FreeBSD -- Kernel stack disclosure via timer_settime(2)

Problem Description: To retrieve the previous timer value, the kernel calls realtimergettime, which obtains the current time for the timer's clock. For a timer using CLOCKTAI this can fail when no TAI offset has been configured, but the error return was not checked, so the uninitialized output...

Fission: Incomplete capability denylist in Environment/Function PodSpec validation allows tenant-added CAP_SYS_TIME and cross-tenant node wall-clock corruption

Fission v1.24.0 added PodSpec safety validation for tenant-facing Environment and Function CRDs ValidatePodSpecSafety / ValidateContainerSafety admission webhook + sanitizeContainerSecurityContext executor merge layer, but the capability check was implemented as a fixed denylist of six Linux...

CVE-2026-64236

A flaw was found in the i2c davinci driver of the Linux kernel. When the 'clock-frequency' property is missing from the device tree, the driver's fallback mechanism can lead to a division-by-zero error. This vulnerability can be triggered by a local attacker providing a malformed device tree,...

Time Clock <= 1.2.2 & Time Clock Pro <= 1.1.4 - Remote Code Execution Detection

The Time Clock plugin and Time Clock Pro plugin for WordPress are vulnerable to Remote Code Execution in versions up to, and including, 1.2.2 for Time Clock and 1.1.4 for Time Clock Pro via the 'etimeclockwploadfunctioncallback' function. This allows unauthenticated attackers to execute code on t...

Ulanzi Clock Detect

Ulanzi Clock panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Ulanzi Clock panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Ulanzi Clock Detect', 'description': 'Ulanzi Clock panel...

USN-8595-3 linux-aws-6.8, linux-aws-fips vulnerabilities

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. CVE-2025-54505 It was discovered that some AMD Zen 2 processors did not properly isolate shared...

USN-8574-3: Linux kernel vulnerabilities

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. CVE-2025-54505 It was discovered that some AMD Zen 2 processors did not properly isolate shared...

Veeder-Root TLS4B Integer Overflow or Wraparound (CVE-2025-55067)

The TLS4B ATG system is vulnerable to improper handling of Unix time values that exceed the 2038 epoch rollover. When the system clock reaches January 19, 2038, it resets to December 13, 1901, causing authentication failures and disrupting core system functionalities such as login access, history...

Aftercall ads are driving Android users crazy

Aftercall is a wave of deceptive Android apps on Google Play that pose as everyday tools while bombarding users with pop-up ads after every phone call. When an unexpected ad pops up every time you hang up a call, it will slowly drive you crazy, especially if you can’t figure out what's causing it...

Linux Distros Unpatched Vulnerability : CVE-2026-64236

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: i2c: davinci: fix division by zero on missing clock-frequency When the 'clock-frequency'...

UBUNTU-CVE-2026-64236

In the Linux kernel, the following vulnerability has been resolved: i2c: davinci: fix division by zero on missing clock-frequency When the 'clock-frequency' property is missing from the device tree, the driver falls back to DAVINCII2CDEFAULTBUSFREQ. However, this macro was defined in kHz 100,...

CVE-2026-64236

In the Linux kernel, the following vulnerability has been resolved: i2c: davinci: fix division by zero on missing clock-frequency When the 'clock-frequency' property is missing from the device tree, the driver falls back to DAVINCII2CDEFAULTBUSFREQ. However, this macro was defined in kHz 100,...

UBUNTU-CVE-2026-64241

In the Linux kernel, the following vulnerability has been resolved: gpio: rockchip: teardown bugs and resource leaks Address several teardown issues and resource leaks in the driver's remove path and error handling: 1. Debounce clock reference leak: The debounce clock bank-dbclk is obtained using...

CVE-2026-64241

In the Linux kernel, the following vulnerability has been resolved: gpio: rockchip: teardown bugs and resource leaks Address several teardown issues and resource leaks in the driver's remove path and error handling: 1. Debounce clock reference leak: The debounce clock bank-dbclk is obtained using...

SUSE CVE-2026-64278

In the Linux kernel, the following vulnerability has been resolved: i2c: imx-lpi2c: mark I2C adapter when hardware is powered down On some i.MX platforms, certain I2C client drivers keep a periodic workqueue which continues to trigger I2C transfers. During system suspend/resume, there exists a ti...

SUSE CVE-2026-64236

In the Linux kernel, the following vulnerability has been resolved: i2c: davinci: fix division by zero on missing clock-frequency When the 'clock-frequency' property is missing from the device tree, the driver falls back to DAVINCII2CDEFAULTBUSFREQ. However, this macro was defined in kHz 100,...

SUSE CVE-2026-64241

In the Linux kernel, the following vulnerability has been resolved: gpio: rockchip: teardown bugs and resource leaks Address several teardown issues and resource leaks in the driver's remove path and error handling: 1. Debounce clock reference leak: The debounce clock bank-dbclk is obtained using...

Linux Distros Unpatched Vulnerability : CVE-2026-64241

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gpio: rockchip: teardown bugs and resource leaks Address several teardown issues and resource leaks in the driver's remove path and error handling: 1. Debounce...

NPM: sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock

NPM: sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock vulnerability discovered by ? in WordPress Npm sm-crypto versions 0.5.0...

sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock

Summary sm-crypto npm package 0.4.0, the latest release, published 2026-01-20 generates SM2 private keys and signing ephemeral scalars from a single module-wide RNG instance src/sm2/utils.js: const rng = new SecureRandom. SecureRandom is jsbn's PRNG, which seeds an ARC4 stream from...