Linux kernel Cryptographic Subsystem Heap Buffer Overflow DoS

The vulnerability of the x509processextension function in the crypto/asymmetrickeys/x509certparser.c module of the Linux kernel’s cryptographic subsystem is related to the execution of operations outside of the buffer boundaries in memory. Exploiting this vulnerability could allow an attacker to...

netfilter BPF Buffer Overflow

The vulnerability of the bpfnflinkupdate function in the net/netfilter/nfbpflink.c module of the netfilter component of the Linux operating system is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...

vdpa Linux Driver Heap Buffer Overflow DoS

The vulnerability of the vdpanlpolicy structure in the drivers/vdpa/vdpa.c file of the vDPA device driver for the Linux operating system is related to incorrect assumptions regarding the organization of data or memory. Exploiting this vulnerability could allow an attacker to compromise the...

netfilter xt_ct_tgDestroy Heap Buffer Overflow DoS

The vulnerability of the xtcttgDestroy function in the net/netfilter/xtCT.c module of the netfilter component of the Linux operating system is related to errors during the update of the link counters. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity...

Linux USB Device Driver Use-After-Free

The vulnerability of the checkcommandsizeinblocks function in the drivers/usb/gadget/function/fmassstorage.c file of the Linux device driver framework is related to integer overflow. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

ToxicPanda 2.0 can take over your Android phone and banking apps

Researchers have uncovered ToxicPanda 2.0, an Android banking Trojan and remote-access tool designed for account takeover and “on-device fraud.” Not only does ToxicPanda 2.0 have a much larger target list of banks and e-wallets, it has also expanded its capabilities by combining banking overlays,...

GitPython sm_name() Function

The vulnerability of the smname function in the src/GitPython/git/objects/submodule/util.py file of the Python library for interacting with Git repositories in GitPython is related to an incorrect limitation on the path name for the directory. Exploiting this vulnerability could allow a malicious...

ROS-20260821-73-0063

The vulnerability of the rdsrecvtracklatency function in the Linux operating system’s kernel is related to a single-shift error. Exploiting this vulnerability could allow an attacker to compromise the accessibility of protected information...

ROS-20260821-73-0056

The vulnerabilities of the functions virtiommioreleasedev and virtiommioprobe in the drivers/virtio/virtiommio.c module related to the virtio chipset support in Linux operating systems are associated with operations involving resources after their expiration time. Exploiting these vulnerabilities...

ROS-20260821-73-0004

The vulnerability of the nftchainlookupbyid function in the net/netfilter/nftablesapi.c module of the netfilter component of the Linux operating system is related to the use of a previously released resource. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...

ROS-20260821-73-0017

The vulnerabilities of the functions freeirqcpurmap, irqcpurmaprelease, and irqcpurmapadd in the lib/cpurmap.c module of the Linux operating system are related to the re-use of previously freed memory. Exploiting these vulnerabilities could allow an attacker to compromise the confidentiality,...

puput (2.0.0), wagtail-all-in-one-accessibility (>=1.1.0, <=1.8.0) +4 more potentially affected by unknown CVE via wagtail (5.0.5)

wagtail PYPI version 5.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - puput 2.0.0 - wagtail-all-in-one-accessibility =1.1.0, =5.0.0, =3.10.1, =0.0.1, =0.0.2 Source cves: unknown CVE Source advisory:...

puput (2.0.0), wagtail-all-in-one-accessibility (>=1.1.0, <=1.8.0) +4 more potentially affected by unknown CVE via wagtail (5.0.5)

wagtail PYPI version 5.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - puput 2.0.0 - wagtail-all-in-one-accessibility =1.1.0, =5.0.0, =3.10.1, =0.0.1, =0.0.2 Source cves: unknown CVE Source advisory:...

aratinga (0.1.0a0.dev3), coop (>=7.1.0, <=7.2.1) +7 more potentially affected by CVE-2026-54261 via wagtail (>=7.1.0, <=7.2.3)

wagtail PYPI version =7.1.0, =7.1.0, =1.1.1, =2.0.0, =0.0.1, =7.1.0a1, =7.2.0b0 Source cves: CVE-2026-54261 Source advisory: OSV:GHSA-R6P4-GRQ7-XM4M...

ToxicPanda 2.0 and GoldDigger Expand Android Banking Attacks with On-Device Fraud

Cybersecurity researchers have shed light on an updated version of ToxicPanda aka TgToxic that comes with "significant enhancements," including a set of 167 remote commands and expands its targeting footprint globally. Zimperium zLabs, in a Wednesday report, said the Android malware also features...

ROS-20260818-73-0012

The vulnerability of the Node.js software platform is related to an uncontrolled consumption of resources. Exploiting this vulnerability can allow a remote attacker to compromise the accessibility of protected information...

About the security content of iOS 18.7.10 and iPadOS 18.7.10

About the security content of iOS 18.7.10 and iPadOS 18.7.10 This update delivers security fixes that were first made available in the iOS 26.6 and 27 and iPadOS 26.6 and 27 betas. This document describes the security content of iOS 18.7.10 and iPadOS 18.7.10. About Apple security updates For our...

WindRelay Android Malware Turns Victims' Phones Into NFC Relays for Payment Fraud

A previously unseen Android near field communication NFC relay malware family dubbed WindRelay is being deployed in conjunction with a known remote access trojan RAT called SpyNote as part of a contactless payment fraud scheme. The purpose-built malware, according to Group-IB, is designed to...

firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to use-after-free in the Disability Access APIs component...

CVE-2026-61358

The CVE-2026-61358 entry concerns Windows Accessibility Infrastructure (ATBroker.exe) with an improper link resolution before file access (‘link following’) vulnerability that allows an authorized, local attacker to elevate privileges. Reported CVSSv3.1: 7.8 (HIGH) with Local access, Low attack c...