CVE-2026-52923

In the Linux kernel, the following vulnerability has been resolved: ipc: limit nextid allocation to the valid ID range The checkpoint/restore sysctl path can request the next SysV IPC id through ids-nextid. ipcidralloc currently forwards that request to idralloc with an open-ended upper bound. If...

Security Bulletin: WebSphere Application Server traditional shipped with IBM Tivoli System Automation Application Manager is affected by remote code execution (CVE-2026-9330 , CVE-2026-9311)

Summary WebSphere Application Server is shipped with IBM Tivoli System Automation Application Manager. Information about a security vulnerability affecting WebSphere Application Server has been published in a security bulletin. Vulnerability Details CVEID:CVE-2026-9330 DESCRIPTION: CWE:CWE-502:...

Security Bulletin: IBM WebSphere Application Server used by IBM Tivoli System Automation Application Manager is affected by multiple vulnerabilities when using when using Web Server Plug-ins(CVE-2026-8633, CVE-2026-8620)

Summary WebSphere Application Server is used by IBM Tivoli System Automation Application Manager and is vulnerable when using Web Server Plug-ins. Required fixes for affected WebSphere Application Server have been published in the security bulletins links below. Vulnerability Details...

CVE-2026-56379

A flaw was found in ImageMagick. This command injection vulnerability in the SVG Scalable Vector Graphics decoder allows a remote attacker to craft malicious SVG files. When these files are processed, the injected Magick Vector Graphics MVG commands can execute, potentially leading to arbitrary...

CVE-2026-52923

The CVE-2026-52923 issue affects the Linux kernel IPC ID allocation in the checkpoint/restore path. ipc_idr_alloc() forwards the next_id request to idr_alloc() with an open-ended upper bound, so if the valid SysV IPC id tail is full the allocation can spill past ipc_mni. The encoded id may then r...

CVE-2026-52923 ipc: limit next_id allocation to the valid ID range

In the Linux kernel, the following vulnerability has been resolved: ipc: limit nextid allocation to the valid ID range The checkpoint/restore sysctl path can request the next SysV IPC id through ids-nextid. ipcidralloc currently forwards that request to idralloc with an open-ended upper bound. If...

CVE-2026-52922

In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: handle forward allocation error batadvdatforwarddata calls pskbcopyforclone to duplicate an skb for each DHT candidate, but does not check the return value before passing it to batadvsendskbprepareunicast4addr...

Exploit for CVE-2026-8461

CVE-2026-8461 "PixelSmash" — FFmpeg MagicYUV Heap OOB Write Po...

MAL-2026-6380 Malicious code in system-core-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a1d575b5be4daa71ffea6c37e5990b0396f864234cb5f0488c11332cdd7e4d3 On require/import, src/index.js shell-executes a hidden PowerShell one-liner that downloads launcher.bat from an anonymous Cloudflare R2 bucket...

MAL-2026-6367 Malicious code in dbt-language-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b15387169de77b4c18baf8c3f4d27156085bd06d96d0a27879545c3f0358dba8 package.json declares a preinstall hook node index.js that runs automatically on npm install. index.js collects installer-side reconnaissance data —...

EUVD-2026-38650

Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09. A specially crafted network packet can lead to command execution. An attacker can send a network request to trigger this vulnerability. libNetSetObj.so is an internal library...

MAL-2026-6373 Malicious code in twilio-voice-js-reference-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3a57b06daad43c269fe3846083da2fdce277fd1ff3a9399533072f6e894afc2 Package impersonates the Twilio Voice JS SDK namespace and ships a single exfiltration payload. package.json declares "preinstall": "node index.js",...

MAL-2026-6362 Malicious code in monty-data (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d234eb20e94a8d34b23f4aed0a562eb1c038ce5bd603856546c970152a70ac5 On npm install, the package's postinstall hook package.json declares "postinstall": "node bin/cli.js" automatically runs a data-collection CLI withou...

MAL-2026-6359 Malicious code in html-to-gutenberg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3edf079490239b2b4c592ce4b7094c8089596437c15a73972ebd8282484a5273 Analysis of [email protected] surfaced no a static rule matches and no traced behaviors indicating credential access, install-time remote code...

PT-2026-52124

Name of the Vulnerable Software and Affected Versions ATEN Unizon affected versions not specified Description An issue in the restoreDB function allows authenticated remote attackers to execute arbitrary code in the context of SYSTEM. This occurs due to insufficient validation of a user-supplied...

PT-2026-51716

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the checkpoint/restore sysctl path where the ipc idr alloc function forwards requests to idr alloc with an open-ended upper bound. When the valid SysV IPC id space is...

PT-2026-51862

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the KVM s390 PCI implementation where the GAIT table is indexed using double-scaling pointer arithmetic. The functions kvm s390 pci aif enable, kvm s390 pci aif disabl...

PT-2026-52182

Name of the Vulnerable Software and Affected Versions OliveTin affected versions not specified Description The filterToDefinedArgumentsOnly function in the executor fails to properly restrict arguments, allowing any argument starting with the ot prefix to bypass input filtering. While the system ...

PT-2026-52145

Name of the Vulnerable Software and Affected Versions Quest NetVault Backup affected versions not specified Description An authentication bypass issue exists within the 'addclient3' webpage due to improper validation of user-supplied data. This allows remote attackers to inject arbitrary scripts,...

PT-2026-51920

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the nfsd4 add rdaccess to wrdeleg function where the nfs4 file get access function may be incorrectly called to increment the nfs4 file access count if fp-fi fdsO RDON...