The vulnerability of the `usb_gadget_state_work()` function in the `/drivers/usb/gadget/udc/core.c` file of the Linux kernel allows a hacker to induce a service failure.

The vulnerability of the usbgadgetstatework function in the /drivers/usb/gadget/udc/core.c file of the Linux kernel is related to situations where the signal processing routine is involved in a race condition. Exploiting this vulnerability could allow an attacker to cause a service failure...

Linux Distros Unpatched Vulnerability : CVE-2026-68177

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tracing: Delay module ref count for enableevent trigger Triggers are now delayed from freeing, but can still be triggered until after the RCU grace period has...

Linux Distros Unpatched Vulnerability : CVE-2026-68342

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ovpn: avoid putting unrelated P2P peer on socket release ovpnpeerreleasep2p is called when an OVPN UDP socket is being destroyed. It checks the currently...

Entity Share Websub - Moderately critical - Server-side request forgery (SSRF) - SA-CONTRIB-2026-097

This module enables you to share content between sites in a hub - subscriber model. Certain inputs were not sufficiently validated, allowing an attacker to achieve server-side request forgery attacks...

PT-2026-71469

Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to 18.5 PostgreSQL versions prior to 17.11 PostgreSQL versions prior to 16.15 PostgreSQL versions prior to 15.19 PostgreSQL versions prior to 14.24 Description Type confusion in the "refint" module allows an object...

CVE-2026-67587: Deserialization of Untrusted Data

Apache Airflow's Task SDK rebuilt a Callback object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because SyncCallback is itself an Airflow class it passes the default alloweddeserializationclasses allow-list, so tightening that...

CVE-2026-44618

A flaw was found in Apache CXF. An insecure XML parser configuration within Apache CXF's WS-Transfer module may allow a remote attacker to perform XML External Entity XXE attacks. This could lead to information disclosure, denial of service, or server-side request forgery. Mitigation If using...

CVE-2026-68116

A flaw was found in the Linux kernel's Virtual Extensible LAN VXLAN module, specifically within its Multicast Database MDB functionality. When an operation to replace the source list of an MDB remote entry fails, the system incorrectly deletes existing sources. This can lead to a situation where...

CVE-2026-68122

A flaw was found in the Linux kernel's ovpn module. A race condition in the TCP error handling paths can lead to a reference count leak. This occurs when an internal object's reference count is incremented twice but decremented only once, preventing the object from being properly released. Over...

CVE-2026-68205

A flaw was found in the Linux kernel. The v4l2-fwnode module, responsible for video device node management, incorrectly handles module ownership during asynchronous subdevice registration. This can lead to a sensor module's reference count not being properly incremented. As a result, the module m...

CVE-2026-68428

A flaw was found in the KVM Kernel-based Virtual Machine component of the Linux kernel. A local attacker with privileges to load and unload kernel modules could exploit a use-after-free vulnerability. This occurs when a vendor module is unloaded while the KVM module remains loaded, and a subseque...

CVE-2026-20898

Improper access control in the firmware for some in Alias Checking Trusted Module for some IntelR XeonR processors may allow an escalation of privilege. Startup code and SMM adversary with a privileged user combined with a high complexity attack may enable escalation of privilege. This result may...

CVE-2026-62693

Technical details beyond the brief description are not publicly provided in the supplied documents. No concrete information on affected components, root cause specifics, or remediation is available here; monitor for official updates.

CVE-2026-68174

A flaw was found in the Linux kernel's tracing subsystem. When handling dynamic events, a memory collision occurs where a reference counter is mistakenly interpreted as a module pointer. This can happen when filtering or setting events for a specific module without properly checking the event's...

CVE-2026-68342

A flaw was found in the Linux kernel's OpenVPN ovpn module. During the destruction of an ovpn UDP socket, a race condition can occur where a new peer is published before the old socket is fully released. This can lead to a use-after-free vulnerability, allowing an attacker to potentially cause a...

CVE-2026-68341

A flaw was found in the Linux kernel's ovpn module. When the unlockovpn function processes a list of objects, it may attempt to access memory that has already been freed. This use-after-free vulnerability could potentially lead to system instability or, in more severe cases, arbitrary code...

Malicious code in base65-11x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14cc9506a804a2663d0cde1c610fa8cba5733e6797652b6365569ada5ef3901d base65-11x is a name-lookalike of the widely used base-x encoder. Both entrypoints src/cjs/index.cjs and src/esm/index.js, 127KB each vs. 4KB for rea...

EUVD-2026-56509

Improper access control in the firmware for some in Alias Checking Trusted Module for some IntelR XeonR processors may allow an escalation of privilege. Startup code and SMM adversary with a privileged user combined with a high complexity attack may enable escalation of privilege. This result may...

CVE-2026-20898

Improper access control in the firmware for some in Alias Checking Trusted Module for some IntelR XeonR processors may allow an escalation of privilege. Startup code and SMM adversary with a privileged user combined with a high complexity attack may enable escalation of privilege. This result may...

CVE-2026-68336

A flaw was found in the Linux kernel's bonding module. When a system is booted with IPv6 disabled, the bonding module incorrectly attempts to send IPv6 Network Service NS packets. This leads to a null pointer dereference, which is an attempt to access uninitialized memory. The consequence of this...