PT-2026-61459

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Two race conditions exist in the ksmbd durable scavenger function when interacting with walkers that iterate f ci-m fp list, such as ksmbd lookup fd inode used by ksmbd vfs rename and...

PT-2026-61128

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the f2fs file system within the destroy extent node function. When the FI NO EXTENT inode flag is set, the system fails to reset the length of the largest extent to 0...

PT-2026-61413

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the batman-adv module. The batadv mcast purge orig function removes entries from RCU-protected hlists without waiting for an RCU grace period. This allow...

PT-2026-61070

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An inconsistency in the f2fs file system occurs during fsck operations due to the incorrect usage of nat entry flags. The function f2fs need dentry mark reads these flags without mutual...

PT-2026-61478

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the icssm prueth probe function within the net: ti: icssm-prueth component. The issue arises when of property read u32 fails, causing the function to return witho...

[SECURITY] Fedora 43 Update: node-exporter-1.12.1-1.fc43

Prometheus exporter for hardware and OS metrics exposed by NIX kernels, writ ten in Go with pluggable metric collectors...

Fedora 43 : node-exporter (2026-5924722657)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-5924722657 advisory. Update to 1.12.1 ---- Update to 1.12.0 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has...

MAL-2026-10772 Malicious code in axios-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0d01cf6414d6896b4f60ac6e2ecc238d33c049b6f6f5add44bd7700de32a906 The package presents itself as a drop-in replacement for axios identical name shape, README, and API but adds a top-level import of a separate npm...

CVE-2026-54496 Missing copy constraint in halo2_gadgets variable-base scalar multiplication allows under-constrained base, breaking Orchard Action circuit soundness

ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad 5.0.0, halo2gadgets 0.5.0, orchard 0.14.0, zcashprimitives 0.28.0, and zcashd 6.20.0, the variable-base scalar multiplication gadget in halo2gadgets/src/ecc/chip/mul/incomplete.rs used assignadvice for the base point without a copy...

CVE-2026-54496

ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad 5.0.0, halo2gadgets 0.5.0, orchard 0.14.0, zcashprimitives 0.28.0, and zcashd 6.20.0, the variable-base scalar multiplication gadget in halo2gadgets/src/ecc/chip/mul/incomplete.rs used assignadvice for the base point without a copy...

CVE-2026-63098 TheHive 4.1.24 Unauthenticated Information Disclosure via /api/status Endpoint

TheHive through 4.1.24 contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve sensitive configuration data by sending a GET request to the /api/status endpoint, which lacks authentication enforcement in the StatusCtrl.scala handler...

CVE-2026-63098

TheHive through 4.1.24 contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve sensitive configuration data by sending a GET request to the /api/status endpoint, which lacks authentication enforcement in the StatusCtrl.scala handler...

CVE-2026-63098

The Hive 4.1.24 has an unauthenticated information-disclosure flaw exposed via GET /api/status (StatusCtrl.scala), enabling attackers without credentials to read sensitive configuration data. Affected items include the datastore attachment protection password, configured authentication providers,...

MAL-2026-10775 Malicious code in n8n-nodes-devops-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 464fa8baaffef716b3920968d35dfbf6c8d49cd439ad5c5bd45050074436d79b Package masquerades as an n8n community node package.json declares n8n.nodes: "MyNode.js", a trivial placeholder while index.js contains an unrelated...

Malicious code in n8n-nodes-probe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9d1aeabd688ffe2fdb4206f6fc715413358a40ec3203ad213dc37bb123eaf62 The package advertises itself as an n8n community-node utility but its main entry index.js executes a recon routine at module load. On require, it...

MAL-2026-10777 Malicious code in n8n-nodes-probe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9d1aeabd688ffe2fdb4206f6fc715413358a40ec3203ad213dc37bb123eaf62 The package advertises itself as an n8n community-node utility but its main entry index.js executes a recon routine at module load. On require, it...

Malicious code in easyway2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fcfc1bc035f5239e384f9e32be4fc53cdffe065920da7c6181e42757d6b41195 On npm install, the package's postinstall hook executes index.js, which POSTs the installer's full process.env, OS username, and current working...

MAL-2026-10769 Malicious code in easyway2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fcfc1bc035f5239e384f9e32be4fc53cdffe065920da7c6181e42757d6b41195 On npm install, the package's postinstall hook executes index.js, which POSTs the installer's full process.env, OS username, and current working...

Malicious code in n8n-nodes-api-finder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9bf8daf2e1d5bbbd97f3f8e6a31787ac5cd44c7d7f52c0228210bc0a8a7ed89c Package advertises itself as an n8n community node package.json declares an n8n node MyNode.js, a benign 'API Finder' shim, but package.json main...

CVE-2026-62228

OpenClaw before 2026.6.5 contain an authorization bypass vulnerability in node exec approvals that allows lower-trust callers to execute actions beyond their intended authorization by using different gateway and node environments. Attackers can exploit mismatched environment configurations to...