CVE-2026-16313

A flaw was found in sg3utils. The sginq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev...

CVE-2026-64481

A flaw was found in the Linux kernel's ALSA sound driver for the cs35l41 component. This vulnerability occurs because the driver fails to properly remove controls and cancel firmware load work during component unbinding or device removal, especially when firmware autostart is disabled. This can...

Malicious code in aone-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a8c02fc6bb23600ab64d77ac8f4d615fcf128010f26df033c40ed2dc2476b9ed Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in local-config-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fa2dd509a9d17ced72d7119cf68768f7356d3f67af131e9cbe5bfe981a626ac4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in aone-sandbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eb48e61b0c82bff5ed26f7afb8cfca9248ffe0a256db4bd9fd2e47b757e7784d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview aone-sandbox is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview local-config-parser is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-11163 Malicious code in aone-kit-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4197cd1713e045c09d745c2d3b518df40d695112f76831bd0e921031cac69606 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in smart-config-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9c23d349475bd923bd4f57440ddd7c07bbfb8b93b746788ecb4b8cc87e1ebae0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11169 Malicious code in smart-config-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9c23d349475bd923bd4f57440ddd7c07bbfb8b93b746788ecb4b8cc87e1ebae0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-41637

A flaw was found in Unbound, a Domain Name System DNS resolver. A remote attacker can exploit this vulnerability by sending and immediately terminating DNS-over-QUIC DoQ queries. This improper handling of terminated queries can lead to a build-up of pending responses, causing a degradation of...

CVE-2026-64326

A flaw was found in the Linux kernel's block device handling. When a block device is unexpectedly removed, the bdevmarkdead function can unconditionally attempt to synchronize the device, even if it is no longer present. This can lead to a system hang, effectively causing a Denial of Service DoS,...

CVE-2026-66299

Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web...

EUVD-2026-49855

Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web...

EUVD-2026-29482

Pocket ID: OIDC refresh token flow bypasses authorization revocation, account disabling, and group restrictions...

Malicious Package

Overview string-format-kit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @wagnibot/hyperliquid is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-64244

A flaw was found in the Linux kernel's memory management. This vulnerability occurs when a memory block fails to register, but its associated memory map is not properly cleared during device removal. This can lead to a system warning and potential instability or a kernel crash, allowing a local...

CVE-2026-64238

A flaw was found in the Linux kernel's gpio: shared component. A too wide critical section, intended to protect the offset field in the struct gpiosharedentry, can lead to a potential deadlock. This occurs during the removal of a shared General Purpose Input/Output GPIO proxy's parent. A successf...

grafana security, bug fix, and enhancement update

An update is available for grafana. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Grafana is an open source, feature rich metrics dashboard and graph editor fo...