Linux Distros Unpatched Vulnerability : CVE-2026-64436

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: afkey: initialize algkeylen for IPComp states pfkeymsg2xfrmstate handles the IPComp SADBXSATYPEIPCOMP case by allocating x-calg and copying only the...

Linux Distros Unpatched Vulnerability : CVE-2026-64280

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fpga: dfl-afu: validate DMA mapping length in afudmamapregion afuioctldmamap accepts a 64-bit length from userspace via DFLFPGAPORTDMAMAP ioctl without an upper...

Linux Distros Unpatched Vulnerability : CVE-2026-64447

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: staging: media: ipu7: fix double-free and use-after-free in error paths In both ipu7isysinit...

Linux Distros Unpatched Vulnerability : CVE-2026-16805

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Blink in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-55973

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the EDNS Report-Channel option code 18 from the last upstream...

Linux Distros Unpatched Vulnerability : CVE-2026-16398

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. CVE-2026-16398 Note that Nessus relies on the...

Linux Distros Unpatched Vulnerability : CVE-2026-64471

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: btusb: fix use-after-free on registration failure Make sure to release the sibling interfaces in case controller registration fails to avoid...

Linux Distros Unpatched Vulnerability : CVE-2026-16374

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information disclosure in the Framework component in DevTools. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird...

Linux Distros Unpatched Vulnerability : CVE-2026-64371

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - proc: protect ptracemayaccess with execupdatelock part 1 Fix the easy cases where procfs currently calls ptracemayaccess without execupdatelock protection, wher...

GHSA-XG4H-6GFC-H4M8 etcd: Watch API authorization bypass via open-ended range requests

Impact What kind of vulnerability is it? Who is impacted? A user granted READ permission on a single, exact key can use the Watch gRPC API with clientv3.WithFromKey an open-ended, "from this key to the end of the keyspace" watch to receive watch events for every key lexicographically greater than...

Shescape: Home-directory disclosure in assignment context on Unix with Dash

Impact This impacts users of Shescape on Unix systems that explicitly configure shell to Dash, or true when the default shell is Dash, using the escape and escapeAll APIs in assignments prefixed to a command. An attacker may be able to obtain the location of the home directory and, depending on h...

GHSA-W4HW-QCX7-56PR Shescape: Shell injection via unescaped parentheses on Windows with CMD

Impact This impacts users of Shescape on Windows that explicitly configure shell to CMD, or true with the default shell being CMD, using the escape and escapeAll APIs. An attacker may be able to achieve shell injection depending on the original command. javascript import as cp from...

Shescape: Shell injection via unescaped parentheses on Windows with CMD

Impact This impacts users of Shescape on Windows that explicitly configure shell to CMD, or true with the default shell being CMD, using the escape and escapeAll APIs. An attacker may be able to achieve shell injection depending on the original command. javascript import as cp from...

GHSA-29W2-FQ35-V728 AWS API MCP Server Security Policy Bypass via Startup Initialization Failure

Summary The AWS API MCP Server is an open source Model Context Protocol MCP server that enables AI assistants to interact with AWS services and resources through AWS CLI commands. It provides programmatic access to manage your AWS infrastructure while maintaining proper security controls. It...

GHSA-Q6X4-V3QX-85QW Budibase: SQL Injection via `multipleStatements: true`

Summary A critical SQL injection vulnerability was discovered in Budibase's MySQL integration that allows remote attackers to execute arbitrary SQL commands. Details Vulnerability Type SQL Injection Description The MySQL integration component in Budibase is configured with multipleStatements: tru...

CVE-2026-48021

In epa4all, prior to version 2026-05-20, an attacker who can intercept the TLS connection between epa4all and the ePA backend can complete the VAU handshake with attacker-controlled keys and obtain the session encryption keys. All inner HTTP traffic patient consent decisions, medication data,...

CVE-2026-48037 Hulumi: AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture. This issue has been patched in version 1.4.0...

CVE-2026-48037 Hulumi: AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture. This issue has been patched in version 1.4.0...

CVE-2026-48036

Hulumi drift classifier (package @hulumi/drift)

EUVD-2026-48726

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers running drift detection in CI / cron could see transient adapter failures silently cached as "all clear" — masking real attacks for up to six...