Page Header

A libzypp plugin loading flaw (CVE-2026-44933) can make chroot to ‘/’ a no-op, allowing plugin paths to execute host binaries like /bin/bash with root privileges; reported 57 minutes ago.

MLflow 3.9.0’s Assistant /ajax-api improper origin validation lets a malicious webpage enable full access and execute arbitrary commands via the Claude Code sub-agent; fixed in 3.10.0, patch now.

Creartia’s ICMS has a critical authorisation bypass (CVE-2026-4320) that could let attackers manipulate HTTP redirect headers to gain unauthorised admin access; patch, isolate and audit immediately.