CVE-2026-64178 Bluetooth: bnep: Fix UAF read of dev->name

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: Fix UAF read of dev-name bnepaddconnection needs to keep holding the bnepsessionsem while reading dev-name just like bnepgetconnlist does; otherwise the bnepsession thread can concurrently free the netdevice, whi...

CVE-2026-64162 idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init()

In the Linux kernel, the following vulnerability has been resolved: idpf: fix readdevclklock spinlock init in idpfptpinit In idpfptpinit, readdevclklock is initialized after ptpscheduleworker had already been called and after idpfptpsettime64 could reach the lock. The PTP aux worker fires...

CVE-2026-64048 net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot

In the Linux kernel, the following vulnerability has been resolved: net/smc: reject CHID-0 ACCEPT that matches an empty ismdev slot On the SMC-D client, slot 0 of ini-ismdev/ini-ismchid is reserved for an SMC-Dv1 device. smcfindismv2deviceclnt populates V2 entries starting at index 1, so when no ...

EUVD-2026-45455

In the Linux kernel, the following vulnerability has been resolved: i2c: core: fix adapter registration race Adapters can be looked up based on their id using i2cgetadapter which takes a reference to the embedded struct device. Make sure that the adapter including its struct device has been...

Linux Distros Unpatched Vulnerability : CVE-2026-53400

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - i2c: core: fix adapter registration race Adapters can be looked up based on their id using i2cgetadapter which takes a reference to the embedded struct device...

CVE-2026-16223: Server-Side Request Forgery (SSRF)

A vulnerability was determined in 1Panel-dev CordysCRM up to 1.4.1. Impacted is the function getSqlBotSrc of the file backend/crm/src/main/java/cn/cordys/crm/system/service/IntegrationConfigService.java of the component Third Party Edit Endpoint. Executing a manipulation of the argument appSecret...

CVE-2026-16222: Server-Side Request Forgery (SSRF)

A vulnerability was found in 1Panel-dev CordysCRM up to 1.4.1. This issue affects some unknown processing of the file backend/crm/src/main/java/cn/cordys/crm/integration/sso/service/TokenService.java of the component Third Party Endpoint. Performing a manipulation of the argument mkAddress result...

CVE-2026-16088 halo-dev halo Files Backup Endpoint MigrationEndpoint.java download path traversal

A vulnerability was detected in halo-dev halo up to 2.24.2. Affected by this vulnerability is the function Download of the file MigrationEndpoint.java of the component Files Backup Endpoint. Performing a manipulation results in path traversal. The attack is possible to be carried out remotely. Th...

CVE-2026-16088

Summary : CVE-2026-16088 affects halo-dev halo up to version 2.24.2. The vulnerability targets the Download function in MigrationEndpoint.java within the Files Backup Endpoint, where input manipulation enables path traversal. This allows remote exploitation, and public exploits have surfaced. Det...

CVE-2026-16088 halo-dev halo Files Backup Endpoint MigrationEndpoint.java download path traversal

A vulnerability was detected in halo-dev halo up to 2.24.2. Affected by this vulnerability is the function Download of the file MigrationEndpoint.java of the component Files Backup Endpoint. Performing a manipulation results in path traversal. The attack is possible to be carried out remotely. Th...

Malicious Package

Overview dev-helper-bg is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

PT-2026-60931

Name of the Vulnerable Software and Affected Versions halo-dev halo versions prior to 2.24.3 Description A path traversal issue exists in the Files Backup Endpoint component within the Download function of the MigrationEndpoint.java file. This flaw allows a remote attacker to perform manipulation...

CVE-2026-16088: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was detected in halo-dev halo up to 2.24.2. Affected by this vulnerability is the function Download of the file MigrationEndpoint.java of the component Files Backup Endpoint. Performing a manipulation results in path traversal. The attack is possible to be carried out remotely. Th...

Malicious code in vanexa-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ea182e48a895e218d345ca6308727223e54eb285d9af44a167b6b115ba1a907 When the user runs vanexa-agent start, the daemon opens a persistent WebSocket to a hardcoded Cloudflare Workers relay at...

database-factory (>=1.0.5, <=1.0.6), mage-ai (>=0.1.0, <=0.2.8) +1 more potentially affected by CVE-2026-15925 via snowflake-connector-python (2.7.9)

snowflake-connector-python PYPI version 2.7.9 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - database-factory =1.0.5, =0.1.0, =1.4.0, =2.0.4 Source cves: CVE-2026-15925 Source advisory:...

apache-airflow-providers-snowflake (>=2.4.0rc1, <=2.5.1), rcd-dev-kit (>=0.0.11, <=1.1.0) potentially affected by CVE-2026-15925 via snowflake-connector-python (2.7.1)

snowflake-connector-python PYPI version 2.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - apache-airflow-providers-snowflake =2.4.0rc1, =0.0.11, =1.1.0 Source cves: CVE-2026-15925 Source advisory:...

yt-dlp: File Downloader cookie leak with curl

SummaryIf curl is used an external downloader for yt-dlp, cookies may be leaked to an unintended host upon HTTP redirect or when the host for download fragments differs from their parent manifest's.This is the equivalent to GHSA-v8mc-9377-rwjj for the curl downloader. The vulnerable behavior is...

PYSEC-2026-2335 Aider is vulnerable to Code Injection via editor_coder.run function

A security flaw has been discovered in Aider-AI Aider 0.86.3.dev. Affected by this vulnerability is the function editorcoder.run of the file auth.py of the component Architect Mode. Performing a manipulation results in code injection. Remote exploitation of the attack is possible. The exploit has...

PYSEC-2026-2524 OpenStack Ironic: Pre-Validation Checksum Calculation allows Denial of Service (DoS) via Infinite Block Devices

In OpenStack Ironic through 35.x before a3f6d73, during image handling, an infinite loop in checksum calculations can occur via the file:///dev/zero URL...

notebooktoall (>=0.1.7, <=0.2.0), python-dev-tools (>=2019.2.25, <=2019.3.1) potentially affected by CVE-2026-6357 via pip (19.0.2)

pip PYPI version 19.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - notebooktoall =0.1.7, =2019.2.25, =2019.3.1 Source cves: CVE-2026-6357 Source advisory: OSV:PYSEC-2026-2876...