DEBIAN-CVE-2026-74288

In the Linux kernel, the following vulnerability has been resolved: net: fibrules: Don't dump dying fibrule in fibrulesdump. rockerrouterfibevent calls fibruleget during RCU dump. If the fibrule is dying, refcountinc will complain about it. Let's call refcountincnotzero in fibrulesdump...

DEBIAN-CVE-2026-72194

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: add depth limit to indxfindbuffer to prevent stack overflow indxfindbuffer recursively descends the B+ tree index with no depth limit. A crafted NTFS image with circular index node references causes unbounded recursion,...

DEBIAN-CVE-2026-68326

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: bound uAP association event IEs to the event buffer mwifiexprocessuapevent handles EVENTUAPSTAASSOC by exposing the reassociation request IEs that the firmware copies into the event: sinfo-assocreqies =...

@ascua/electron (>=0.8.0, <=0.18.0), @eltmon/panctl (0.7.2-canary.3) +11 more potentially affected by CVE-2026-70604 via electron (>=40.0.0, <=40.8.5)

electron NPM version =40.0.0, =0.8.0, =4.0.0, =0.30.0, =0.8.0, =1.1.0-rc-1, =1.0.0, =1.142.0, =0.1.5, =1.2.1, =2.0.4, =3.24.1 Source cves: CVE-2026-70604 Source advisory: SNYK:JS-ELECTRON-18563330...

NewStart CGSL MAIN 6.06 : bluez Vulnerability (NS-SA-2026-0059)

The remote NewStart CGSL host, running version MAIN 6.06, has bluez packages installed that are affected by a vulnerability: - Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboard reports,...

@bpmiq/mcp (>=1.0.0, <=2.3.0), @bpmiq/validator (>=1.0.0, <=2.3.0) +30 more potentially affected by CVE-2026-73569 via fast-xml-parser (>=5.9.3, <=5.10.0)

fast-xml-parser NPM version =5.9.3, =1.0.0, =1.0.0, =0.1.0, =1.18.42-test.0, =1.6.6, =0.24.0, =5.1.22, =5.1.22, =0.0.1, =0.0.1, =49.13.0, =50.0.0, =2.4.0, =2.4.2 and more Source cves: CVE-2026-73569 Source advisory: OSV:GHSA-8R6M-32JQ-JX6Q...

MiracleLinux 8 : python-pillow-5.1.1-22.el8_10 (AXSA:2026-1268:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1268:01 advisory. python-pillow: Pillow: Denial of Service via crafted BDF font file CVE-2026-55379 python-pillow: Pillow: Denial of Service via crafted GD 2.x image...

GHSA-X5P7-9CW8-WR27 vulnerabilities

Vulnerabilities for packages: chromium...

@0xtender/events-schema-generator (>=0.0.4, <=0.2.11), @11ty/eleventy (3.0.0-alpha.16) +167 more potentially affected by CVE-2026-45617 via liquidjs (>=10.2.0, <=10.25.7)

liquidjs NPM version =10.2.0, =0.0.4, =0.6.0, =0.1.0, =0.0.0, =0.5.5, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.2, =0.0.1-alpha.0, =0.0.1-alpha.2, =0.0.1-alpha.0, =0.8.0, =0.31.16 - @altipla/directus-sdk-utils 0.7.2 and more Source cves: CVE-2026-45617 Source advisory: OSV:GHSA-R7G9-XPMJ-5FCQ...

CLEANSTART-2026-MX56097 Security fixes for CVE-2026-25679, CVE-2026-27139, CVE-2026-27142, CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32289, CVE-2026-33186, CVE-2026-33811, CVE-2026-33814, CVE-2026-39820, CVE-2026-39823, CVE-2026-39825, CVE-2026-39826, CVE-2026-39836, CVE-2026-42499, ghsa-p77j-4mvh-x3m3, ghsa-vvgc-356p-c3xw applied in versions: 1.7.0-r0, 1.7.0-r1

Multiple security vulnerabilities affect the yunikorn-k8shim-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

@bloggrify/bento (>=3.0.0, <=3.0.1), @bloggrify/core (>=3.0.0, <=3.1.2) +16 more potentially affected by CVE-2026-46342 via @nuxt/nitro-server (>=4.2.0, <=4.4.5)

@nuxt/nitro-server NPM version =4.2.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =4.2.2-depup.0, =10.0.2-rc.5, =1.1.11, =1.0.8, =0.4.5, =3.0.0-dev.27, =4.2.0, =0.5.0, =1.0.1, =0.4.0, =0.1.13, =0.2.2 and more Source cves: CVE-2026-46342 Source advisory: SNYK:JS-NUXTNITROSERVER-16770417...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload and worm propagation logic. A malicious actor associated with the "TeamPCP" or "Mini Shai-Hulud" campaign compromised a maintainer's access token; this allowed the...

@piksail/strapi-plugin-publish-coolify (0.0.1), cypherscan-strapi (0.1.1) +4 more potentially affected by CVE-2025-64526 via @strapi/plugin-users-permissions (>=5.11.0, <=5.42.1)

@strapi/plugin-users-permissions NPM version =5.11.0, =0.1.0, =0.1.4 - stronges 0.1.1 - test-lead 0.1.0 Source cves: CVE-2025-64526 Source advisory: OSV:GHSA-7MQX-WWH4-F9FW...

Arbitrary Code Injection

Overview @jswork/next-npm-version is a Get npm package version. Affected versions of this package are vulnerable to Arbitrary Code Injection via the process that handles user-supplied input. An attacker can execute arbitrary system commands by supplying crafted input that is improperly sanitized...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @agentforce/adk (>=0.9.0, <=0.12.1) +543 more potentially affected by CVE-2026-56762 via hono (>=4.0.0, <=4.12.10)

hono NPM version =4.0.0, =0.3.1, =0.9.0, =0.1.9, =0.2.0, =0.2.0, =0.4.0, =0.2.0, =0.0.1, =1.0.2, =2.0.0-beta.66, =2.0.0-beta.78, =2.0.0-beta.66, =0.0.1, =0.0.1, =1.0.0 and more Source cves: CVE-2026-56762 Source advisory: OSV:GHSA-26PP-8WGV-HJVM...

@ascua/electron (>=0.8.0, <=0.18.0), @eltmon/panctl (0.7.2-canary.3) +10 more potentially affected by CVE-2026-34775 via electron (>=40.0.0, <=40.7.0)

electron NPM version =40.0.0, =0.8.0, =4.0.0, =0.30.0, =0.8.0, =1.1.0-rc-1, =1.0.0, =1.142.0, =0.1.5, =1.2.1, =2.0.4, =3.24.1 Source cves: CVE-2026-34775 Source advisory: SNYK:JS-ELECTRON-15876334...

@amqp-contract/asyncapi (>=0.2.0, <=0.20.0), @c15t/backend (>=1.1.0-canary.0, <=1.8.5) +13 more potentially affected by CVE-2026-33331 via @orpc/openapi (>=1.0.0-beta.1, <=1.13.8)

@orpc/openapi NPM version =1.0.0-beta.1, =0.2.0, =1.1.0-canary.0, =1.1.0-canary.0, =1.2.0-canary.0, =1.2.2-canary-20250514183211, =1.2.0-canary.8, =1.2.0-canary.0, =0.1.0, =0.4.2, =1.0.0-beta.2, =0.0.0, =0.0.0, =1.0.0-beta.2, =1.0.0-beta.1, =1.2.0-canary.0, =1.8.5 Source cves: CVE-2026-33331 Sour...

@adpush/start (>=1.87.14, <=1.87.16), @akkuma/vinxi (0.3.12) +215 more potentially affected by CVE-2026-33128 via h3 (>=1.0.1, <=1.15.5)

h3 NPM version =1.0.1, =1.87.14, =1.0.7, =1.0.0, =1.5.0, =1.0.0, =0.8.16-canary.v20250123185645, =8.3.3, =3.1.0, =0.0.11, =3.1.0-0, =3.2.0 - @enrypase/solidstart-endpoint 0.1.0 and more Source cves: CVE-2026-33128 Source advisory: OSV:GHSA-22CC-P3C6-WPVM...

Use After Free

Overview Magick.NET-Q16-HDRI-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

CVE-2026-24400 affecting package javapackages-bootstrap for versions less than 1.14.0-4

CVE-2026-24400 affecting package javapackages-bootstrap for versions less than 1.14.0-4. A patched version of the package is available...