PT-2026-72371

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A bypass exists in the Landlock security module regarding the LANDLOCK SCOPE SIGNAL restriction, which is intended to prevent sandboxed processes from signaling processes outside their...

CVE-2026-74270: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: handshake: Require admin permission for DONE command ACCEPT and DONE are the two downcalls of the handshake genl family, both intended for use by the trusted handshake agent tlshd. ACCEPT already requires GENLADMINPERM; DONE has ...

PT-2026-72408

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A double-free or use-after-free issue exists in the sunrpc component. The svc release rqst function executes a callback within rqstp-rq procinfo-pc release. If a worker thread processes ...

PT-2026-72966

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the KVM s390 PCI component regarding memory accounting for pinned and unpinned pages. The account mem and unaccount mem functions call get uid, which increments the...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read via the csinsnname lookup in arch/M68K/M68KInstPrinter.c and arch/RISCV/RISCVMapping.c. An attacker can crash the process by supplying an invalid instruction ID to csinsnname on an M68K or RISCV handle. On M68K, the...

CVE-2026-73680

Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows authenticated users with only the assets/upload permission to execute arbitrary commands by uploading a video file with a shell metacharacter-laden filename. The unsanitized filename is...

CVE-2026-73680 Cockpit CMS 2.14.0 Authenticated Command Injection via FFmpeg Filename

Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows authenticated users with only the assets/upload permission to execute arbitrary commands by uploading a video file with a shell metacharacter-laden filename. The unsanitized filename is...

CVE-2026-73680

Cockpit CMS 2.14.0 and earlier exposes a command-injection vulnerability in the FFmpeg integration. An authenticated user with assets/upload can upload a video file whose filename contains shell metacharacters; the unsanitized filename is interpolated into a shell command executed via Process::fr...

CVE-2026-73680

Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows authenticated users with only the assets/upload permission to execute arbitrary commands by uploading a video file with a shell metacharacter-laden filename. The unsanitized filename is...

CVE-2026-73680 Cockpit CMS 2.14.0 Authenticated Command Injection via FFmpeg Filename

Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows authenticated users with only the assets/upload permission to execute arbitrary commands by uploading a video file with a shell metacharacter-laden filename. The unsanitized filename is...

CVE-2026-73680 Cockpit CMS 2.14.0 Authenticated Command Injection via FFmpeg Filename

Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows authenticated users with only the assets/upload permission to execute arbitrary commands by uploading a video file with a shell metacharacter-laden filename. The unsanitized filename is...

Malicious code in @ghost_debugger/nanocache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c027fa29f4577bd052bfda553a617994365ea5855216b877e900610542f4bcce On require/import, the package spawns a bundled 1.1 MB Windows executable at vendor/nanocache.exe as a detached background process with stdio ignored...

irflow-timeline v1.0.10

IRFlow Timeline Native macOS forensic timeline analysis. Import, search, and investigate EVTX, CSV, XLSX, Plaso, $MFT, $J, and local AI assistant artifacts — with AI Secret Hunt and the analytics DFIR professionals actually need. Built on Electron + SQLite to handle millions of rows without...

CVE-2026-45819

A flaw was found in baseline-browser-mapping. This vulnerability allows an attacker to cause a denial of service by providing invalid or conflicting input parameters. The affected component improperly terminates the process instead of handling the input error gracefully, leading to immediate...

EUVD-2026-58672

Nozomi Networks Labs identified a CWE-787: Out-of-bounds Write vulnerability in the process-image management functionality of KUNBUS piControl in version 2.6.2 that allows a local authenticated attacker with device configuration access to write attacker-controlled data outside the bounds of the...

Malicious code in alelo-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b1fd03e0ca4d5452b6a5d6aa2880a9c711021e287eaae056e68f70f6aedc926 On npm install, preinstall.js collects hostname, username, platform, cwd and the full process.env and POSTs the JSON body to...

MAL-2026-14025 Malicious code in alelo-payment (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef5aceecfb22fd66b4e0861399aa6864ba19a983f3483294dd0740e7e24d1c34 On npm install, preinstall.js collects hostname, username, platform, cwd, and the full process.env and POSTs the payload over HTTPS with TLS...

CVE-2026-72830

Grav API plugin versions before 1.0.13 fail to enforce API key scope caps in ConfigController super-scope gates, allowing scoped keys to write scheduler configuration. The scope cap is applied only inside requirePermission, while the scheduler and backups gates use a bare isSuperAdmin check that...

CVE-2026-72813

actix-files before 0.6.10 contains a denial of service vulnerability triggered by an empty Range header in GET requests for static files. When panic is set to abort, remote attackers can crash the process on-demand by sending a GET request with an empty Range header...

CVE-2026-72830

Grav API plugin versions before 1.0.13 fail to enforce API key scope caps in ConfigController super-scope gates, allowing scoped keys to write scheduler configuration. Attackers with a scoped api.config.write key can inject arbitrary commands into scheduler.customjobs that execute via Symfony...