CVE-2026-68149

The CVE-2026-68149 entry pertains to a Linux kernel bug in ACL_DONT_CACHE handling within forget_cached_acl(). The issue arises when ACL_DONT_CACHE state is unintentionally invalidated, affecting inodes for filesystems opting out of POSIX ACL caching. Specifically, in fuse-related paths, forget_a...

CVE-2026-68149 fs: preserve ACL_DONT_CACHE state in forget_cached_acl()

In the Linux kernel, the following vulnerability has been resolved: fs: preserve ACLDONTCACHE state in forgetcachedacl The ACLDONTCACHE state is meant to be a constant state for the inode for filesystems that want to opt out of posix acl caching. Commit facd61053cff1 "fuse: fixes after adapting t...

CVE-2026-68149: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: fs: preserve ACLDONTCACHE state in forgetcachedacl The ACLDONTCACHE state is meant to be a constant state for the inode for filesystems that want to opt out of posix acl caching. Commit facd61053cff1 "fuse: fixes after adapting t...

PT-2026-69827

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the host1x bo clear cached mappings function. This occurs because host1x bo unpin drops the last reference to the mapping and frees it, making subsequent...

ClickFix Attacks Deliver macOS Stealer That Can Drain Crypto Wallets

ClickFix-style attacks are being used to deliver a Go-based malware capable of stealing cryptocurrency assets, as well as browser-stored passwords, Apple iCloud Keychain data, and cached credentials. The macOS-focused infection chain is designed to deliver a shell script that profiles the host an...

CVE-2026-17600

Nexus Repository 3 is affected by CVE-2026-17600 where a user’s active session is not immediately terminated or cached permissions revoked after account deletion, deactivation, or password change. The flaw allows a user with an active session to continue interacting with the repository as if the ...

CVE-2026-17600 Nexus Repository 3 - Session Not Invalidated on User Account Deletion or Deactivation

Sonatype Nexus Repository 3 did not immediately terminate a user's active login session or revoke their cached permissions when that user's account was deleted, deactivated, or had its password changed. A user whose account was already logged in at the time of one of these actions could continue...

SUSE CVE-2026-68744

A flaw was found in SSSD. The sssnssprotocolfillinitgr function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to...

CVE-2026-68746

Not Failing Securely 'Failing Open' vulnerability in livebook-dev livebook allows an unauthenticated network client to obtain full access to a Livebook server that enforces identity through Livebook Teams. A Livebook Agent or App Server connected to Livebook Teams caches the identifier of the...

CVE-2026-68746 Livebook Teams identity check fails open when the deployment group is unresolvable, allowing unauthenticated access

Not Failing Securely 'Failing Open' vulnerability in livebook-dev livebook allows an unauthenticated network client to obtain full access to a Livebook server that enforces identity through Livebook Teams. A Livebook Agent or App Server connected to Livebook Teams caches the identifier of the...

CVE-2026-68746

Not Failing Securely 'Failing Open' vulnerability in livebook-dev livebook allows an unauthenticated network client to obtain full access to a Livebook server that enforces identity through Livebook Teams. A Livebook Agent or App Server connected to Livebook Teams caches the identifier of the...

CVE-2026-70606

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 40.10.6, 41.9.1, 42.5.1, and 43.0.0, when a custom protocol handler returned a ProtocolResponse with a url and no session, Electron made the upstream request through defaultSession...

EUVD-2026-53445

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 40.10.6, 41.9.1, 42.5.1, and 43.0.0, when a custom protocol handler returned a ProtocolResponse with a url and no session, Electron made the upstream request through defaultSession...

CVE-2026-70606

Electron prior to versions 40.10.6, 41.9.1, 42.5.1, and 43.0.0 has a vulnerability where a ProtocolResponse with a URL and no session could cause the upstream request to go through the defaultSession instead of the registering session. This could allow a cached response to be reused across otherw...

Malicious code in devplatform-i18n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30b21acc89730541bc58390e2694a9e5410417e5232bb4f4d47c0c27b035e2f4 Package is published as an i18n library but its main entry index.js requires./setup on load. setup.js selects a per-platform payload path, fetches...

CVE-2026-25703

NeuVector through 5.4.9 is can potentially leak information from manager /network/graph API due to missing authentication and cached data containing sensitive information...

CVE-2026-25703

NeuVector up to version 5.4.9 potentially leaks information from the manager, specifically via the /network/graph API, due to missing authentication and cached data containing sensitive information. Affected component: NeuVector manager API surface; vulnerability arises from insufficient access c...

CVE-2026-25703 Potential information leakage from manager /network/graph API in NeuVector

NeuVector through 5.4.9 is can potentially leak information from manager /network/graph API due to missing authentication and cached data containing sensitive information...

CVE-2026-25703 Potential information leakage from manager /network/graph API in NeuVector

NeuVector through 5.4.9 is can potentially leak information from manager /network/graph API due to missing authentication and cached data containing sensitive information...

CVE-2026-68744

A flaw was found in SSSD. The sssnssprotocolfillinitgr function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to...