SUSE CVE-2026-35536

In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.setcookie were not checked for crafted characters...

EUVD-2026-18790

In the Linux kernel, the following vulnerability has been resolved: NFSD: Defer sub-object cleanup in export put callbacks svcexportput calls pathput and authdomainput immediately when the last reference drops, before the RCU grace period. RCU readers in eshow and cshow access both expath via...

EUVD-2026-18664

In the Linux kernel, the following vulnerability has been resolved: iommu/sva: Fix crash in iommusvaunbinddevice domain-mm-iommumm can be freed by iommudomainfree: iommudomainfree mmdrop mmdrop mmpasiddrop After iommudomainfree returns, accessing domain-mm-iommumm may dereference a freed mm...

[SECURITY] Fedora 42 Update: bind9-next-9.21.20-1.fc42

BIND Berkeley Internet Name Domain is an implementation of the DNS Domain Name System protocols. BIND includes a DNS server named, which resolves host names to IP addresses; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server ...

CVE-2026-23429

In the Linux kernel, the following vulnerability has been resolved: iommu/sva: Fix crash in iommusvaunbinddevice domain-mm-iommumm can be freed by iommudomainfree: iommudomainfree mmdrop mmdrop mmpasiddrop After iommudomainfree returns, accessing domain-mm-iommumm may dereference a freed mm...

CVE-2026-31404

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-23429

In the Linux kernel, the following vulnerability has been resolved: iommu/sva: Fix crash in iommusvaunbinddevice domain-mm-iommumm can be freed by iommudomainfree: iommudomainfree mmdrop mmdrop mmpasiddrop After iommudomainfree returns, accessing domain-mm-iommumm may dereference a freed mm...

UBUNTU-CVE-2026-23429

In the Linux kernel, the following vulnerability has been resolved: iommu/sva: Fix crash in iommusvaunbinddevice domain-mm-iommumm can be freed by iommudomainfree: iommudomainfree mmdrop mmdrop mmpasiddrop After iommudomainfree returns, accessing domain-mm-iommumm may dereference a freed mm...

UBUNTU-CVE-2026-31404

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-31404

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-31404

CVE-2026-31404 is rejected and not an active vulnerability entry.

CVE-2026-23429

The CVE-2026-23429 issue affects the Linux kernel IOMMU/SVA subsystem. The root cause is that after iommu_domain_free() returns, code may dereference domain->mm->iommu_mm, which can lead to a crash. The published fix moves the access to domain->mm->iommu_mm to before the call to iommu...

CVE-2026-23429

In the Linux kernel, the following vulnerability has been resolved: iommu/sva: Fix crash in iommusvaunbinddevice domain-mm-iommumm can be freed by iommudomainfree: iommudomainfree mmdrop mmdrop mmpasiddrop After iommudomainfree returns, accessing domain-mm-iommumm may dereference a freed mm...

CVE-2026-23429 iommu/sva: Fix crash in iommu_sva_unbind_device()

In the Linux kernel, the following vulnerability has been resolved: iommu/sva: Fix crash in iommusvaunbinddevice domain-mm-iommumm can be freed by iommudomainfree: iommudomainfree mmdrop mmdrop mmpasiddrop After iommudomainfree returns, accessing domain-mm-iommumm may dereference a freed mm...

CVE-2026-23429 iommu/sva: Fix crash in iommu_sva_unbind_device()

In the Linux kernel, the following vulnerability has been resolved: iommu/sva: Fix crash in iommusvaunbinddevice domain-mm-iommumm can be freed by iommudomainfree: iommudomainfree mmdrop mmdrop mmpasiddrop After iommudomainfree returns, accessing domain-mm-iommumm may dereference a freed mm...

CVE-2026-35536

A flaw was found in Tornado. A remote attacker could exploit this vulnerability by injecting specially crafted characters into the domain, path, and samesite arguments when setting cookies. This could lead to cookie attribute injection, potentially allowing for information disclosure or...

CVE-2026-29134

SEPPmail Secure Email Gateway before version 15.0.3 allows an external user to modify GINA webdomain metadata and bypass per-domain restrictions...

MAL-2026-2446 Malicious code in @corpweb-ui/wmkt-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dfd12ddf708e12b032513bcf667e459df772f642106507d1798d95ee81f6cbe2 index.js uses childprocess to execute whoami and gather hostname information, then transmits results via https.get to api.telegram.org/bot — a...

Malicious code in @corpweb-ui/wmkt-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dfd12ddf708e12b032513bcf667e459df772f642106507d1798d95ee81f6cbe2 index.js uses childprocess to execute whoami and gather hostname information, then transmits results via https.get to api.telegram.org/bot — a...

Malicious code in @toprank/partner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78a6d41a400b329c496f199f979216a151264b95d960a177b3b0347e6b3cf10e The package @toprank/partner was found to contain malicious code. Source: ossf-package-analysis...