MAL-2026-11723 Malicious code in @or-sdk/queue-manager (npm)

npm/@or-sdk/queue-manager is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republish...

CVE-2026-14816

The GDPR Framework By Data443 WordPress plugin before 2.4.0 does not properly verify authorization or the identity of the data subject when recording cookie-consent choices and privacy requests, allowing unauthenticated attackers to forge consent records for arbitrary email addresses and to flood...

K000162754: Linux kernel AMD KFD driver vulnerability CVE-2026-53143

Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 The v11 MQD manager incorrectly assigned the CP-compute variants of checkpointmqd/restoremqd for KFDMQDTYPESDMA queues. These...

CVE-2026-68771

ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node that allows unauthenticated remote attackers to execute arbitrary Python code by uploading a crafted pickle file and triggering its deserialization. Attackers can upload a malicious shard.pkl file via...

AlmaLinux 9 : kernel (ALSA-2026:45192)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:45192 advisory. kernel: KVM: x86: Don't recheck L1 intercepts when completing userspace I/O CVE-2025-40026 kernel: dm log: fix out-of-bounds write due to regioncount...

EUVD-2026-51027

An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fetches from MQTT. This may lead to integrity and availability loss...

CVE-2026-44092 Missing input validation / stripping of CRLF characters in SystemConfigManager

An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fetches from MQTT. This may lead to integrity and availability loss...

CVE-2026-44090

CVE-2026-44090 describes a lack of authentication exposing an MQTT broker to unauthenticated remote access. The broker is only protected by an external firewall, enabling a network attacker to potentially take full control of the device. Documented impact includes high confidentiality, integrity,...

kernel: nvmet-tcp: fix race between ICReq handling and queue teardown

A flaw was found in the Linux kernel's NVMe over TCP nvmet-tcp implementation. A race condition exists between the handling of an Initialization Connection Request ICReq and the teardown of a queue. A remote attacker, by sending an ICReq and immediately closing the connection, could trigger a...

EUVD-2026-50443

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpContentEncoder the superclass of the production handler HttpContentCompressor maintains a per-channel ArrayDeque named acceptEncodingQueue that accumulates attacker-controll...

CVE-2026-59899 Netty HttpContentEncoder: Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpContentEncoder the superclass of the production handler HttpContentCompressor maintains a per-channel ArrayDeque named acceptEncodingQueue that accumulates attacker-controll...

CVE-2026-59899 Netty HttpContentEncoder: Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpContentEncoder the superclass of the production handler HttpContentCompressor maintains a per-channel ArrayDeque named acceptEncodingQueue that accumulates attacker-controll...

EUVD-2026-50417

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by non-leader exec race Wongi and Jungwoo decoded and reported a non-leader exec related race which can result in an UAF: systimerdelete exec posixcputimerdel // Observes old leader p =...

CVE-2026-64560 posix-cpu-timers: Prevent UAF caused by non-leader exec() race

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by non-leader exec race Wongi and Jungwoo decoded and reported a non-leader exec related race which can result in an UAF: systimerdelete exec posixcputimerdel // Observes old leader p =...

CVE-2026-64560

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by non-leader exec race Wongi and Jungwoo decoded and reported a non-leader exec related race which can result in an UAF: systimerdelete exec posixcputimerdel // Observes old leader p =...

kernel: nvmet-tcp: fix race between ICReq handling and queue teardown

A flaw was found in the Linux kernel's NVMe over TCP nvmet-tcp implementation. A race condition exists between the handling of an Initialization Connection Request ICReq and the teardown of a queue. A remote attacker, by sending an ICReq and immediately closing the connection, could trigger a...

CVE-2026-64435

A flaw was found in the Linux kernel's auditing subsystem. Multiple readers could access the auditqueue length qlen concurrently with a writer without proper synchronization, leading to a data race. This race condition could result in inconsistent data reads, potentially causing unpredictable...

CVE-2026-64366

A flaw was found in the Linux kernel's Wacom Human Interface Device HID driver. This vulnerability occurs in the wacomwacqueueinsert function when handling incoming reports. Improper management of the kernel's internal buffer kfifo can lead to a slab-out-of-bounds write, allowing an attacker to...

CVE-2026-63239

The CVE-2026-63239 entry describes a vulnerability in Koollab LMS where hard-coded AWS IAM credentials are present. This flaw can allow an attacker to access shared multi-tenant S3 buckets and SQS queues, exposing sensitive data and enabling malicious content injection, job manipulation, or email...

EUVD-2026-50134

A hard-coded AWS IAM credentials vulnerability in Koollab LMS allowed an attacker to access shared multi-tenant S3 buckets and SQS queues, exposing sensitive data and enabling malicious content injection, job manipulation, or email interception...