Malicious code in base65-77x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef76e83f2641fcfacf488a6ef61447fac81f6a24cff6287b407a385374b9ddf7 The package impersonates base-x name, description, keywords, and homepage copied from base-x and patches the advertised decode function in both the...

MAL-2026-13749 Malicious code in base65-33x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4e22e29bf42b32b80c5336d5f38d10d96879c84f162d86565289b588253589b Package name resembles the popular base-x encoder/decoder. The exported decodestring function in both CJS and ESM entrypoints POSTs its caller-suppli...

Malicious code in base65-33x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4e22e29bf42b32b80c5336d5f38d10d96879c84f162d86565289b588253589b Package name resembles the popular base-x encoder/decoder. The exported decodestring function in both CJS and ESM entrypoints POSTs its caller-suppli...

Malicious code in base65-15x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00fcb69b2f5c7e64ede8df36e3865dad82632ef076c6c2974b568727ec046062 base65-15x is a typosquat of the base-x package. Its decode function does not perform base decoding; instead it POSTs the caller-supplied string...

MAL-2026-13748 Malicious code in base65-15x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00fcb69b2f5c7e64ede8df36e3865dad82632ef076c6c2974b568727ec046062 base65-15x is a typosquat of the base-x package. Its decode function does not perform base decoding; instead it POSTs the caller-supplied string...

CVE-2026-68172

A flaw was found in the Linux kernel, specifically within the hugeptepget helper function for the arm64 architecture. When this function is provided with an unaligned virtual address, it can incorrectly process Page Table Entries PTEs. This can lead to the kernel dereferencing invalid memory...

CVE-2026-68164

A flaw was found in the Linux kernel's DAMON Data Access MONitor subsystem. The damonsetregions function, responsible for setting memory monitoring regions, incorrectly processes unsorted or overlapping input ranges due to a missing validation check. This can lead to unexpected behavior in DAMON...

CVE-2026-68209

A flaw was found in the Linux kernel's sun4i-csi media driver. When the startstreaming function fails, the vb2 framework does not properly return queued buffers, causing a buffer leak. This issue could lead to resource exhaustion and potentially a Denial of Service DoS condition on the affected...

CVE-2026-68237

A flaw was found in the Linux kernel's drm/amdgpu/userq component. During a GPU reset, the prereset function only force-completes fences for mapped queues. If a queue is in another state, its last fence remains pending and never signals after the reset. This can cause the eviction/suspend worker...

CVE-2026-68180

A flaw was found in the intelth Intel Trace Hub driver within the Linux kernel. This vulnerability occurs because the intelthoutputopen function acquires a device reference that is not properly released by the intelthmscrelease function when handling Message Signaled Interrupt MSC outputs...

CVE-2026-68184

A flaw was found in the Linux kernel's CD-ROM cdrom driver. When handling the CDROMVOLCTRL command, the mmcioctlcdromvolume function can perform an incorrect calculation of buffer length after a pointer adjustment. This leads to a stack out-of-bounds read, where 8 bytes of data beyond the intende...

CVE-2026-68256

A flaw was found in the drm/amd/display component of the Linux kernel. This issue occurs in the detectlinkandlocalsink function, where a prevsink reference is not properly released if the DisplayPort DP alt mode timeout path returns false. This missing cleanup can lead to a memory leak, potential...

CVE-2026-68262

A flaw was found in the Linux kernel. The drm/imagination component's pvrsetuobjarray function mishandles the user array stride during copies of kernel objects to a userspace array. This error causes incorrect memory access, leading to memory corruption where data is written to unintended...

CVE-2026-68224

A flaw was found in the Linux kernel's mali-c55 driver. This vulnerability occurs because the mediapadremotepadunique function's error return value an ERRPTR was not properly checked before being dereferenced in the enablestreams function. A local attacker could exploit this oversight, potentiall...

CVE-2026-68232

A flaw was found in the Linux kernel's drm/gpusvm component. When the kvmallocarray function fails within drmgpusvmrangeevict, a previously acquired memory management MM reference is not properly released. This oversight leads to a reference leak, which can result in resource exhaustion and a...

CVE-2026-73226 Electerm WebSocket `upgrade-func` and `fs` handlers allow arbitrary method/function invocation due to missing method-name allowlist

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.186, electerm allows an authenticated WebSocket client to invoke unintended internal functions through client-controlled func values in upgrade-func in src/app/server/dispatch-center.js and...

CVE-2026-73226 Electerm WebSocket `upgrade-func` and `fs` handlers allow arbitrary method/function invocation due to missing method-name allowlist

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.186, electerm allows an authenticated WebSocket client to invoke unintended internal functions through client-controlled func values in upgrade-func in src/app/server/dispatch-center.js and...

CVE-2026-73226 Electerm WebSocket `upgrade-func` and `fs` handlers allow arbitrary method/function invocation due to missing method-name allowlist

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.186, electerm allows an authenticated WebSocket client to invoke unintended internal functions through client-controlled func values in upgrade-func in src/app/server/dispatch-center.js and...

CVE-2026-68221

A flaw was found in the Linux kernel's Nuvoton NPCM video driver. The npcmvideoprobe function allocates memory that is not properly freed on error paths or during device removal, leading to memory leaks. Additionally, when npcmvideosetupvideo fails, associated reserved memory is not released. The...

CVE-2026-68187

A flaw was found in the Linux kernel's exec subsystem, specifically within the transferargstostack function. A local user could provide a specially crafted argument or environment string during process creation, causing an unsigned loop counter to wrap. This leads to an out-of-bounds read and...