CVE-2026-68175 tracing: Fix resource leak on mmiotrace trace_pipe close

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix resource leak on mmiotrace tracepipe close The mmiotrace tracer was added May 12th 2008. At that time, resources created in pipeopen could not be freed because there was not pipeclose function pointer of the tracer...

Exploit for CVE-2026-14802

CVE-2026-14802 Name of the Vulnerable Software and Affected Ve...

PT-2026-69573

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ublk component where the system waits on ub-completion instead of ublk dev ready. Because ub-completion is only re-armed by a successful START USER RECOVERY, a ubl...

PT-2026-80036

TuxCare rebuilt webpack-dev-server to address 2 CVEs. Fixed in 4.15.1-tuxcare.4...

CVE-2026-68200: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: don't re-enter an instance callback that is still running The userspace-driven timer utimer TRIGGER ioctl calls sndtimerinterrupt directly with no serialization, so two threads triggering the same utimer can run...

PT-2026-69579

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the nsm dev ioctl function where the system jumps to a common output label even if the initial copy from user function fails before the nsm-lock mutex is acquired. Thi...

PT-2026-80037

TuxCare rebuilt webpack-dev-server to address 4 CVEs. Fixed in 3.11.3-tuxcare.4...

Malicious code in sme-rko-finance-front-payments-domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8fcad12c3078bf2134f5e3cafd7ffa0ecf9f2bfec919533881d5c65b738b9fa On require of the package, index.js loads./polyfill.js which assembles a set of C2 hostnames from split string fragments via.join'' — resolving to...

Malicious code in sme-rko-finance-front-payments-feed-display-list (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eedf1850bd0f58b8adef8a6b6c3ac13adf7848819306e5a7b9518cbb174911a3 On require of the package's main module, compat.js unconditionally downloads a platform-specific executable and runs it. Destination hosts are...

Nuxt dev server discloses project root and workspace UUID via the Chrome DevTools workspace endpoint

Impact When a Nuxt dev server is bound to a network-reachable interface for example nuxt dev --host for on-device testing, the default-enabled Chrome DevTools workspace endpoint GET /.well-known/appspecific/com.chrome.devtools.json returns the absolute project root workspace.root, i.e. rootDir an...

NPM: Nuxt dev server discloses project root and workspace UUID via the Chrome DevTools workspace endpoint

NPM: Nuxt dev server discloses project root and workspace UUID via the Chrome DevTools workspace endpoint vulnerability discovered by ? in WordPress Npm nuxt versions = 3.21.7, 3.21.10...

MAL-2026-13613 Malicious code in big-tss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 022f32d17f1b3fa4c33727aa2309fe4e75706c842ac04b25a48738fdb9aa3d2b [email protected] impersonates the popular big.js arbitrary-precision math library and ships upstream big.js source with an injected block at the top of...

Malicious code in dolyame-ui-progresscircle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 248909eca58bc4f747cced81acc6919e90204bf5f5e1b65417a9fe230dfa3f4d The package's main entry unconditionally loads ext.js, which on require/import downloads a platform-specific executable over HTTPS from hardcoded...

MAL-2026-13505 Malicious code in dolyame-ui-iconloaderhoc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 812cef02743987901661dc22ace6c19fee82977c4bb73b05ee046698ad603932 On require of the package's main entry, [email protected] executes two dropper paths that fetch platform-specific binaries from hardcod...

Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate Developer Edition

Summary Multiple vulnerabilities were addressed in IBM watsonx Orchestrate Developer Edition version 2.14.0 Vulnerability Details CVEID:CVE-2026-14620 DESCRIPTION: webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and...

PT-2026-75941

Impact When a Nuxt dev server is bound to a network-reachable interface for example nuxt dev --host for on-device testing, the default-enabled Chrome DevTools workspace endpoint GET /.well-known/appspecific/com.chrome.devtools.json returns the absolute project root workspace.root, i.e. rootDir an...

WordPress WPMU DEV Dashboard plugin <= 5.0.0 - Authentication Bypass to Arbitrary plugin Installation (Remote Code Execution) vulnerability

Authentication Bypass to Arbitrary plugin Installation Remote Code Execution vulnerability discovered by Austin Ginder in WordPress Plugin WPMU DEV Dashboard versions = 5.0.0...

CVE-2026-15459

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.0. On sites not yet connected to the WPMU DEV Hub — the default state after installation — the site API key that keys the WDP-AUTH request signature is empty, making the...

CVE-2026-15459

The CVE-2026-15459 entry concerns the WordPress WPMU DEV Dashboard plugin (≤ 5.0.0). Public details show an authentication bypass allowing unauthenticated attackers to perform privileged Hub actions, including installing/activating plugins from attacker URLs (remote code execution), deleting plug...

CVE-2026-15459

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.0. On sites not yet connected to the WPMU DEV Hub — the default state after installation — the site API key that keys the WDP-AUTH request signature is empty, making the...