EUVD-2026-56134

Nuxt versions = 4.4.7 and = 3.21.7 and 3.21.10, contain an information disclosure vulnerability in the development server's Chrome DevTools workspace endpoint GET /.well-known/appspecific/com.chrome.devtools.json. The endpoint's local-request gate isLocalDevRequest is header-based and trusts the...

CVE-2026-68189

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Protect UUID list traversal The hcisync conversion moved class-of-device and EIR generation from an HCI request built under hdev-lock to asynchronous command sync work. The worker holds hdev-reqlock, but that...

UBUNTU-CVE-2026-68189

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Protect UUID list traversal The hcisync conversion moved class-of-device and EIR generation from an HCI request built under hdev-lock to asynchronous command sync work. The worker holds hdev-reqlock, but that...

CVE-2026-68189

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Protect UUID list traversal The hcisync conversion moved class-of-device and EIR generation from an HCI request built under hdev-lock to asynchronous command sync work. The worker holds hdev-reqlock, but that...

EUVD-2026-55290

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Protect UUID list traversal The hcisync conversion moved class-of-device and EIR generation from an HCI request built under hdev-lock to asynchronous command sync work. The worker holds hdev-reqlock, but that...

CVE-2026-68189 Bluetooth: hci_sync: Protect UUID list traversal

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Protect UUID list traversal The hcisync conversion moved class-of-device and EIR generation from an HCI request built under hdev-lock to asynchronous command sync work. The worker holds hdev-reqlock, but that...

CVE-2026-68189

CVE-2026-68189 affects the Linux kernel Bluetooth hci_sync component. A race between asynchronous command sync work and UUID list updates can cause a use-after-free in eir_create due to non-serialized access to hdev->uuids. The fix/mitigation is to hold hdev->lock while generating and commi...

CVE-2026-68189 Bluetooth: hci_sync: Protect UUID list traversal

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Protect UUID list traversal The hcisync conversion moved class-of-device and EIR generation from an HCI request built under hdev-lock to asynchronous command sync work. The worker holds hdev-reqlock, but that...

Linux Distros Unpatched Vulnerability : CVE-2026-68189

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hcisync: Protect UUID list traversal The hcisync conversion moved class-of-device and EIR generation from an HCI request built under hdev-lock to...

CVE-2026-47364

In versions of the Datadog Android application prior to v545-5.9.2, the app tags Crashlytics data with the user's Datadog UUID, with no user-facing opt-out. Impact: The Datadog user UUID and crash data are visible within Firebase Crashlytics. This UUID is not identifying outside Datadog's own...

CVE-2026-47364

Summary of CVE-2026-47364 : The Datadog Android app, on every successful login, calls FirebaseCrashlytics.setUserId with the signed-in Datadog UUID (a stable per-user identifier) and ties it to the device’s Firebase installation ID on Google’s backend. Separately, uncaught exceptions are forwarde...

CVE-2026-47364

In versions of the Datadog Android application prior to v545-5.9.2, the app tags Crashlytics data with the user's Datadog UUID, with no user-facing opt-out. Impact: The Datadog user UUID and crash data are visible within Firebase Crashlytics. This UUID is not identifying outside Datadog's own...

EUVD-2026-54569

In versions of the Datadog Android application prior to v545-5.9.2, the app tags Crashlytics data with the user's Datadog UUID, with no user-facing opt-out. Impact: The Datadog user UUID and crash data are visible within Firebase Crashlytics. This UUID is not identifying outside Datadog's own...

CVE-2026-47364

In versions of the Datadog Android application prior to v545-5.9.2, the app tags Crashlytics data with the user's Datadog UUID, with no user-facing opt-out. Impact: The Datadog user UUID and crash data are visible within Firebase Crashlytics. This UUID is not identifying outside Datadog's own...

Information Exposure

Overview @nuxt/nitro-server is a Nitro server integration for Nuxt Affected versions of this package are vulnerable to Information Exposure via the Chrome DevTools workspace endpoint when the development server is bound to a network-reachable interface and experimental.chromeDevtoolsProjectSettin...

NPM: Nuxt dev server discloses project root and workspace UUID via the Chrome DevTools workspace endpoint

NPM: Nuxt dev server discloses project root and workspace UUID via the Chrome DevTools workspace endpoint vulnerability discovered by ? in WordPress Npm nuxt versions = 3.21.7, 3.21.10...

Nuxt dev server discloses project root and workspace UUID via the Chrome DevTools workspace endpoint

Impact When a Nuxt dev server is bound to a network-reachable interface for example nuxt dev --host for on-device testing, the default-enabled Chrome DevTools workspace endpoint GET /.well-known/appspecific/com.chrome.devtools.json returns the absolute project root workspace.root, i.e. rootDir an...

Malicious code in forge-gas-diff (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b1f6143f5a7c6106ab4ba0a21a6adaf9020e332835b1e528de6f36b64537734 index.js is advertised as a Foundry gas-report diff utility but on module load / CLI run schedules a setTimeout of 259,200,000 ms 3 days that calls...

ROOT-APP-NPM-GHSA-W5HQ-G745-H8PQ GHSA-w5hq-g745-h8pq in uuid - Patched by Root

Root has patched GHSA-w5hq-g745-h8pq in the uuid package for Root:npm. Multiple fixed versions available...

CVE-2026-69094 Admidio before 5.0.11 IDOR via save_temporary mylist_function.php

Admidio before 5.0.11 contains an insecure direct object reference vulnerability in the savetemporary mode of mylistfunction.php that allows authenticated users to hijack list configurations. Attackers can enumerate global list UUIDs and overwrite admin-curated global lists or other users' privat...