EUVD-2026-3689

In the Linux kernel, the following vulnerability has been resolved: net/sched: schqfq: Fix NULL deref when deactivating inactive aggregate in qfqreset qfqclass-leafqdisc-q.qlen 0 does not imply that the class itself is active. Two qfqclass objects may point to the same leafqdisc. This happens whe...

EUVD-2026-3690

Not used...

EUVD-2026-3696

Not used...

EUVD-2026-3695

Not used...

EUVD-2026-3697

Not used...

EUVD-2026-3719

Malicious code in qdrant-js npm...

EUVD-2026-3717

Malicious code in weaviate-js npm...

EUVD-2026-3721

Malicious code in babel-js npm...

EUVD-2026-3735

Malicious code in connect-web npm...

EUVD-2026-3743

Malicious code in hw-app-eth npm...

EUVD-2026-3744

Malicious code in anthropic-sdk npm...

EUVD-2026-3752

Malicious code in worldposition npm...

EUVD-2026-3765

Malicious code in recaptcha-cors npm...

EUVD-2026-3769

Malicious code in blocks-builder-manifest-generator npm...

EUVD-2026-3771

Malicious code in victim-package-b npm...

EUVD-2026-3716

Malicious code in coolpackage2323 PyPI...

EUVD-2026-3341

HackerOne community member Jad Ghamloush 0xjad has reported an authorization bypass vulnerability in the tracker-delete.php script of Revive Adserver. Users with permissions to delete trackers are mistakenly allowed to delete trackers owned by other accounts...

EUVD-2026-3338

A flaw in Node.js’s Permissions model allows attackers to bypass --allow-fs-read and --allow-fs-write restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files...

EUVD-2026-3331

A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the vm module with the timeout option. Under specific timing conditions, buffers allocated with Buffer.alloc and other TypedArray instances like Uint8Array may contain leftover...

EUVD-2026-3357

NVIDIA Nsight Systems contains a vulnerability in the gfxhotspot recipe, where an attacker could cause an OS command injection by supplying a malicious string to the processnsysrepcli.py script if the script is invoked manually. A successful exploit of this vulnerability might lead to code...