2667 matches found
CVE-2026-48159: Embedded Malicious Code
use-reducer-async is a React useReducer with async actions. Between 2026-05-18 16:29:52 and 2026-05-19 15:26:07, the default branch contained malicious commits da72edbde5705efcec6c62e0a3dcb73687b78dc8 through df07d5711458d8b46e11dd7afaaa21e88cafabfb that executed remote attacker-controlled code o...
PT-2026-69885
Name of the Vulnerable Software and Affected Versions use-reducer-async affected versions not specified Description Malicious commits were introduced into the default branch of the repository, which executed remote attacker-controlled code on developer workstations during the npm install process...
CVE-2026-68382: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Hold device ref until queue teardown completes GuC exec queue destruction can run asynchronously. If the final device put happens from a destroy worker, drmm cleanup can end up draining the same workqueue and deadlock...
PT-2026-69610
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the stm32 dcmi media component where the dcmi graph init function registers an async notifier before the dcmi probe function toggles the reset line. If the reset contr...
CVE-2026-68426: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: xfrm: fix stale skb-prev after async crypto steals a GSO segment skbgsosegment leaves the segment list head with -prev pointing at the last segment, an invariant validatexmitskblist relies on when it sets its tail pointer tail =...
ECHO-A10B-DD74-A1AF
Bulletin has no description...
CVE-2026-47661 Pathling has path traversal in $result endpoint that allows arbitrary warehouse file read
Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's /$result endpoint allows a caller who can obtain any valid async export job ID to supply file parameter values containing path...
CVE-2026-47661 Pathling has path traversal in $result endpoint that allows arbitrary warehouse file read
Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's /$result endpoint allows a caller who can obtain any valid async export job ID to supply file parameter values containing path...
CVE-2026-47661 Pathling has path traversal in $result endpoint that allows arbitrary warehouse file read
Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's /$result endpoint allows a caller who can obtain any valid async export job ID to supply file parameter values containing path...
CVE-2026-47661
Pathling Server prior to 2.0.0 is vulnerable in the /$result endpoint: an attacker with a valid async export job ID can supply file parameters with path traversal sequences. The handler only validates the supplied job and does not normalise or confine the requested file path to the job’s director...
EUVD-2026-54640
Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's /$result endpoint allows a caller who can obtain any valid async export job ID to supply file parameter values containing path...
SUSE-SU-2026:23171-1 Security update for sssd
This update for sssd fixes the following issue: - CVE-2026-12610: cancelled or completed PAM request while the asynchronous child process is still running can lead to a use-after-free bsc1269807...
PT-2026-69132
Name of the Vulnerable Software and Affected Versions Pathling Server versions prior to 2.0.0 Description The /$result endpoint allows a caller with a valid async export job ID to provide file parameter values containing path traversal sequences. Path traversal is a technique used to access files...
[SECURITY] [DLA 4721-1] async-http-client security update
------------------------------------------------------------------------- Debian LTS Advisory DLA-4721-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb August 06, 2026 https://wiki.debian.org/LTS -...
Debian dla-4721 : libasync-http-client-java - security update
The remote Debian 11 / 12 host has a package installed that is affected by a vulnerability as referenced in the dla-4721 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4721-1 [email protected]...
MAL-2026-12339 Malicious code in async-mutex-hook (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 624c93cbd007656467757c5504db29971b220bc36685eda2af6a1d1390715133 Package is published under the name async-mutex-hook and self-describes as a Promise-based mutex library, but ships no mutex implementation. Its...
Malicious code in async-mutex-hook (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 624c93cbd007656467757c5504db29971b220bc36685eda2af6a1d1390715133 Package is published under the name async-mutex-hook and self-describes as a Promise-based mutex library, but ships no mutex implementation. Its...
RHSA-2026:50263 Red Hat Security Advisory: Satellite 6.18.8 Async Update
Bulletin has no description...