The vulnerability of the lpfc_sli4pci_mem_setup() function in the drivers/scsi/lpfc/lpfc_init.c file of the Linux operating system’s SCSI device driver module allows a hacker to cause a service failure.

The vulnerability of the lpfcsli4pcimemsetup function in the drivers/scsi/lpfc/lpfcinit.c file of the Linux SCSI device driver module is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a system failure...

MAL-2026-10993 Malicious code in torch-musa (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 dc7f99306afb7d31dab4c2ca32f2feb984bcdc505cf1dc6c3ee736cd21f9bcc9 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

CVE-2026-8152

CVE-2026-8152 affects Unblu Spark. The issue is an open redirect that can be escalated to a DOM-based XSS when deployed with com.unblu.identifier.siteEmbeddedSetup=true, causing injected JavaScript to run in the host app’s origin and gain access to cookies, DOM, and same-origin APIs. This expands...

CVE-2026-8152

Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting XSS attack. When Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the host application. Any JavaScript injected through this...

EUVD-2026-47656

Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting XSS attack. When Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the host application. Any JavaScript injected through this...

CVE-2026-8152 Unblu Spark Open Redirect leading to DOM-Based XSS

Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting XSS attack. When Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the host application. Any JavaScript injected through this...

CVE-2026-8152 Unblu Spark Open Redirect leading to DOM-Based XSS

Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting XSS attack. When Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the host application. Any JavaScript injected through this...

CVE-2026-64001

A flaw was found in the Linux kernel's ALSA Advanced Linux Sound Architecture PCM Pulse Code Modulation OSS Open Sound System component. A local user could exploit a Use-After-Free UAF vulnerability in the sndpcmossprocwrite function. This occurs when a setup entry is prematurely linked into the...

PT-2026-63394

Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting XSS attack. When Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the host application. Any JavaScript injected through this...

PT-2026-63367

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions 1.22.0 through 1.25.1 Description In DNS-over-QUIC DoQ environments, high concurrency and system pressure can trigger an assertion in the libngtcp2 library regarding monotonic timestamps. This occurs because Unbound...

Plone 4.3.x < 5.2.5 Multiple Vulnerabilities (HF 20210518)

The version of Plone installed on the remote host is 4.3.x prior to 5.2.5. It is, therefore, affected by the following vulnerabilities: - Plone CMS has a stored Cross-Site Scripting XSS vulnerability in the user fullname property and the file upload functionality. CVE-2021-3313 -...

SUSE CVE-2026-64001

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: oss: Fix setup list UAF on proc write error sndpcmossprocwrite links a newly allocated setup entry into the OSS setup list before duplicating the task name. If the task-name allocation fails, the error path frees the...

SUSE CVE-2026-64019

In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix dma mapping leak on data setup error We're leaking the initial DMA mapping during iteration if we fail to allocate the tracking descriptor for both PRP and SGL. Unmap the iterator directly; we can't use the existing...

SUSE CVE-2026-64144

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtk: fix urb-setuppacket leak in error paths The setuppacket of control urb is not freed if usbsubmiturb fails or the submitted urb is killed. Add free in these two paths...

SUSE CVE-2026-64168

In the Linux kernel, the following vulnerability has been resolved: spi: sprd: fix error pointer deref after DMA setup failure The driver falls back to PIO mode if DMA setup fails during probe. Make sure to check the dma.enabled flag before trying to release the DMA channels also on late probe...

SUSE CVE-2026-64169

In the Linux kernel, the following vulnerability has been resolved: spi: ep93xx: fix error pointer deref after DMA setup failure The driver falls back to PIO mode if DMA setup fails during probe. Make sure to the clear the DMA channel pointers on setup failure to avoid dereferencing an error...

CVE-2026-64169

A flaw was found in the Linux kernel's spi: ep93xx driver. This vulnerability occurs when the driver fails to properly clear Direct Memory Access DMA channel pointers after a DMA setup failure during probe. An attacker could potentially trigger a system crash, leading to a Denial of Service DoS...

Malicious code in faust-cont (npm)

The npm package faust-cont is a supply-chain dropper disguised as a benign CLI tool index.js is a decoy that only logs "cli tool install package loaded". The real behaviour is placed in an install script. An install lifecycle hook install: node install.js executes automatically on npm install,...

CVE-2026-53595

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the public endpoint POST /user-setup/hash/invitesentat OpenController@userSetupSave selects the target account solely by its invitehash column, then overwrites that account's email and...

EUVD-2026-46094

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the public endpoint POST /user-setup/hash/invitesentat OpenController@userSetupSave selects the target account solely by its invitehash column, then overwrites that account's email and...