CVE-2026-32683

CVE-2026-32683 affects EZVIZ products that use older cloud feature modules with legacy API interfaces. The root issue is data transmission risk due to these outdated modules, potentially allowing an attacker to eavesdrop on network requests and obtain data. The available sources describe the impa...

CVE-2026-32683

Some EZVIZ products utilize older versions of cloud feature modules with legacy API interfaces, which pose a data transmission risk. Attackers can exploit this by eavesdropping on network requests to obtain data.Users are advised to upgrade the app to the latest version and enable the video...

azureml-designer-classic-modules (>=0.0.127, <=0.0.129), azureml-designer-cv-modules (>=0.0.8, <=0.0.10) +17 more potentially affected by CVE-2026-42308 via pillow (7.1.0)

pillow PYPI version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - azureml-designer-classic-modules =0.0.127, =0.0.8, =0.0.10, =0.0.7, =0.0.7, =0.0.2, =0.3.1, =0.1.1, =0.0.2, =0.0.1, =0.0.4, =0.0.3, =0.1.0 - qweb...

EZVIZ APP security vulnerability

EZVIZ APP is a mobile application developed by EZVIZ, a Chinese company, for remote monitoring and management of smart security devices. The EZVIZ APP has a security vulnerability, which stems from the use of outdated cloud function modules and legacy API interfaces. This vulnerability may allow...

CVE-2026-32683: Cleartext Transmission of Sensitive Information

Some EZVIZ products utilize older versions of cloud feature modules with legacy API interfaces, which pose a data transmission risk. Attackers can exploit this by eavesdropping on network requests to obtain data.Users are advised to upgrade the app to the latest version and enable the video...

PT-2026-39324

Name of the Vulnerable Software and Affected Versions EZVIZ products affected versions not specified Description Certain products use outdated cloud feature modules with legacy API interfaces, creating a data transmission risk. This allows attackers to obtain data by eavesdropping on network...

[slackware-security] kernel

New kernel packages are available for Slackware 15.0 and -current to fix a security issue. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/linux-5.15.205/kernel-generic-5.15.205-i586-1.txz: Upgraded. patches/packages/linux-5.15.205/kernel-generic-smp-5.15.205smp-i686-1.tx...

@2kk/miniprogram-ci (>=0.0.2, <=0.0.8), @agilejs/cli (1.0.0) +336 more potentially affected by CVE-2026-44728 via @babel/plugin-transform-modules-systemjs (>=7.12.1, <=7.29.0)

@babel/plugin-transform-modules-systemjs NPM version =7.12.1, =0.0.2, =1.0.0, =7.21.4-esm.2, =2.1.0-alpha.0, =2.1.0-alpha.0, =2.1.0-alpha.0, =2.1.0-alpha.74, =1.0.0, =1.1.5 and more Source cves: CVE-2026-44728 Source advisory: GHSA-FV7C-FP4J-7GWP...

@2kk/miniprogram-ci (>=0.0.2, <=0.0.8), @agilejs/cli (1.0.0) +336 more potentially affected by CVE-2026-44728 via @babel/plugin-transform-modules-systemjs (>=7.12.1, <=7.29.0)

@babel/plugin-transform-modules-systemjs NPM version =7.12.1, =0.0.2, =1.0.0, =7.21.4-esm.2, =2.1.0-alpha.0, =2.1.0-alpha.0, =2.1.0-alpha.0, =2.1.0-alpha.74, =1.0.0, =1.1.5 and more Source cves: CVE-2026-44728 Source advisory: SNYK:JS-BABELPLUGINTRANSFORMMODULESSYSTEMJS-16624576...

@babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input

Impact Using Babel to compile code that was specifically crafted by an attacker can cause Babel to generate output code that executes arbitrary code. Known affected plugins are: - @babel/plugin-transform-modules-systemjs - @babel/preset-env when using the modules: "systemjs" option, as it delegat...

@1stg/app-config (16.0.0), @1stg/babel-preset (5.0.0) +343 more potentially affected by CVE-2026-44728 via @babel/plugin-transform-modules-systemjs (8.0.1)

@babel/plugin-transform-modules-systemjs NPM version 8.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on @babel/plugin-transform-modules-systemjs and may be impacted: - @1stg/app-config 16.0.0 - @1stg/babel-preset 5.0.0 - @1stg/common-config 16.0.0 -...

@2kk/miniprogram-ci (>=0.0.2, <=0.0.8), @agilejs/cli (1.0.0) +336 more potentially affected by CVE-2026-44728 via @babel/plugin-transform-modules-systemjs (>=7.12.1, <=7.29.0)

@babel/plugin-transform-modules-systemjs NPM version =7.12.1, =0.0.2, =1.0.0, =7.21.4-esm.2, =2.1.0-alpha.0, =2.1.0-alpha.0, =2.1.0-alpha.0, =2.1.0-alpha.74, =1.0.0, =1.1.5 and more Source cves: CVE-2026-44728 Source advisory: OSV:GHSA-FV7C-FP4J-7GWP...

New Linux PamDOORa Backdoor Uses PAM Modules to Steal SSH Credentials

Cybersecurity researchers have disclosed details of a new Linux backdoor named PamDOORa that's being advertised on the Rehub Russian cybercrime forum for $1,600 by a threat actor called "darkworm." The backdoor is designed as a Pluggable Authentication Module PAM-based post-exploitation toolkit...

Exploit for Write-what-where Condition in Linux Linux_Kernel

Dirty Frag mitigation script This script: 1. Block...

dirtyfrag-check

dirtyfrag-check A safe, read-only Python script to detect whe...

org.opencms.modules:com.alkacon.opencms.v8.article (>=8.0.1, <=8.0.4), org.opencms.modules:com.alkacon.opencms.v8.event (>=8.0.1, <=8.0.3) +65 more potentially affected by CVE-2023-42346 via org.opencms:opencms-core (8.0.1)

org.opencms:opencms-core MAVEN version 8.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.opencms:opencms-core and may be impacted: - org.opencms.modules:com.alkacon.opencms.v8.article =8.0.1, =8.0.1, =8.0.1, =8.0.1, =8.0.1, =8.0.1, =8.0.1,...

Apache HTTP Server: multiple modules: HTTP response splitting forwarding malicious status line

...

Important: Red Hat Security Advisory: python3.12 security update

An update for python3.12 is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...

Improper Isolation or Compartmentalization

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Improper Isolation or Compartmentalization through the NodeVM constructor in lib/nodevm.js. An attacker can run host commands when the VM is set up...

python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules

A flaw was found in Python's decompression modules, including lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile. This vulnerability, a use-after-free, can occur if a program attempts to re-use a decompression object after a memory allocation error, especially when the system is...