Ubuntu patches multiple Linux kernel (Azure) flaws across ARM64, Bluetooth, Netfilter, NTFS3, SMB and other subsystems.
Ubuntu security notice USN-8761-1 corrects several security issues in the Linux kernel for Azure, spanning ARM32, ARM64, and PowerPC architectures plus subsystems including Bluetooth, Netfilter, EFI core, GPU drivers, InfiniBand, SCSI, NTFS3, and SMB. An attacker could possibly use these flaws to compromise the system.
Canonical issues USN-8760-1 patching multiple Linux kernel (NVIDIA) vulnerabilities across numerous subsystems and CPU architectures.
Canonical published USN-8760-1 to correct several Linux kernel (NVIDIA) vulnerabilities that an attacker could possibly use to compromise the system. The update fixes flaws spanning UAPI, the kernel build system, ARM32, ARM64, RISC-V, S390, and x86 architectures. Patched subsystems also include the block layer, cryptographic API, Compute Acceleration Framework, Intel NPU driver, ACPI and Bluetooth drivers, and the hardware random number generator core.
A Metasploit Framework commit adds a DefangedMode advanced option to an exploit module that modifies the target host configuration.
The commit introduces a DefangedMode advanced option so that the exploit's modification of the target configuration runs only explicitly, making the behavior visible to the user. No target product, affected software, or CVE identifier is named in the commit message.
A public proof-of-concept demonstrates remote code execution in Marimo 0.20.4, the open-source Python notebook framework.
Exploit-DB lists a remote code execution proof of concept affecting Marimo version 0.20.4. Marimo is an open-source reactive Python notebook tool used by developers. The listing does not reference a CVE id or observed in-the-wild exploitation.
A public proof-of-concept denial-of-service exploit has been published for the EVerest 2025.9.0 open-source EV charging framework.
Exploit-DB lists a denial-of-service proof of concept targeting EVerest version 2025.9.0. EVerest is an open-source software framework used for EV charging infrastructure. No in-the-wild exploitation or CVE mapping is stated in the listing.
Apache NiFi 2.11.0 Connector Migration REST APIs authorize only against the target Connector, skipping Process Group access checks (CVE-2026-86089, Low).
Apache NiFi 2.11.0 supports migrating version-controlled Process Group contents into a Connector via REST API methods that list eligible migration sources and submit migration requests. Both methods were authorized only against the target Connector, without evaluating user access to the involved Process Groups. The flaw, tracked as CVE-2026-86089, is rated Low severity and affects the nifi-web-api component.
Jenkins released a security advisory patching vulnerabilities across 13 plugins, including GitLab, Bitbucket, Gradle, Keycloak Authentication, and Script Security.
The Jenkins security advisory dated September 16, 2026 addresses vulnerabilities in 13 plugins: Bitbucket Push and Pull Request, Bitbucket Server Integration, Coverage, Gitee, GitLab, Gradle, Keycloak Authentication, OWASP Dependency-Check, Pipeline: Groovy Libraries, Pipeline: Multibranch, Robot Framework, Script Security, and Warnings. Jenkins users should update the affected plugins to the patched versions listed in the advisory.