CLSA-2026-1786365627 TuxCare security update for webpack-dev-server (2 CVEs)

TuxCare rebuilt webpack-dev-server to address 2 CVEs. Fixed in 4.15.1-tuxcare.4...

EUVD-2026-55457

In the Linux kernel, the following vulnerability has been resolved: watchdog: airoha: Prevent division by zero when clock frequency is zero clkgetrate can return 0 when the clock provider is not properly configured or the clock is unmanaged. The driver uses wdtfreq as a divisor directly in...

CVE-2026-68280

The CVE affects the Linux kernel DRM/Bridge code for cdns-dsi. The root cause is using the deprecated UNIVERSAL_DEV_PM_OPS() macro, which handles both runtime PM and system sleep, causing DSI clocks to be disabled twice (runtime suspend and system suspend). This can trigger a WARN from the clock ...

CVE-2026-68280 drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS()

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: cdns-dsi: Replace deprecated UNIVERSALDEVPMOPS The deprecated UNIVERSALDEVPMOPS macro uses the provided callbacks for both runtime PM and system sleep. This causes the DSI clocks to be disabled twice: once during...

CVE-2026-68175

The CVE-2026-68175 entry documents a fixed resource leak in the Linux kernel tracing subsystem (mmiotrace) related to trace_pipe close. Specifically, mmio_pipe_open() allocated a header_iter and took a pci_dev reference when trace_pipe opened; mmio_close() frees them but was not wired to the trac...

CVE-2026-68175 tracing: Fix resource leak on mmiotrace trace_pipe close

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix resource leak on mmiotrace tracepipe close The mmiotrace tracer was added May 12th 2008. At that time, resources created in pipeopen could not be freed because there was not pipeclose function pointer of the tracer...

Exploit for CVE-2026-14802

CVE-2026-14802 Name of the Vulnerable Software and Affected Ve...

PT-2026-69573

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ublk component where the system waits on ub-completion instead of ublk dev ready. Because ub-completion is only re-armed by a successful START USER RECOVERY, a ubl...

CVE-2026-68200: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: don't re-enter an instance callback that is still running The userspace-driven timer utimer TRIGGER ioctl calls sndtimerinterrupt directly with no serialization, so two threads triggering the same utimer can run...

PT-2026-80036

TuxCare rebuilt webpack-dev-server to address 2 CVEs. Fixed in 4.15.1-tuxcare.4...

PT-2026-69579

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the nsm dev ioctl function where the system jumps to a common output label even if the initial copy from user function fails before the nsm-lock mutex is acquired. Thi...

PT-2026-80037

TuxCare rebuilt webpack-dev-server to address 4 CVEs. Fixed in 3.11.3-tuxcare.4...

Malicious code in sme-rko-finance-front-payments-domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8fcad12c3078bf2134f5e3cafd7ffa0ecf9f2bfec919533881d5c65b738b9fa On require of the package, index.js loads./polyfill.js which assembles a set of C2 hostnames from split string fragments via.join'' — resolving to...

Malicious code in sme-rko-finance-front-payments-feed-display-list (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eedf1850bd0f58b8adef8a6b6c3ac13adf7848819306e5a7b9518cbb174911a3 On require of the package's main module, compat.js unconditionally downloads a platform-specific executable and runs it. Destination hosts are...

Nuxt dev server discloses project root and workspace UUID via the Chrome DevTools workspace endpoint

Impact When a Nuxt dev server is bound to a network-reachable interface for example nuxt dev --host for on-device testing, the default-enabled Chrome DevTools workspace endpoint GET /.well-known/appspecific/com.chrome.devtools.json returns the absolute project root workspace.root, i.e. rootDir an...

NPM: Nuxt dev server discloses project root and workspace UUID via the Chrome DevTools workspace endpoint

NPM: Nuxt dev server discloses project root and workspace UUID via the Chrome DevTools workspace endpoint vulnerability discovered by ? in WordPress Npm nuxt versions = 3.21.7, 3.21.10...

MAL-2026-13613 Malicious code in big-tss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 022f32d17f1b3fa4c33727aa2309fe4e75706c842ac04b25a48738fdb9aa3d2b [email protected] impersonates the popular big.js arbitrary-precision math library and ships upstream big.js source with an injected block at the top of...

Malicious code in dolyame-ui-progresscircle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 248909eca58bc4f747cced81acc6919e90204bf5f5e1b65417a9fe230dfa3f4d The package's main entry unconditionally loads ext.js, which on require/import downloads a platform-specific executable over HTTPS from hardcoded...

MAL-2026-13505 Malicious code in dolyame-ui-iconloaderhoc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 812cef02743987901661dc22ace6c19fee82977c4bb73b05ee046698ad603932 On require of the package's main entry, [email protected] executes two dropper paths that fetch platform-specific binaries from hardcod...

Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate Developer Edition

Summary Multiple vulnerabilities were addressed in IBM watsonx Orchestrate Developer Edition version 2.14.0 Vulnerability Details CVEID:CVE-2026-14620 DESCRIPTION: webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and...