Malicious code in @beloved-lenora/opencode-stats (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 84f3316cd114c1dae8ec5b0470fc9f16297c74c495b645085103a553002e825e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: gve: Fixed corruption in the stats report when the number of queues changes. The driver and the Network Interface Card NIC share a memory region for stats reporting. The NIC calculates its offset within this region based on the...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: net/mlx5e: Fixed the issue where zero-sized buffers were allocated for HV VHCA statistics. The function mlx5ehvvhcastatscreate is called from mlx5enicenable, before mlx5eopen. At that point, priv-statsnch remains zero, because...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: md/md-bitmap: Synchronized bitmapgetstats with the lifetime of the bitmap. After the commit with code ec6bb299c7c3 “md/md-bitmap: added ‘syncsize’ to struct mdbitmapstats”, a panic is reported: Oops: General Protection Fault,...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: dm-stats: A crash occurs if the allocation of per-cpu data fails. If dmkvzallocpercpuallocsize, cputonodecpu fails, the code jumps to the “out” label and calls dmstatfree. dmstatfree executes foreachpossiblecpucpu...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fixed the issue with mlx5ibgethwstats when used for devices. Currently, when mlx5ibgethwstats is used for a device where portnum = 0, there is a special handling to ensure that the correct counters are used. However,...

USN-8924-1 linux vulnerabilities

It was discovered that the timer stats implementation in the Linux kernel allowed the discovery of a real PID value while inside a PID namespace. A local attacker could use this to expose sensitive information. CVE-2017-5967 Wen Xu discovered that the XFS file system implementation in the Linux...

CVE-2026-108749

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-108749 docling-serve 1.14.0 through 1.36.0 Missing Authentication via Memory Management Endpoints

docling-serve 1.14.0 through 1.36.0 contains a missing authentication vulnerability that allows unauthenticated attackers to access /v1/memory/stats and /v1/memory/counts because they omit the requireauth dependency. Attackers can bypass the configured DOCLINGSERVEAPIKEY to read process and cgrou...

CVE-2026-108749

...

EUVD-2026-96914

docling-serve 1.14.0 through 1.36.0 contains a missing authentication vulnerability that allows unauthenticated attackers to access /v1/memory/stats and /v1/memory/counts because they omit the requireauth dependency. Attackers can bypass the configured DOCLINGSERVEAPIKEY to read process and cgrou...

CVE-2026-108749

A missing authentication vulnerability in docling-serve versions 1.14.0 through 1.36.0 allows unauthenticated remote attackers to access the /v1/memory/stats and /v1/memory/counts endpoints. The root cause is the omission of the require_auth dependency, enabling attackers to bypass the DOCLING_SE...

CVE-2026-108749: Missing Authentication for Critical Function

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

SUSE CVE-2026-98305

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mxl862xx: disable the stats poll on teardown mxl862xxsetup arms the stats poll before mxl862xxsetupmdio, and nothing stops it until dsaregisterswitch has returned an error to mxl862xxprobe. DSA frees the dsaport list...

CVE-2026-98305

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mxl862xx: disable the stats poll on teardown mxl862xxsetup arms the stats poll before mxl862xxsetupmdio, and nothing stops it until dsaregisterswitch has returned an error to mxl862xxprobe. DSA frees the dsaport list...

CVE-2026-98305

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mxl862xx: disable the stats poll on teardown mxl862xxsetup arms the stats poll before mxl862xxsetupmdio, and nothing stops it until dsaregisterswitch has returned an error to mxl862xxprobe. DSA frees the dsaport list...

CVE-2026-98305

The Linux kernel contains a vulnerability in the net: dsa: mxl862xx driver where the stats poll is not correctly disabled during teardown. The mxl862xx_setup() function arms the poll before mxl862xx_setup_mdio() , but if dsa_register_switch() returns an error, the dsa_port list is freed while the...

CVE-2026-98305 net: dsa: mxl862xx: disable the stats poll on teardown

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mxl862xx: disable the stats poll on teardown mxl862xxsetup arms the stats poll before mxl862xxsetupmdio, and nothing stops it until dsaregisterswitch has returned an error to mxl862xxprobe. DSA frees the dsaport list...

CVE-2026-98305 net: dsa: mxl862xx: disable the stats poll on teardown

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mxl862xx: disable the stats poll on teardown mxl862xxsetup arms the stats poll before mxl862xxsetupmdio, and nothing stops it until dsaregisterswitch has returned an error to mxl862xxprobe. DSA frees the dsaport list...

CVE-2026-98305

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mxl862xx: disable the stats poll on teardown mxl862xxsetup arms the stats poll before mxl862xxsetupmdio, and nothing stops it until dsaregisterswitch has returned an error to mxl862xxprobe. DSA frees the dsaport list...