CVE-2026-74486

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: use exefiledenywriteaccess for the interpreter clone For MISCFMTOPENFILE entries loadmiscbinary clones the registered interpreter file and denies write access to the clone via plain denywriteaccess. The clone is...

CVE-2026-74486 binfmt_misc: use exe_file_deny_write_access() for the interpreter clone

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: use exefiledenywriteaccess for the interpreter clone For MISCFMTOPENFILE entries loadmiscbinary clones the registered interpreter file and denies write access to the clone via plain denywriteaccess. The clone is...

CVE-2026-74440

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Wait on external BO kernel fences in exec IOCTL Before arming a user job, xeexecioctl only added the VM's dma-resv KERNEL slot as a dependency. That slot covers rebinds and the kernel operations of the VM's private BOs, b...

CVE-2026-74440 drm/xe: Wait on external BO kernel fences in exec IOCTL

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Wait on external BO kernel fences in exec IOCTL Before arming a user job, xeexecioctl only added the VM's dma-resv KERNEL slot as a dependency. That slot covers rebinds and the kernel operations of the VM's private BOs, b...

CVE-2026-74440 drm/xe: Wait on external BO kernel fences in exec IOCTL

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Wait on external BO kernel fences in exec IOCTL Before arming a user job, xeexecioctl only added the VM's dma-resv KERNEL slot as a dependency. That slot covers rebinds and the kernel operations of the VM's private BOs, b...

CVE-2026-74440

Summary: CVE-2026-74440 affects Linux kernel DRM/XE, where a user job could race with kernel operations on external buffer objects (BOs) due to an incomplete dependency model. Root cause: during xe_exec_ioctl(), only the VM’s dma-resv KERNEL slot was added as a dependency, omitting external BOs (...

CVE-2026-74440: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Wait on external BO kernel fences in exec IOCTL Before arming a user job, xeexecioctl only added the VM's dma-resv KERNEL slot as a dependency. That slot covers rebinds and the kernel operations of the VM's private BOs, b...

Linux Distros Unpatched Vulnerability : CVE-2026-74440

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/xe: Wait on external BO kernel fences in exec IOCTL Before arming a user job, xeexecioctl only added the VM's dma-resv KERNEL slot as a dependency. That slo...

PT-2026-72892

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Wait on external BO kernel fences in exec IOCTL Before arming a user job, xe exec ioctl only added the VM's dma-resv KERNEL slot as a dependency. That slot covers rebinds and the kernel operations of the VM's private BOs,...

CVE-2026-73678

MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by submitting crafted prompts to the unprotected POST /api/v1/responses/ endpoint, which reaches the Anton agent...

CVE-2026-73678 MindsDB Minds Platform v26.1.0 Unauthenticated RCE via scratchpad exec()

MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by submitting crafted prompts to the unprotected POST /api/v1/responses/ endpoint, which reaches the Anton agent...

EUVD-2026-58787

MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by submitting crafted prompts to the unprotected POST /api/v1/responses/ endpoint, which reaches the Anton agent...

CVE-2026-73678

MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by submitting crafted prompts to the unprotected POST /api/v1/responses/ endpoint, which reaches the Anton agent...

CVE-2026-73678

CVE-2026-73678 enables unauthenticated remote code execution in MindsDB Minds Platform

CVE-2026-73678 MindsDB Minds Platform v26.1.0 Unauthenticated RCE via scratchpad exec()

MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by submitting crafted prompts to the unprotected POST /api/v1/responses/ endpoint, which reaches the Anton agent...

CVE-2026-73678: Improper Control of Generation of Code

MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by submitting crafted prompts to the unprotected POST /api/v1/responses/ endpoint, which reaches the Anton agent...

PT-2026-72088

Name of the Vulnerable Software and Affected Versions MindsDB Minds Platform versions prior to 26.1.1 Description An unauthenticated remote code execution flaw allows attackers to execute arbitrary OS commands. The issue occurs when crafted prompts are submitted to the unprotected 'POST...

CVE-2026-73841

OpenChoreo is a complete, open-source developer platform for Kubernetes. From 1.2.0-rc.1 until 1.2.0, internal/openchoreo-api/api/handlers/exec.go and internal/openchoreo-api/api/handlers/wirelogs.go authorize component:exec and wirelogs:view using the caller-supplied project query parameter...

CVE-2026-73841

OpenChoreo (Kubernetes platform) is affected by CVE-2026-73841 in versions 1.2.0-rc.1 through 1.2.0. The flaw lies in internal/openchoreo-api/api/handlers/exec.go and internal/openchoreo-api/api/handlers/wirelogs.go, which authorize component:exec and wirelogs:view using a caller-supplied project...

Malicious code in @jacksher/install-exec-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2551a4d2336e3a5279c44673c1a18dbcebc62268773ee324c8a8e7bb8828423 package.json declares postinstall: node beacon.js. On every npm install, beacon.js unconditionally performs a DNS lookup, an HTTPS GET to...