PT-2026-65190

Name of the Vulnerable Software and Affected Versions iOS versions prior to 26.6 iPadOS versions prior to 26.6 macOS Tahoe versions prior to 26.6 Description An app may be able to access information about a user's contacts due to insufficient checks. Recommendations Update iOS to version 26.6...

SUSE CVE-2026-64274

In the Linux kernel, the following vulnerability has been resolved: Input: goodix - clamp the device-reported contact count goodixtsreadinputreport copies the number of touch points reported by the device into an on-stack buffer u8 pointdata2 + GOODIXMAXCONTACTSIZE GOODIXMAXCONTACTS; which is siz...

CVE-2026-64364

In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: fix out-of-bounds bit access on mtioflags mtioflags is a single unsigned long, but mtprocessslot, mtreleasependingpalms and mtreleasecontacts use it as a per-slot bitmap indexed by the slot number. That slot numb...

CVE-2026-64274

In the Linux kernel, the following vulnerability has been resolved: Input: goodix - clamp the device-reported contact count goodixtsreadinputreport copies the number of touch points reported by the device into an on-stack buffer u8 pointdata2 + GOODIXMAXCONTACTSIZE GOODIXMAXCONTACTS; which is siz...

UBUNTU-CVE-2026-64364

In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: fix out-of-bounds bit access on mtioflags mtioflags is a single unsigned long, but mtprocessslot, mtreleasependingpalms and mtreleasecontacts use it as a per-slot bitmap indexed by the slot number. That slot numb...

UBUNTU-CVE-2026-64274

In the Linux kernel, the following vulnerability has been resolved: Input: goodix - clamp the device-reported contact count goodixtsreadinputreport copies the number of touch points reported by the device into an on-stack buffer u8 pointdata2 + GOODIXMAXCONTACTSIZE GOODIXMAXCONTACTS; which is siz...

EUVD-2026-48986

In the Linux kernel, the following vulnerability has been resolved: Input: goodix - clamp the device-reported contact count goodixtsreadinputreport copies the number of touch points reported by the device into an on-stack buffer u8 pointdata2 + GOODIXMAXCONTACTSIZE GOODIXMAXCONTACTS; which is siz...

CVE-2026-64274 Input: goodix - clamp the device-reported contact count

In the Linux kernel, the following vulnerability has been resolved: Input: goodix - clamp the device-reported contact count goodixtsreadinputreport copies the number of touch points reported by the device into an on-stack buffer u8 pointdata2 + GOODIXMAXCONTACTSIZE GOODIXMAXCONTACTS; which is siz...

CVE-2026-64274

The CVE-2026-64274 issue is in the Linux kernel Goodix touchscreen driver. The code reads device-reported touch counts without clamping, allowing a malfunctioning/malicious controller (or I2C bus tampering) to advertise up to 15 contacts. This enables a stack out-of-bounds write in goodix_ts_read...

CVE-2026-64274 Input: goodix - clamp the device-reported contact count

In the Linux kernel, the following vulnerability has been resolved: Input: goodix - clamp the device-reported contact count goodixtsreadinputreport copies the number of touch points reported by the device into an on-stack buffer u8 pointdata2 + GOODIXMAXCONTACTSIZE GOODIXMAXCONTACTS; which is siz...

PT-2026-64495

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A stack out-of-bounds write exists in the goodix ts read input report function. The function copies the number of touch points reported by a device into an on-stack buffer point data,...

BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery

The North Korean threat actors behind the ClickFix-style campaigns that employ typosquatted Zoom and Microsoft Teams domains have been found to operate an active phishing kit to impersonate the videoconferencing platforms in social engineering campaigns designed to deliver malware. "BlueNoroff ha...

Malicious code in govapkg (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6960d465fbaca432a24450044c48aaaeb6f4c687171c4c0c4305005cccceffaf govapkg presents itself as a client for pkg.go.dev but on any use of its public API get/package/module invokes an internal helper...

CVE-2026-47130 NextCRM has a BOLA/IDOR in PATCH /api/crm/contacts/[id] that allows Cross-Tenant CRM Data Tampering

NextCRM is open-source customer relationship management CRM software. Versions prior to 0.12.0 have a Broken Object Level Authorization BOLA/IDOR vulnerability exists in the CRM contact and target update endpoints. The application fails to verify if the authenticated user has ownership of the...

CVE-2026-48948

An improper access check allows user to download vcard exports of comcontact contacts that are inaccessible...

CVE-2026-48948

An improper access check allows user to download vcard exports of comcontact contacts that are inaccessible...

CVE-2026-48948 Joomla! Core - [20260702] - Incorrect Access Control in com_contact vcf download

An improper access check allows user to download vcard exports of comcontact contacts that are inaccessible...

CVE-2026-48948

CVE-2026-48948: Joomla! Core vulnerability in the com_contact vCard download suffered from an improper access check, enabling a user to download vCard exports for contacts that should be inaccessible. The issue is in Joomla core functionality (com_contact) and is described across multiple feeds (...

CVE-2026-48948

An improper access check allows user to download vcard exports of comcontact contacts that are inaccessible...

CVE-2026-48948 Joomla! Core - [20260702] - Incorrect Access Control in com_contact vcf download

An improper access check allows user to download vcard exports of comcontact contacts that are inaccessible...