CVE-2026-34593

This CVE affects Ash Framework (Elixir) where Ash.Type.Module.cast_input/2 unconditionally creates a new Erlang atom via Module.concat([value]) for inputs starting with "Elixir." before module existence is verified. The atom creation can exhaust BEAM’s atom table (default ~1,048,576 entries) and ...

CVE-2026-34593 Ash Framework: Ash.Type.Module.cast_input/2 atom exhaustion via unchecked Module.concat allows BEAM VM crash

Ash Framework is a declarative, extensible framework for building Elixir applications. Prior to version 3.22.0, Ash.Type.Module.castinput/2 unconditionally creates a new Erlang atom via Module.concatvalue for any user-supplied binary string that starts with "Elixir.", before verifying whether the...

nodejs: Nodejs uninitialized memory exposure

A memory exposure flaw has been discovered in Node.js. A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the vm module with the timeout option. Under specific timing conditions, buffers allocated with Buffer.alloc and other...

KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE

...

CVE-2026-21765: Incorrect Permission Assignment for Critical Resource

HCL BigFix Platform is affected by insecure permissions on private cryptographic keys. The private cryptographic keys located on a Windows host machine might be subject to overly permissive file system permissions...

The vulnerability of the ATMs system “BUK TS-G” arises from the lack of measures taken to neutralize special elements, allowing for the execution of arbitrary codes.

The vulnerability of the ATMs system “BUK TS-G” is related to the failure to take measures to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary codes...

The vulnerability of the ATMs system “BUK TS-G” lies in the lack of measures taken to protect SQL queries, allowing attackers to gain unauthorized access to protected information.

The vulnerability of the configuration module of the automation system “BUK TS-G” is related to the failure to implement measures to protect SQL queries. Exploiting this vulnerability may allow an attacker, operating remotely, to gain unauthorized access to protected information...

ovmf-202602-6.1 on GA media (moderate)

ovmf-202602-6.1 on GA media Announcement ID: openSUSE-SU-2026:10467-1 Rating: moderate Cross-References: CVE-2025-2296 CVSS scores: CVE-2025-2296 SUSE : 5.2 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:L CVE-2025-2296 SUSE : 5.7 CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N Affect...

CVE-2026-34445

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. Prior to version 1.21.0, the ExternalDataInfo class in ONNX was using Python’s setattr function to load metadata like file paths or data lengths directly from an ONNX model file. It didn’t check if the...

CVE-2026-34209

mppx is a TypeScript interface for machine payments protocol. Prior to version 0.4.11, the tempo/session cooperative close handler validated the close voucher amount using "" instead of "=" against the on-chain settled amount. An attacker could submit a close voucher exactly equal to the settled...

CVE-2026-23402

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM module. This vulnerability allows a host user to bypass KVM's memory management rules by overwriting critical memory structures. This can lead to a compromise of the virtual machine's memory integrity, potentially causing...

Cybersecurity Firm TAC Security Hits 10,000 Clients, Enters Top 5 in Global VM & AppSec

New York, New York, April 1st, 2026, CyberNewswire...

CVE-2026-23402

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE Adjust KVM's sanity check against overwriting a shadow-present SPTE with a another SPTE with a different target PFN to only apply to direct MMUs, i.e. on...

MAL-2026-2322 Malicious code in bs58-basic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56502a3bb31374f7cf0d79d8abc98ccac595ca94fe2b9720daeeb9217901c9e0 The package bs58-basic was found to contain malicious code. Source: ghsa-malware 5101b36fd690268aa870c7d458d29e404540f3d3cc29dd19404137ca9f618f56 Any...

MAL-2026-2320 Malicious code in base-x-64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2486f9bad36944300cb58e1a73a370afef7be10040daf814861d1b1a6287cdb8 The package base-x-64 was found to contain malicious code. Source: ghsa-malware d09ca9d36cb3821dc878f97db3b7e8ddef6f5f8e390373492186d10b668718f3 Any...

CVE-2026-23402 KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE Adjust KVM's sanity check against overwriting a shadow-present SPTE with a another SPTE with a different target PFN to only apply to direct MMUs, i.e. on...

CVE-2026-23401

The Linux kernel contains a vulnerability within the KVM subsystem related to x86/mmu shadow page table entry handling. Specifically, the system fails to drop/zap existing present SPTEs before installing emulated MMIO SPTEs when host userspace modifies a shadowed gPTE to switch from a memslot to ...

CVE-2026-34054

vcpkg is a free and open-source C/C++ package manager. Prior to version 3.6.13, vcpkg's Windows builds of OpenSSL set openssldir to a path on the build machine, making that path be attackable later on customer machines. This issue has been patched in version 3.6.13...

EUVD-2026-17510

NVIDIA Jetson for JetPack contains a vulnerability in the system initialization logic, where an unprivileged attacker could cause the initialization of a resource with an insecure default. A successful exploit of this vulnerability might lead to information disclosure of encrypted data, data...

CVE-2026-24148

NVIDIA Jetson for JetPack contains a vulnerability in the system initialization logic, where an unprivileged attacker could cause the initialization of a resource with an insecure default. A successful exploit of this vulnerability might lead to information disclosure of encrypted data, data...