DataEase <= 2.4.1 - Sensitive Information Exposure

DataEase, an open source data visualization and analysis tool, has a database configuration information exposure vulnerability prior to version 2.5.0. Visiting the /de2api/engine/getEngine;.js path via a browser reveals that the platform's database configuration is returned. id: CVE-2024-30269...

CVE-2026-12001

A hardcoded credential vulnerability exists in the firmware of multiple TP-Link routers TL-WR845N v4, TL-WR850N v3, Archer C20 v6 & Archer MR200 v5. Authentication-related credential material is embedded within a password file in the firmware image and may be recovered through firmware analysis...

UBUNTU-CVE-2026-45623

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the / sourceMappingURL=PATH / comment from any CSS string passed to process and dereferences PATH against the...

Daylight Security Launches Detection Program Visibility

Daylight Security adds Detection Program Visibility to unify detections, map coverage to MITRE ATT&CK, and help MDR customers spot gaps and improve results...

Modeling Local Exploit Hazard - a Bayesian Framework for Quantifying Exploit Risk and Operational Efficiency

This paper presents a local exploit hazard model : a Bayesian framework that converts the global probabilities produced by an exploit likelihood model ELM, such as the Exploit Prediction Scoring System EPSS, into a daily exploit hazard rate for an organization's own assets. The model measures the...

CVE-2026-64449

In the Linux kernel, the following vulnerability has been resolved: staging: vmeuser: bound slave read/write to the kernbuf size The SLAVE-path helpers buffertouser and bufferfromuser copy 'count' bytes into/out of the fixed-size kernbuf sizebuf == PCIBUFSIZE == 0x20000, 128 KiB using ppos as the...

UBUNTU-CVE-2026-64463

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpcirt1711h: unregister TCPCI port with devres rt1711hprobe registers the TCPCI port before requesting the interrupt and enabling alert interrupts. If either of those later steps fails, the probe function returns...

UBUNTU-CVE-2026-64338

In the Linux kernel, the following vulnerability has been resolved: USB: misc: uss720: unregister parport on probe failure uss720probe registers a parport before reading the 1284 register used to detect unsupported Belkin F5U002 adapters. If get1284register fails, the error path drops the driver...

UBUNTU-CVE-2026-64348

In the Linux kernel, the following vulnerability has been resolved: usb: free iso schedules on failed submit EHCI and FOTG210 isochronous submits build an ehciisosched before linking the URB to the endpoint queue, and keep the staged schedule in urb-hcpriv until isostreamschedule and the link...

Malicious code in identityscimapiserv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7c77102d108de4236b5ff8d121143aaa19efde51a10e4f63a6f79ad2dc982c34 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in xo-member-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8f87897415ac7cb1f40cf896ec879d2a71a642d3361935df0758944a34389b13 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in f0-form-manipulator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b44787fd6b711e395dc87ae7f5235d0e80d5591a925f9149319aa7d6ba3f0f72 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11060 Malicious code in f0-form-manipulator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b44787fd6b711e395dc87ae7f5235d0e80d5591a925f9149319aa7d6ba3f0f72 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11062 Malicious code in preferenceslifecycle-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8741695d3ce21420a88f903f03c16da4621561d07117127b656f91488c9b58f5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11056 Malicious code in gpaas-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 04c01a5b087d1c4d6ae8700fd1fee92cdb45c5a77f59a62723b17b5aa43e7f5d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in payoutsvettingserv-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 32d630492188c1db46669f68ec67e108a452a185dceb46b7fd0cb3bc939e865b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-64463 usb: typec: tcpci_rt1711h: unregister TCPCI port with devres

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpcirt1711h: unregister TCPCI port with devres rt1711hprobe registers the TCPCI port before requesting the interrupt and enabling alert interrupts. If either of those later steps fails, the probe function returns...

Linux Distros Unpatched Vulnerability : CVE-2026-64463

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: typec: tcpcirt1711h: unregister TCPCI port with devres rt1711hprobe registers the TCPCI port before requesting the interrupt and enabling alert interrupts...

Malicious code in @daylightqc/date-fmt-lite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62c563208137dbdd6b4c26764222942e2b81e815349b596518ff4db5a652b2bf The package declares a postinstall script postinstall.js that runs automatically on npm/pnpm install and POSTs host identifiers hostname, whoami, pwd...

MAL-2026-11041 Malicious code in @daylightqc/date-fmt-lite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62c563208137dbdd6b4c26764222942e2b81e815349b596518ff4db5a652b2bf The package declares a postinstall script postinstall.js that runs automatically on npm/pnpm install and POSTs host identifiers hostname, whoami, pwd...