CVE-2026-68107 drm/amdgpu/vcn4: avoid rereading IB param length

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn4: avoid rereading IB param length Reuse the parameter length returned by vcnv40encfindibparam instead of rereading it from the IB. This avoids a potential TOCTOU issue if the IB contents change between reads. cherr...

CVE-2026-64595

In the Linux kernel, the following vulnerability has been resolved: HID: hid-lenovo-go: cancel cfgsetup work in hidgocfgremove hidgocfgprobe initialises drvdata.gocfgsetup and schedules it to run 2 ms later: INITDELAYEDWORK&drvdata.gocfgsetup, &cfgsetup; scheduledelayedwork&drvdata.gocfgsetup,...

EUVD-2026-53782

In the Linux kernel, the following vulnerability has been resolved: HID: hid-lenovo-go: cancel cfgsetup work in hidgocfgremove hidgocfgprobe initialises drvdata.gocfgsetup and schedules it to run 2 ms later: INITDELAYEDWORK&drvdata.gocfgsetup, &cfgsetup; scheduledelayedwork&drvdata.gocfgsetup,...

MAL-2026-12933 Malicious code in bnpl-blocks-desktop-bnpl-news-cards (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4c8c28332f033f4a53e19a9c2555f07d05be868631e953e2c3156b50ed2e397 On require, index.js loads shim.js which reconstructs C2 hostnames from split string arrays Cloudflare Workers subdomains...

MAL-2026-13042 Malicious code in boxy-esm-shims (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8f8bbecdfed31ec416782f6de127cb1003692978560504d748acd121b30fa3b On require of the package, index.js loads vendor.js which fetches an opaque binary from string-obfuscated Cloudflare Workers hosts...

Malicious code in checkout-input-card-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1cc552600295f6b008943a756a1cf29218d2e6d93a40dd72ea4cd06f039f80cb On require of the package, index.js loads vendor.js, which downloads a platform-specific binary from Cloudflare Workers subdomains...

Malicious Package

Overview test-dev-link is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @peptide-packets/js-unimode is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview @dexwilt/node-fetch is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview react-fast-refresh-helper is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

The vulnerabilities of the functions batadv_bla_claim_dump_entry() and batadv_bla_backbone_dump() in the net/batman-adv/bridge_loop_avoidance.c module of the Linux kernel allow a hacker to trigger a service failure.

The vulnerability of the functions batadvblaclaimdumpentry and batadvblabackbonedump in the net/batman-adv/bridgeloopavoidance.c module of the Linux kernel is related to the use of pointers. Exploiting this vulnerability could allow an attacker to cause a service failure...

Malicious Package

Overview eslint-commit-parser is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview node-procmetrics is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview fundraiserserv is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @akunsansan0/karedok16 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

SUSE CVE-2026-64358

In the Linux kernel, the following vulnerability has been resolved: media: mtk-jpeg: cancel workqueue on release for supported platforms only Since a recent fix the mtkjpegrelease function cancels any pending or running work present in the driver workqueue using cancelworksync function. Currently...

CVE-2026-64419

In the Linux kernel, the following vulnerability has been resolved: mm/shrinker: do not hold RCU lock in shrinkerdebugfscountshow Reading the debugfs "count" file of a memcg-aware shrinker can sleep inside an RCU read-side critical section: BUG: sleeping function called from invalid context at...

CVE-2026-64465

In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Fix sleep in atomic context in xhcifreestreams When a USB device with active stream endpoints is disconnected, xhcifreestreams is called from the hubevent workqueue to free the stream resources. It calls...

EUVD-2026-49004

In the Linux kernel, the following vulnerability has been resolved: iommufd: Move vevent memory allocation outside spinlock The veventq memory allocation happens inside the spinlock. Given its depth is decided by the user space, this leaves a vulnerability, where userspace can allocate large queu...

SUSE CVE-2026-64211

In the Linux kernel, the following vulnerability has been resolved: srcu: Don't queue workqueue handlers to never-online CPUs While an srcustruct structure is in the midst of switching from CPU-0 to all-CPUs state, it can attempt to invoke callbacks for CPUs that have never been online. Worse yet...