MAL-2026-13998 Malicious code in async-critical-section (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 933cc6900114e5aef5a4b89e0c20c0242cf368b5322cf260ae395c75cc97552f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Parents take on Meta, TikTok, Google, and Snap in 3,000 youth safety lawsuits

A group of big tech firms is fighting to stop roughly 3,000 youth safety lawsuits from moving forward, and they just lost a critical procedural battle in court. The lawsuits, brought by attorneys general and families, allege that Meta, Google, ByteDance's TikTok, and Snap knew their products were...

AZL-95556 CVE-2026-73072 affecting package vim for versions less than 9.2.0957-1

Vim is an open source, command line text editor. Prior to 9.2.0846, setsofo in src/spellfile.c reuses slsalfirst without resetting values left by setsalfirst, so a crafted spell file containing an SNSAL section before an SNSOFO section causes under-counted mapping lists and attacker-influenced...

CVE-2026-68393

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: extend connhash lookup critical sections Using RCU-protected pointers outside the critical sections without refcount is incorrect and may result to UAF. Extend critical section to cover both hciconnhash lookup...

Linux Distros Unpatched Vulnerability : CVE-2026-68286

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dropmonitor: perform u64stats updates under IRQ-disabled section In netdmpackettracekfreeskbhit and netdmhwtrappacketprobe, u64statsupdatebegin / u64statsinc /...

JLSEC-2026-1236

libexpat before 2.8.2 does not consider XMLTOKDATACHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219...

XML injection vulnerability in QDom comment, CDATA and processing-instruction serialization

...

ROS-20260806-73-0002

The vulnerability of the populatesectionmemmap function in the Linux operating system is related to improper cleanup or release of resources. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-10709

The CVE-2026-10709 entry concerns Autodesk FBX SDK: a crafted FBX file can trigger a stack-based buffer overflow in fbxsdk::FbxIO::BinaryReadSectionHeader. The vulnerability allows arbitrary code execution in the hosting process. Documents identify the affected component as the Autodesk FBX SDK’s...

SUSE CVE-2026-67326

GitPython before 3.1.50 fails to validate newline characters in the section parameter of configwriter, allowing attackers to inject arbitrary section headers into .git/config. Attackers can inject newlines to create a forged core section with hooksPath pointing to attacker-controlled directories,...

CVE-2026-67326

A flaw was found in GitPython. This vulnerability allows attackers to inject newline characters into the section parameter of the configwriter function, leading to the injection of arbitrary section headers into the .git/config file. By forging a core section with a malicious hooksPath, an attack...

CVE-2026-69097

GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous config keys into the victim's .git/config via...

CVE-2026-69097 GitPython before 3.1.53 Config Injection via Submodule Names

GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous config keys into the victim's .git/config via...

CVE-2026-69097

GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous config keys into the victim's .git/config via...

UBUNTU-CVE-2026-67326

GitPython before 3.1.50 fails to validate newline characters in the section parameter of configwriter, allowing attackers to inject arbitrary section headers into .git/config. Attackers can inject newlines to create a forged core section with hooksPath pointing to attacker-controlled directories,...

CVE-2026-67326

GitPython before 3.1.50 fails to validate newline characters in the section parameter of configwriter, allowing attackers to inject arbitrary section headers into .git/config. Attackers can inject newlines to create a forged core section with hooksPath pointing to attacker-controlled directories,...

CVE-2026-67326 GitPython before 3.1.50 Newline Injection via config_writer section

GitPython before 3.1.50 fails to validate newline characters in the section parameter of configwriter, allowing attackers to inject arbitrary section headers into .git/config. Attackers can inject newlines to create a forged core section with hooksPath pointing to attacker-controlled directories,...

CVE-2026-67326 GitPython before 3.1.50 Newline Injection via config_writer section

GitPython before 3.1.50 fails to validate newline characters in the section parameter of configwriter, allowing attackers to inject arbitrary section headers into .git/config. Attackers can inject newlines to create a forged core section with hooksPath pointing to attacker-controlled directories,...

binutils: GNU Binutils: Local denial of service via null pointer dereference in Section Merge

A flaw was found in GNU Binutils. This vulnerability, located in the bfdwritemergedsection function within the Section Merge component, allows a local attacker to trigger a null pointer dereference. This can lead to a denial of service DoS condition, making the affected system or application...

binutils: GNU Binutils: Null pointer dereference via SHT_GROUP Section manipulation

A flaw was found in GNU Binutils. A local attacker can exploit this vulnerability by manipulating the SHTGROUP Section. This manipulation can lead to a null pointer dereference within the bfdelfsetgroupcontents function. The primary consequence of this flaw is a denial of service...