2454 matches found
CVE-2026-68340 hwmon: occ: validate poll response sensor blocks
In the Linux kernel, the following vulnerability has been resolved: hwmon: occ: validate poll response sensor blocks The OCC poll response parser walks a counted list of sensor data blocks. It used the static backing-array capacity as the parse boundary, but a transport response makes only...
CVE-2026-68205
The CVE-2026-68205 details a Linux kernel issue in media: v4l2-fwnode where v4l2_async_register_subdev_sensor() could overwrite the sensor driver’s owner with NULL due to THIS_MODULE resolving to the v4l2-fwnode module (or NULL when built-in). This prevented the sensor module’s reference count fr...
CVE-2026-68205 media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor()
In the Linux kernel, the following vulnerability has been resolved: media: v4l2-fwnode: Fix subdev owner overwritten in v4l2asyncregistersubdevsensor The v4l2 helper v4l2asyncregistersubdevsensor calls v4l2asyncregistersubdev, which is a macro that expands to v4l2asyncregistersubdevsd,THISMODULE...
EUVD-2026-55306
In the Linux kernel, the following vulnerability has been resolved: media: v4l2-fwnode: Fix subdev owner overwritten in v4l2asyncregistersubdevsensor The v4l2 helper v4l2asyncregistersubdevsensor calls v4l2asyncregistersubdev, which is a macro that expands to v4l2asyncregistersubdevsd,THISMODULE...
CVE-2026-72586 frangoteam FUXA - Missing Authentication on DAQ_QUERY Socket.IO Event Handler
A missing authentication vulnerability in frangoteam/FUXA through 1.3.3 allows an unauthenticated remote attacker to query all historical sensor data via the DAQQUERY Socket.IO event. When secureEnabled=true, all other sensitive Socket.IO events DEVICEBROWSE, HOSTINTERFACES, DEVICETAGSREQUEST, et...
EUVD-2026-55220
A missing authentication vulnerability in frangoteam/FUXA through 1.3.3 allows an unauthenticated remote attacker to query all historical sensor data via the DAQQUERY Socket.IO event. When secureEnabled=true, all other sensitive Socket.IO events DEVICEBROWSE, HOSTINTERFACES, DEVICETAGSREQUEST, et...
CVE-2026-72586 frangoteam FUXA - Missing Authentication on DAQ_QUERY Socket.IO Event Handler
A missing authentication vulnerability in frangoteam/FUXA through 1.3.3 allows an unauthenticated remote attacker to query all historical sensor data via the DAQQUERY Socket.IO event. When secureEnabled=true, all other sensitive Socket.IO events DEVICEBROWSE, HOSTINTERFACES, DEVICETAGSREQUEST, et...
CVE-2026-72586
A missing authentication vulnerability in frangoteam/FUXA through 1.3.3 allows an unauthenticated remote attacker to query all historical sensor data via the DAQQUERY Socket.IO event. When secureEnabled=true, all other sensitive Socket.IO events DEVICEBROWSE, HOSTINTERFACES, DEVICETAGSREQUEST, et...
CVE-2026-72586 frangoteam FUXA - Missing Authentication on DAQ_QUERY Socket.IO Event Handler
A missing authentication vulnerability in frangoteam/FUXA through 1.3.3 allows an unauthenticated remote attacker to query all historical sensor data via the DAQQUERY Socket.IO event. When secureEnabled=true, all other sensitive Socket.IO events DEVICEBROWSE, HOSTINTERFACES, DEVICETAGSREQUEST, et...
PT-2026-69470
Name of the Vulnerable Software and Affected Versions frangoteam/FUXA versions prior to 1.3.4 Description A missing authentication flaw allows an unauthenticated remote attacker to query all historical sensor data. This occurs because the DAQ QUERY Socket.IO event handler in server/runtime/index....
maltrail v3.0
Maltrail Maltrail is a network traffic detection system that identifies communication with known malicious infrastructure and reports selected traffic anomalies. It matches domains, URLs, IP addresses, IP:port pairs, and User-Agent values observed on the network against a set of indicators called...
maltrail v3.0-rc1
Maltrail Maltrail is a network traffic detection system that identifies communication with known malicious infrastructure and reports selected traffic anomalies. It matches domains, URLs, IP addresses, IP:port pairs, and User-Agent values observed on the network against a set of indicators called...
ALSA-2026:51153 Important: gpsd-minimal security update
gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or USB interface, making its data on the location/course/velocity of the sensor available to be queried on TCP port 2947 of the host computer. The AlmaLinux support for this package is limited...
Tenable Sensor Proxy < 1.4.2 Code Injection (TNS-2026-21)
According to its self-reported version, the Tenable Sensor Proxy running on the remote host is prior to 1.4.2. It is, therefore, affected by code injection vulnerability as referenced in the TNS-2026-21 advisory. - A vulnerability in Tenable Sensor Proxy allows a remote attacker to execute code...
MAL-2026-13217 Malicious code in akamai-sensorv2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e5e3bd6235ef87b1f7df5dae95ccbf9868ab3f861ff4fdf0396e20dc6ec4ffb akamai-sensorv2 hides an executable payload inside a source comment in index.js composed entirely of invisible Unicode variation selectors FE00-FE0F...
Malicious code in akamai-sensorv1 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bfc0d67815042459dd2e8c526215eb8e204e0b62ae97438b320c0bd0a69a2ddf The package hides an executable payload inside a block comment in index.js using Unicode variation selectors U+FE00–U+FE0F and U+E0100–U+E01EF...
MAL-2026-12337 Malicious code in akamaijs-sensor (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14a4955c82b04226b267bc55691b0b9c08770710a7038b58e75bfdd009d046fe The package presents itself as an Akamai sensor generator but ships two coupled malicious mechanisms. index.js contains a / / comment filled with...
Malicious code in akamaijs-sensor (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14a4955c82b04226b267bc55691b0b9c08770710a7038b58e75bfdd009d046fe The package presents itself as an Akamai sensor generator but ships two coupled malicious mechanisms. index.js contains a / / comment filled with...
MAL-2026-12139 Malicious code in akamai-sensorv3 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1cece1e9d08a52387c6bf8eefd462c4b94a8bb810f87632fd3fdb105e9410e2 The package advertises itself as an 'akamai generator' but its main API is a covert remote-code-execution loader. Calling the exported sensor trigger...