SUSE-SU-2026:3935-1 Security update for cups-filters

This update for cups-filters fixes the following issues: - CVE-2026-64611: user who controls an IEEE-1284 device ID consumed by cfIEEE1284GetMakeModel can drive cfIEEE1284NormalizeMakeModel into an infinite loop bsc1273145. - CVE-2026-64612: authenticated client that can submit an image print job...

AxHunter — Updated!

AxHunter PoCs for Wellbia XIGNCODE3 anti-cheat xhunter driver family — xhunter1.sys v2023.12.7.78 CVE-2026-3609 and xhunter2.sys v2026.6.1.192 CVE-2026-15430. Workspace layout Cargo workspace, three crates: AxHunter/ ├── Cargo.toml workspace manifest ├── axhunter-lsa/ shared crate — driver-agnost...

CVE-2026-85165: Improper Neutralization of Directives in Dynamically Evaluated Code

n8n versions before 2.36.2 contain an expression sandbox bypass vulnerability where free identifiers in spread, computed-key, switch-case, or class-extension positions resolve against process globals. Authenticated users with workflow-edit permission can mutate host objects through expression...

Linux Distros Unpatched Vulnerability : CVE-2026-84355

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in Navigation in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to bypass web...

CVE-2026-85048: Use After Free

Use after free in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-85451: Use of Hard-coded Credentials

MOOS core-moos through 10.4.0 contains a remote process termination vulnerability in the SuicidalSleeper component that uses a hard-coded passphrase for multicast command authorization. Any multicast-reachable peer can enumerate MOOS processes and send termination commands to trigger process...

PT-2026-85025

A vulnerability was found in NousResearch hermes-agent 0.18.0. This vulnerability affects the function resourceBufferFromUrl of the file apps/desktop/electron/main.ts of the component Electron Main Process. Performing a manipulation results in allocation of resources. The attack may be initiated...

PT-2026-85290

Name of the Vulnerable Software and Affected Versions MOOS core-moos versions prior to 10.4.1 Description An issue exists where the software fails to validate that serialized string lengths are non-negative within the CMOOSMsg::operator function. Unauthenticated attackers can exploit this by...

PT-2026-85074

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Improper handling of an unexpected value size in the decryption path of a client-side encryption library can cause a failed internal check that terminates the...

PT-2026-95384

Name of the Vulnerable Software and Affected Versions vm2 NodeVM versions prior to 3.12.1 Description A sandbox escape exists because the DANGEROUS BUILTINS denylist fails to include child process, even though other modules capable of spawning host processes are blocked. This allows attackers to...

Linux Distros Unpatched Vulnerability : CVE-2026-84358

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper privilege management in Downloads in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to spoof...

CVE-2026-85052: Out-of-bounds Read

Out of bounds read in CrashReporting in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-84971: Reachable Assertion

Improper handling of an unexpected value size in the decryption path of a client-side encryption library can cause a failed internal check that terminates the process using the library. A party able to place a suitably formed encrypted value where an application will decrypt it, or able to contro...

PT-2026-85241

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.82 Description An out of bounds read exists in the CrashReporting component. This allows a remote attacker who has already compromised the renderer process to read memory outside the sandbox by using ...

Linux Distros Unpatched Vulnerability : CVE-2026-84359

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information leak in Skia in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to leak cross-origin data vi...

CVE-2026-85107: Allocation of Resources Without Limits or Throttling

A vulnerability was found in NousResearch hermes-agent 0.18.0. This vulnerability affects the function resourceBufferFromUrl of the file apps/desktop/electron/main.ts of the component Electron Main Process. Performing a manipulation results in allocation of resources. The attack may be initiated...

Linux TPM-core Device Driver Heap Buffer Overflow DoS

The vulnerability of the tpmdevrelease function in the drivers/char/tpm/tpm-chip.c module of the Linux TPM-devices driver module is related to improper inter-process communication for critical data deletion. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2026-18718 — Updated!

Advisory: GHSA-pcfh-853f-q3gh · Severity: High CVSS 7.5 · Affected: Ghidra ≤ 12.1.2 · Fixed: c03a70d Ghidra 12.1.3 Opening someone else's Ghidra project was enough to execute their code. Ghidra 12.1.2 stores analyzer options inside the program database , and one of those options is a filesystem...

Malicious code in tailwindcss-fluid-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e9b69dc0a9e6eabb685fa4be860fa456d8810c712ab300ff87023d72cf93631 src/index.js executes an evalatob... blob at top level on require. The decoded loader queries Ethereum RPC endpoints for the latest transaction from...

MAL-2026-15826 Malicious code in tailwindcss-fluid-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e9b69dc0a9e6eabb685fa4be860fa456d8810c712ab300ff87023d72cf93631 src/index.js executes an evalatob... blob at top level on require. The decoded loader queries Ethereum RPC endpoints for the latest transaction from...