MGASA-2026-0349 Updated python-hpack packages fix a security vulnerability

An issue was found in the python-hyper/hpack library, most commonly used as a downstream dependency of the python-hyper/h2 library an HTTP/2 client and server implementation. Unbounded variable integer decoding can cause run-away computation on malformed input leading to On^2 runtime, effectively...

MAL-2026-15633 Malicious code in spc-grafeno-login (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01c074fc169a09169385a53a74ea0bc928f45bf20d40621d7c4b4657e28c01f2 The package's preinstall.js lifecycle script auto-executes on npm install and performs two attacker-benefiting actions against the installer. First, ...

SUSE CVE-2026-72150

In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix uninitialized xprtcreateargs structure The xprtcreateargs structure is allocated on the stack without initialization in rpcsysfsxprtswitchaddxprtstore. While some fields are manually populated, critical fields like...

CVE-2026-80711

A flaw was found in the Linux kernel's power supply subsystem, specifically within the MAX17040 fuel gauge driver. When the MAX17040 fuel gauge operates without a registered charger status supplier, the driver fails to properly handle this missing information. This oversight can result in userspa...

PT-2026-89705

An issue was found in the python-hyper/hpack library, most commonly used as a downstream dependency of the python-hyper/h2 library an HTTP/2 client and server implementation. Unbounded variable integer decoding can cause run-away computation on malformed input leading to On^2 runtime, effectively...

Linux Distros Unpatched Vulnerability : CVE-2026-80645

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rapidio/tsi721: prevent a bad dereference in tsi721dbdpc With a listforeach loop, if we don't find the item we are looking for in the list, then the loop exits...

The vulnerability of the Dawn component in Google Chrome and Microsoft Edge web browsers allows a hacker to gain access to confidential data.

The vulnerability of the Dawn component in Google Chrome and Microsoft Edge is related to errors during initialization of variables. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...

The vulnerability of the Codecs components in Google Chrome and Microsoft Edge web browsers allows attackers to access confidential data.

The vulnerability of the Codecs components in Google Chrome and Microsoft Edge relates to errors during initialization of variables. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created video file...

The vulnerability of the Audio component in Google Chrome and Microsoft Edge web browsers allows a perpetrator to access confidential data.

The vulnerability of the Audio component in Google Chrome and Microsoft Edge relates to errors during initialization of variables. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...

The vulnerability of the Skia component in Google Chrome and Microsoft Edge web browsers allows attackers to access confidential data.

The vulnerability of the Skia component in Google Chrome and Microsoft Edge is related to errors during variable initialization. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...

The vulnerability of the ANGLE component in Google Chrome and Microsoft Edge web browsers allows attackers to access confidential data.

The vulnerability of the ANGLE component in Google Chrome and Microsoft Edge is related to errors during initialization of variables. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...

The vulnerability of the ANGLE component in Google Chrome and Microsoft Edge web browsers allows attackers to access confidential data.

The vulnerability of the ANGLE component in Google Chrome and Microsoft Edge is related to errors during initialization of variables. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...

The vulnerability of the Media component in Google Chrome and Microsoft Edge web browsers allows a hacker to gain access to confidential data.

The vulnerability of the Media component in Google Chrome and Microsoft Edge relates to errors during initialization of variables. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...

The vulnerability of the ANGLE component in Google Chrome and Microsoft Edge web browsers allows attackers to access confidential data.

The vulnerability of the ANGLE component in Google Chrome and Microsoft Edge is related to errors during initialization of variables. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-80648

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: pinctrl: spacemit: fix NULL check in spacemitpinsetconfig spacemitpinsetconfig looks up the...

OESA-2026-3501 dracut security update

dracut contains tools to create bootable initramfses for the Linux kernel. Unlike previous implementations, dracut hard-codes as little as possible into the initramfs. dracut contains various modules which are driven by the event-based udev. Having root on MD, DM, LVM2, LUKS is supported as well ...

Malicious code in eth-pino (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81e08c035ca41519f1d57d389027befac80a8ee8405612825b633967db5fb8c1 On require, lib/initializeCaller.js runs a top-level async IIFE that decodes a base64-obfuscated URL to...

Exploit for Argument Injection in Gnu Inetutils

Original source:https://github.com/K3ysTr0K3R/CVE-2026-24061...

SUSE CVE-2026-80648

In the Linux kernel, the following vulnerability has been resolved: pinctrl: spacemit: fix NULL check in spacemitpinsetconfig spacemitpinsetconfig looks up the per-pin descriptor with spacemitgetpin then checks the wrong variable for failure: const struct spacemitpin spin = spacemitgetpinpctrl,...

CVE-2026-82244

Budibase versions before 3.41.3 contain a remote code execution vulnerability in plugin handling that allows authenticated admin users to execute arbitrary code by uploading a malicious plugin tarball. The server calls eval on plugin JavaScript files without sandboxing in the main Node.js process...