Malicious Package

Overview @usaa-grp-personal-profile/personal-profile-common is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that...

Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de7570e75b52c8d98aef5a71ab1b1183991359e7e3e1864befba58a9f5ca630a Package published to public npm under an internal-looking scope @usaa-grp-personal-profile at version 999.0.0, a shape consistent with...

MAL-2026-14370 Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de7570e75b52c8d98aef5a71ab1b1183991359e7e3e1864befba58a9f5ca630a Package published to public npm under an internal-looking scope @usaa-grp-personal-profile at version 999.0.0, a shape consistent with...

CVE-2026-74644: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: putback folios on invalid migrate nid damonpamigrate and damosvamigrate isolate folios into a local list and then call damonmigratepages. When targetnid is invalid including the scheme default NUMANONODE / -1...

CVE-2026-74644: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: putback folios on invalid migrate nid damonpamigrate and damosvamigrate isolate folios into a local list and then call damonmigratepages. When targetnid is invalid including the scheme default NUMANONODE / -1...

DEBIAN-CVE-2026-62867

Incus is a system container and virtual machine manager. Prior to version 7.3.0, improper validation of user-provided block.createoptions in storage volume configuration leads to argument injection in the constructed filesystem creation command line. This allows a project-scoped user to inject...

CVE-2026-74463

A flaw was found in the Linux kernel's i2c: jz4780 driver. A severe deadlock can occur between the Common Clock Framework CCF and the I2C adapter lock. This happens when an I2C-controlled clock generator client is registered or modified, and a concurrent I2C transfer attempts to acquire a lock...

Malicious Package

Overview vite-common-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CGA-2VM8-W2XQ-P3R6

Bulletin has no description...

CVE-2026-76576 yangzongzhuan RuoYi-Vue Common Download Endpoint CommonController.java resourceDownload path traversal

A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.9.2. This impacts the function fileDownload/resourceDownload of the file ruoyi-admin/src/main/java/com/ruoyi/web/controller/common/CommonController.java of the component Common Download Endpoint. Performing a manipulation of the argumen...

DEBIAN-CVE-2026-55191

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients that negotiate RDPGFX AVC444 with an H.264 decoder backend calculate the intermediate YUV444 allocation size in libfreerdp/codec/h264.c with 32-bit multiplication in avc444ensurebuffer. A malicious R...

Malicious Package

Overview checkout-common-tokens is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Malicious Package

Overview @epic-common/observability-node is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and th...

CVE-2026-76576: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.9.2. This impacts the function fileDownload/resourceDownload of the file ruoyi-admin/src/main/java/com/ruoyi/web/controller/common/CommonController.java of the component Common Download Endpoint. Performing a manipulation of the argumen...

CVE-2026-70773

Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite component: Knowledge Integration. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HCM...

CVE-2026-62520

Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion component: Common Events. The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperio...

CVE-2026-62522

Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion component: Common Security. The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperi...

CVE-2026-62523

Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion component: Common Security. The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperio...

CVE-2026-62502

Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion component: Common Events. The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion...

CVE-2026-62500

Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion component: Common Events. The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion...