CVE-2026-64010

CVE-2026-64010 involves a use-after-free in the Linux NFC LLCP stack. The race occurs when nfc_llcp_recv_cc() moves a socket from the connecting_sockets list to the sockets list without holding the socket lock, risking linking a freed socket if llcp_sock_release() runs concurrently. The mitigatio...

EUVD-2026-45583

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix use-after-free race in nfcllcprecvcc A race condition exists in the NFC LLCP connection state machine where the connection acceptance packet CC can be processed concurrently with socket release. This can lead to a...

CVE-2026-64010 nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix use-after-free race in nfcllcprecvcc A race condition exists in the NFC LLCP connection state machine where the connection acceptance packet CC can be processed concurrently with socket release. This can lead to a...

CVE-2026-64004

In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix locking in .getsockopt Mirror iucvsocksetsockopt and wrap the whole switch in locksock/releasesock. The pre-existing SOMSGLIMIT-only lock becomes redundant and is removed. Any AFIUCV HIPER user can potentially crash...

CVE-2026-63938

The vulnerability CVE-2026-63938 affects the Linux kernel KVM SEV path, specifically PSC processing. The issue arises when validating PSC requests: the PSC buffer must be checked against the effective size of the scratch area, which may be smaller than the maximum if a guest supplies a pointer no...

CVE-2026-63915

CVE-2026-63915 : In the Linux kernel, the NFC NFC HCI stack (nfc_hci_recv_from_llc and nci_hci_data_received_cb) is vulnerable to an out-of-bounds heap read from packet->header when a 0-byte HCP frame is received, because the code reads skb->data at entry without ensuring a byte is present....

CVE-2026-63915 nfc: hci: fix out-of-bounds read in HCP header parsing

In the Linux kernel, the following vulnerability has been resolved: nfc: hci: fix out-of-bounds read in HCP header parsing Both nfchcirecvfromllc and ncihcidatareceivedcb read packet-header from skb-data at function entry without first checking that the buffer holds at least one byte. A malicious...

EUVD-2026-45688

In the Linux kernel, the following vulnerability has been resolved: nfc: hci: fix out-of-bounds read in HCP header parsing Both nfchcirecvfromllc and ncihcidatareceivedcb read packet-header from skb-data at function entry without first checking that the buffer holds at least one byte. A malicious...

EUVD-2026-45505

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject non-VALID session in compound request branch smb2checkusersession takes a shortcut for any operation that is not the first in a COMPOUND request: it reuses work-sess the session bound by the first operation and...

PT-2026-61232

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds heap read occurs during HCP header parsing. The functions nfc hci recv from llc and nci hci data received cb access packet-header from skb-data without verifying that th...

Malicious code in relativity-pdfjs-dist (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 542f0656a76929fa6bd11c9d8ff36f9f69c5865f46d835b8c707a803d71aa55f package.json declares a preinstall script that runs node -e inline JavaScript on npm install. The inline code collects the installer's hostname,...

Federated Lightweight Intrusion Detection in Drone Swarms with Knowledge Distillation

Drone swarms are increasingly deployed in critical applications such as surveillance, disaster response, and infrastructure monitoring. However, their reliance on open communication channels and their limited computational resources make them vulnerable to a wide range of cyber-threats. There is ...

CVE-2026-13446

IBM Langflow OSS 1.0.0 through 1.10.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data...

EUVD-2026-45330

IBM Langflow OSS 1.0.0 through 1.10.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data...

CVE-2026-13446

IBM Langflow OSS 1.0.0 through 1.10.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data...

MAL-2026-10769 Malicious code in easyway2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fcfc1bc035f5239e384f9e32be4fc53cdffe065920da7c6181e42757d6b41195 On npm install, the package's postinstall hook executes index.js, which POSTs the installer's full process.env, OS username, and current working...

CVE-2026-9602 Mattermost Desktop App crashes when malformed arguments are provided to some exposed IPC methods

Mattermost Desktop App versions =6.2 6.0.2 5.6.13.0 fail to validate payloads sent from the Mattermost Web App to the Desktop App which allows a malicious server owner to crash the Mattermost Desktop App via changing the payload of a method to a malformed one. Mattermost Advisory ID: MMSA-2026-00...

CVE-2026-13446: Use of Hard-coded Credentials

IBM Langflow OSS 1.0.0 through 1.10.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data...

PT-2026-60879

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.1 Description The software contains hard-coded credentials, such as passwords or cryptographic keys. These credentials are used for inbound authentication, outbound communication with external...

ROS-20260717-73-0006

The vulnerability of the WebRTC technology implementation in Google Chrome browser is related to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...