Malicious Package

Overview dumb-binding-gyp-package is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview hydration-vli-ui is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

SUSE CVE-2026-74725

In the Linux kernel, the following vulnerability has been resolved: enic: fix txhangreset use-after-free on device removal enicremove cancels the reset and changemtuwork items but does not cancel txhangreset. A TX timeout that fires while the device is being removed can schedule enictxhangreset s...

PT-2026-82135

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ovpn component where crypto completion callbacks do not properly manage references to the key-slot and peer. Specifically, the peer reference pins the netdev, and...

PT-2026-82172

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the atmel-mci driver due to a race condition in the atmci remove function. The &host-bh work variable is bound to the atmci work func function and can be...

Linux Distros Unpatched Vulnerability : CVE-2026-80556

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mmc: atmel-mci: Fix use-after-free in atmciremove due to race condition In atmciprobe, &host-bhwork is bound with atmciworkfunc, and atmciinterrupt,...

CVE-2026-80195: Improper Enforcement of Behavioral Workflow

Kimai before 2.63.0 contains a business logic / improper authorization vulnerability in the team update API endpoint PATCH /api/teams/id, which removes all existing team members before validating the submitted replacement member list. An authenticated teamlead or other user with permission to edi...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098799)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098799 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: fix missing lastunlinktrans update when removing a directory When removing a directory we...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098903)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098903 advisory. In the Linux kernel, the following vulnerability has been resolved: nfsd: release layout stid on setlease failure nfs4allocstid publishes the new stid into...

CVE-2026-80195

Kimai before 2.63.0 has a business logic / improper authorization flaw in the team update API endpoint (PATCH /api/teams/{id} ). The endpoint deletes all existing team membership rows before validating the submitted replacement member list. An authenticated user with team-edit permission can ther...

CVE-2026-80195 Kimai before 2.63.0 Team Membership Removal via API

Kimai before 2.63.0 contains a business logic / improper authorization vulnerability in the team update API endpoint PATCH /api/teams/id, which removes all existing team members before validating the submitted replacement member list. An authenticated teamlead or other user with permission to edi...

CVE-2026-62861 TypeBot: Cross-tenant custom-domain removal via unbound `name` in handleDeleteCustomDomain

TypeBot is a chatbot builder tool. Prior to 3.18.0, any authenticated non-guest workspace member can remove another workspace's public custom domain and make typebots on that domain unavailable. The custom-domain delete handler in handleDeleteCustomDomain.ts authorizes a caller against a...

Malicious code in voice-crate-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d4e872ad9052cdd5d86c4c1656c57e5a899513853824efc24d4636a3c1679e3 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

The vulnerabilities of the functions remove_unready_flow() and mlx5e_tc_del_fdb_flow() in the driver/net/ethernet/mellanox/mlx5/core/en_tc.c file of the Mellanox Ethernet network adapter driver for the Linux operating system, which allow attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the functions removeunreadyflow and mlx5etcdelfdbflow in the driver/net/ethernet/mellanox/mlx5/core/entc.c file of the Mellanox Ethernet network adapter driver for the Linux operating system is related to synchronization errors when using shared resources. Exploiting this...

CVE-2026-74725

A flaw was found in the Linux kernel's enic driver. During device removal, a timing issue can occur where a transmit TX timeout schedules a reset operation after the device's memory has been freed. This leads to a use-after-free vulnerability, a type of memory corruption where the system attempts...

CVE-2026-74727

A flaw was found in the Linux kernel's ovpn module. A race condition can occur when an OpenVPN ovpn peer is removed concurrently while the system attempts to rehash it. This can lead to the peer being re-inserted into internal tables after it has been logically removed, creating a Use-After-Free...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: The calltrace warning in amddrmbuddyfini has been fixed. The following call trace was observed when the amdgpu driver was removed. This issue arises because the BOs allocated for psp are not freed until the driver is...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Nullifies the cq-dbg pointer in mlx5debugcqRemove Before this patch, if mlx5CoreDestroyCq failed, the destruction operations continued. However, mlx5CoreDestroyCq could be called again by the user, causing additional...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: gpio: mockup: Fixed a NULL pointer dereferencing issue when removing debugfs. We now remove the debugfs entries of the device when unbinding the driver. This now causes a NULL-pointer dereferencing issue at the end of the module,...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftsocket: The WARNONONCE message was removed when the maximum cgroup level was set. By default, the maximum depth of a cgroup is INTMAX. There’s a setting that allows restricting this maximum depth to a more reasonabl...