Malicious code in @gfe/lx-watcher (npm)

Source: amazon-inspector 22abe9bf1ccb266833585bda205a07bc5c9a728763a733aa48b08fe50b640b4e All three npm lifecycle hooks preinstall, install, postinstall invoke install.js, which POSTs the installer's hostname, OS username, current working directory, timestamp, and hook name to a hardcoded...

CVE-2026-72333 Bluetooth: L2CAP: fix tx ident leak for commands without a response

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix tx ident leak for commands without a response Commit 6c3ea155e5ee "Bluetooth: L2CAP: Fix not tracking outstanding TX ident" changed ident allocation to use an IDA, releasing idents in l2capputident when the...

Malicious code in ac_semantic-ui_ts (npm)

Source: amazon-inspector f8b97f7d3e69494d0415e13aec8d9d51ce1f5912d8c1de45a1e563e2d1b01d3d package.json declares a postinstall hook that runs canary.js, which issues an HTTP GET to bare IP 157.230.17.236 on port 80 with query parameters including os.hostname, the package name and version, a nonce,...

Malicious code in bytefaas-sdk (npm)

Source: amazon-inspector 07cb4f68cec68081ac4817ad2ae387e7b031d3377a74a74ecca59c5858940d08 Package published at version 9999.0.0 under the name bytefaas-sdk, the canonical dependency-confusion shape used to shadow a private internal package of the same name. package.json declares a preinstall hook...

posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path

...

Apache Airflow exposes unreadable DAG identifiers in the scheduling dependencies graph

A bug in Apache Airflow's /ui/dependencies scheduling graph endpoint applied the caller's readable-Dag filter to the top-level serialized Dag key but still emitted referenced Dag IDs through the dep.source and dep.target fields of trigger / sensor dependency entries. An authenticated UI user with...

PT-2026-29876

Name of the Vulnerable Software and Affected Versions OneUptime versions prior to 10.0.42 Description OneUptime, an open-source monitoring and observability platform, had multiple notification API endpoints registered without authentication middleware. This allowed an unauthenticated attacker to...

CVE-2026-28682

Gokapi CVE-2026-28682 affects the self-hosted file sharing server Gokapi prior to 2.2.3. The vulnerability lies in the upload status SSE implementation for /uploadStatus, which previously published the global upload state to any authenticated listener and included file_id values not scoped to the...

CVE-2025-69207

Khoj is a self-hostable artificial intelligence app. Prior to 2.0.0-beta.23, an IDOR in the Notion OAuth callback allows an attacker to hijack any user's Notion integration by manipulating the state parameter. The callback endpoint accepts any user UUID without verifying the OAuth flow was...

Linux Kernel Security Vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from an unreleased xid, which could lead to an xid leak...

UBUNTU-CVE-2023-54003

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix GID entry ref leak when createah fails If AH create request fails, release sgidattr to avoid GID entry referrence leak reported while releasing GID table...

CVE-2023-54003 RDMA/core: Fix GID entry ref leak when create_ah fails

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix GID entry ref leak when createah fails If AH create request fails, release sgidattr to avoid GID entry referrence leak reported while releasing GID table...

CVE-2025-68233 drm/tegra: Add call to put_pid()

In the Linux kernel, the following vulnerability has been resolved: drm/tegra: Add call to putpid Add a call to putpid corresponding to gettaskpid. host1xmemorycontextalloc does not take ownership of the PID so we need to free it here to avoid leaking. [email protected]: reword commit message...

kernel: cifs: Fix xid leak in cifs_ses_add_channel()

A transaction ID xid leak was found in the CIFS/SMB filesystem. When adding a new channel fails, the allocated xid is not freed, leading to gradual exhaustion of the xid pool...

EUVD-2025-27766

Malicious code in bioql PyPI...

CVE-2022-50460 cifs: Fix xid leak in cifs_flock()

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix xid leak in cifsflock If not flock, before return -ENOLCK, should free the xid, otherwise, the xid will be leaked...

CVE-2022-50351 cifs: Fix xid leak in cifs_create()

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix xid leak in cifscreate If the cifs already shutdown, we should free the xid before return, otherwise, the xid will be leaked...

CVE-2025-30038

The vulnerability consists of a session ID leak when saving a file downloaded from CGM CLININET. The identifier is exposed through a built-in Windows security feature that stores additional metadata in an NTFS alternate data stream ADS for all files downloaded from potentially untrusted sources...

CVE-2025-30038

The CVE-2025-30038 vulnerability concerns a session ID leak when saving a file downloaded from CGM CLININET. The exposed identifier is stored in an NTFS alternate data stream (ADS) via a built-in Windows security feature that preserves extra metadata for files downloaded from potentially untruste...

CVE-2025-47870 Team invite ID leaked to team admin with no member invite privileges

Mattermost versions 10.8.x = 10.8.3, 10.5.x = 10.5.8, 9.11.x = 9.11.17, 10.9.x = 10.9.2 fail to sanitize the team invite ID in the POST /api/v4/teams/:teamId/restore endpoint which allows an team admin with no member invite privileges to get the team’s invite id...