SUSE CVE-2026-72418

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconncount: prevent connlimit drops for early confirmed ct Commit 69894e5b4c5e "netfilter: nftconnlimit: update the count if add was skipped" introduced a regression where packets for valid connections are dropped whe...

Linux Distros Unpatched Vulnerability : CVE-2026-80683

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: SCO: give the socket its own scoconn reference scoconndel drops a reference it does not own. It takes one transient reference via...

PT-2026-83013

In the Linux kernel, the following vulnerability has been resolved: io uring: preserve task restrictions across exec Per-task restrictions apply to all rings created by a task. Once installed, they should not be dropped across exec. For a task that has used io uring, the exec cancellation path...

CVE-2026-54552

A flaw was found in sh, a Python library for process launching. When sh runs from an elevated process and launches a command with the uid option set to an unprivileged user, the child process may retain the parent process's supplementary groups. This incomplete privilege drop can allow the child...

CVE-2026-73427

A flaw was found in Trix, a rich text editor. A remote attacker could exploit this vulnerability by convincing a victim to drag and drop a specially crafted JSON payload into an editor using the Level0InputController. This could bypass sanitization and allow the injection of executable JavaScript...

MAL-2026-15607 Malicious code in mbxcnsuwgs1 (npm)

Published as part of a ClickFix-style fake-CAPTCHA phishing campaign documented by OX Security see reference. The package's only file is index.html, declared as the npm "main" entry; package.json defines no preinstall/install/postinstall/prepare lifecycle script, so the payload does not execute a...

MAL-2026-15604 Malicious code in @worrisome/reutil (npm)

Published as part of a ClickFix-style fake-CAPTCHA phishing campaign documented by OX Security see reference. The package's only file is index.html, declared as the npm "main" entry; package.json defines no preinstall/install/postinstall/prepare lifecycle script, so the payload does not execute a...

Malicious code in mndsxcusiwlk1 (npm)

Published as part of a ClickFix-style fake-CAPTCHA phishing campaign documented by OX Security see reference. The package's only file is index.html, declared as the npm "main" entry; package.json defines no preinstall/install/postinstall/prepare lifecycle script, so the payload does not execute a...

Malicious code in mn4xcouzvhus (npm)

Published as part of a ClickFix-style fake-CAPTCHA phishing campaign documented by OX Security see reference. The package's only file is index.html, declared as the npm "main" entry; package.json defines no preinstall/install/postinstall/prepare lifecycle script, so the payload does not execute a...

MAL-2026-15613 Malicious code in mobiwaefhxc3 (npm)

Published as part of a ClickFix-style fake-CAPTCHA phishing campaign documented by OX Security see reference. The package's only file is index.html, declared as the npm "main" entry; package.json defines no preinstall/install/postinstall/prepare lifecycle script, so the payload does not execute a...

Malicious code in @worrisome/reutil (npm)

Published as part of a ClickFix-style fake-CAPTCHA phishing campaign documented by OX Security see reference. The package's only file is index.html, declared as the npm "main" entry; package.json defines no preinstall/install/postinstall/prepare lifecycle script, so the payload does not execute a...

Malicious code in mobiwaefhxc3 (npm)

Published as part of a ClickFix-style fake-CAPTCHA phishing campaign documented by OX Security see reference. The package's only file is index.html, declared as the npm "main" entry; package.json defines no preinstall/install/postinstall/prepare lifecycle script, so the payload does not execute a...

Malicious code in skxcmwuncbg2 (npm)

Published as part of a ClickFix-style fake-CAPTCHA phishing campaign documented by OX Security see reference. The package's only file is index.html, declared as the npm "main" entry; package.json defines no preinstall/install/postinstall/prepare lifecycle script, so the payload does not execute a...

Malicious code in mbxcnsuwgs1 (npm)

Published as part of a ClickFix-style fake-CAPTCHA phishing campaign documented by OX Security see reference. The package's only file is index.html, declared as the npm "main" entry; package.json defines no preinstall/install/postinstall/prepare lifecycle script, so the payload does not execute a...

Malicious code in mn3sadkoiewu (npm)

Published as part of a ClickFix-style fake-CAPTCHA phishing campaign documented by OX Security see reference. The package's only file is index.html, declared as the npm "main" entry; package.json defines no preinstall/install/postinstall/prepare lifecycle script, so the payload does not execute a...

MAL-2026-15617 Malicious code in skxcmwuncbg2 (npm)

Published as part of a ClickFix-style fake-CAPTCHA phishing campaign documented by OX Security see reference. The package's only file is index.html, declared as the npm "main" entry; package.json defines no preinstall/install/postinstall/prepare lifecycle script, so the payload does not execute a...

MAL-2026-15611 Malicious code in mn4xcouzvhus (npm)

Published as part of a ClickFix-style fake-CAPTCHA phishing campaign documented by OX Security see reference. The package's only file is index.html, declared as the npm "main" entry; package.json defines no preinstall/install/postinstall/prepare lifecycle script, so the payload does not execute a...

Malicious code in mn2adskhweox (npm)

Published as part of a ClickFix-style fake-CAPTCHA phishing campaign documented by OX Security see reference. The package's only file is index.html, declared as the npm "main" entry; package.json defines no preinstall/install/postinstall/prepare lifecycle script, so the payload does not execute a...

CVE-2026-80346

StarRocks performs no privilege check when a legacy synchronous materialized view is dropped. Every other statement type routed through AuthorizerStmtVisitor calls into Authorizer before execution, but visitDropMaterializedViewStatement returns immediately with a comment stating the check happens...

CVE-2026-80346

StarRocks through 4.0.13 has a missing authorization vulnerability in the DROP MATERIALIZED VIEW code path for legacy synchronous materialized views. When such a view is dropped, the statement visitor returns without invoking the Authorizer , and the execution logic that should perform the check ...