module when comparing plaintext passwords. An attacker could possibly use this issue to obtain sensitive information by measuring response-timing differences during repeated authentication attempts.
Summary The exported getToken() helper (next-auth/jwt and @auth/core/jwt) can throw an uncaught exception when it reads a malformed Authorization: Bearer … header. When no session cookie is present, getToken() URL-decodes the bearer value before validating it, and malformed perc…
Naoki Wakamatsu discovered that libXpm did not properly validate file boundaries when processing XPM image files. An attacker could possibly use this issue to cause libXpm to crash, resulting in a denial of service.
Summary The default email-address normalizer used by the email/magic-link sign-in flow validates the address before applying Unicode normalization. An address can contain a Unicode character that is not an ASCII @ (U+0040) but canonicalizes to one under NFKC/NFKD normalization (…
Serial number: AV26-739 Date: July 23, 2026 On July 23, 2026, JetBrains published security advisories to address vulnerabilities in the following products: JetBrains GoLand - versions prior to 2026.2 JetBrains IntelliJ IDEA - version prior to 2026.2 JetBrains PhpStorm - version p…
Summary Auth.js stores the OAuth/OIDC anti-CSRF checks (state, nonce, and the PKCE verifier) in global cookies that are not bound to the provider that created them. On callback, a check value minted during a sign-in started with one provider can satisfy the callback for a differ…
It was discovered that HTTP-Date incorrectly handled parsing certain date strings. An attacker could possibly use this issue to cause HTTP-Date to use excessive resources, leading to a denial of service.
It was discovered that rsyslog incorrectly handled regex-based TCP framing in the imptcp module. A remote attacker could possibly use this issue to cause rsyslog to crash, resulting in a denial of service. It was discovered that rsyslog incorrectly handled oversized RFC5424 struc…
Serial number: AV26–698 Date: July 14, 2026 Updated: July 23, 2026 On July 14, 2026, Microsoft published security advisories to address vulnerabilities in multiple products. Included were critical updates for the following products: .NET 10.0 installed on Linux .NET 10.0 installe…
Serial number: AV26-735 Date: July 22, 2026 Updated: July 23, 2026 On July 22, 2026, Check Point published a security advisory to address vulnerabilities in the following products. Included was a critical update for the following : Security Management, Multi-Domain Management – m…
View CSAF Summary Successful exploitation of this vulnerability could allow an authenticated attacker to write arbitrary files to restricted system directories outside of the application's intended directory. The following versions of Rockwell Automation ThinManager are affected:…
Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite Executive summary A group of Russian state-supported cyber actors has been targeting and compromising various Western government and commercial organizations using the Zim…
GCHQ’s National Cyber Security Centre and international partners issue warning as ‘LAUNDRY BEAR’ cyber threat group exposed for targeted phishing campaign
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker with access to the IT network to manipulate industrial control devices without requiring physical access, specialized insider knowledge, or advanced tooling. The following versions of Pandu…
View CSAF Summary Successful exploitation of this vulnerability could result in an attacker obtaining confidential information from the device. The following versions of Johnson Controls XAAP Android are affected: XAAP Android <1.53 CVSS Vendor Equipment Vulnerabilities v3 3.3 Jo…
View CSAF Summary Successful exploitation of this vulnerability could cause the parsing process to crash, which will cause a denial of service. The following versions of MZ Automation lib60870 are affected: lib60870 <=2.4.0 CVSS Vendor Equipment Vulnerabilities v3 8.2 MZ Automati…