Incorrect Authorization

Overview liquidjs is an A simple, expressive, safe and Shopify compatible template engine in pure JavaScript. Affected versions of this package are vulnerable to Incorrect Authorization via array index access in the readArrayElement path, where the ownPropertyOnly option is not enforced for...

Exploit for Improper Certificate Validation in Checkpoint Gaia_Embedded

CVE-2026-85102 — Check Point Unauthenticated VPN Tunnel Establ...

MSC-2026-12685

The npm package wix-ssr-thunderbolt-grid-polyfill version 0.1.0 contains embedded malicious code. It ships forged Wix Thunderbolt registry manifests rbwixui and rbdsgnsys that point the wixui namespace at this package's dist directory through Wix's static.parastorage.com unpkg mirror, so Wix...

SUSE CVE-2026-98237

In the Linux kernel, the following vulnerability has been resolved: net: wwan: mhiwwanmbim: guard against a cyclic NDP chain The NDP traversal in mhimbimrx only stops when wNextNdpIndex is zero. Nothing requires the offsets to advance, so a modem that points an NDP at itself, or at an earlier NDP...

Skill Constellations: Tracing the Supply Chain of Agent Skills on GitHub

Agent skills are SKILL.md instructions and scripts that AI coding agents such as Claude Code and Codex run with the permissions of their user. Developers share skills by copying them between repositories, which makes them a software supply chain without a registry, versions or provenance. The...

Pump-And-Dump Meets Honeypot Tokens: Detection and Analysis of Telegram Bait-And-Trap Schemes

While Pump-and-Dump schemes have been extensively studied on centralized exchanges CEXs, how they operate in decentralized exchanges DEXs remains largely unexplored. We monitor 83 Telegram channels used to coordinate Pump-and-Dump campaigns and collect 3,677 events across the BNB Smart Chain and...

The Economic Security of Exponential EIP-1559

We consider the problem of parameter selection for EIP-1559, a widely used gas pricing mechanism for blockchains. As opposed to previous work, we aim to achieve economic security, where the chosen parameters guarantee a lower bound on total collected gas fees whenever usage over a given time wind...

MSC-2026-12682

The npm package css-jptvix-polyfill version 1.0.0 contains embedded malicious code in thunderboltRegistry.js. The file self-executes when loaded: it runs id, whoami, env and ifconfig via childprocess.execSync, sends the full process environment including any credentials and tokens to an...

DEBIAN-CVE-2026-98237

In the Linux kernel, the following vulnerability has been resolved: net: wwan: mhiwwanmbim: guard against a cyclic NDP chain The NDP traversal in mhimbimrx only stops when wNextNdpIndex is zero. Nothing requires the offsets to advance, so a modem that points an NDP at itself, or at an earlier NDP...

AZL-106119 CVE-2026-98237 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net: wwan: mhiwwanmbim: guard against a cyclic NDP chain The NDP traversal in mhimbimrx only stops when wNextNdpIndex is zero. Nothing requires the offsets to advance, so a modem that points an NDP at itself, or at an earlier NDP...

CVE-2026-98237

In the Linux kernel, the following vulnerability has been resolved: net: wwan: mhiwwanmbim: guard against a cyclic NDP chain The NDP traversal in mhimbimrx only stops when wNextNdpIndex is zero. Nothing requires the offsets to advance, so a modem that points an NDP at itself, or at an earlier NDP...

CVE-2026-98237

In the Linux kernel, the following vulnerability has been resolved: net: wwan: mhiwwanmbim: guard against a cyclic NDP chain The NDP traversal in mhimbimrx only stops when wNextNdpIndex is zero. Nothing requires the offsets to advance, so a modem that points an NDP at itself, or at an earlier NDP...

UBUNTU-CVE-2026-98237

In the Linux kernel, the following vulnerability has been resolved: net: wwan: mhiwwanmbim: guard against a cyclic NDP chain The NDP traversal in mhimbimrx only stops when wNextNdpIndex is zero. Nothing requires the offsets to advance, so a modem that points an NDP at itself, or at an earlier NDP...

CVE-2026-98237 net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain

In the Linux kernel, the following vulnerability has been resolved: net: wwan: mhiwwanmbim: guard against a cyclic NDP chain The NDP traversal in mhimbimrx only stops when wNextNdpIndex is zero. Nothing requires the offsets to advance, so a modem that points an NDP at itself, or at an earlier NDP...

EUVD-2026-93165

In the Linux kernel, the following vulnerability has been resolved: net: wwan: mhiwwanmbim: guard against a cyclic NDP chain The NDP traversal in mhimbimrx only stops when wNextNdpIndex is zero. Nothing requires the offsets to advance, so a modem that points an NDP at itself, or at an earlier NDP...

CVE-2026-98237 net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain

In the Linux kernel, the following vulnerability has been resolved: net: wwan: mhiwwanmbim: guard against a cyclic NDP chain The NDP traversal in mhimbimrx only stops when wNextNdpIndex is zero. Nothing requires the offsets to advance, so a modem that points an NDP at itself, or at an earlier NDP...

CVE-2026-98237

The Linux kernel contains a vulnerability in the mhi_wwan_mbim driver where the mhi_mbim_rx() function fails to adequately validate NDP traversal offsets. A modem that points an NDP at itself or an earlier NDP can cause an infinite loop, pinning one CPU at 100% utilization and preventing the thre...

CVE-2026-98237

In the Linux kernel, the following vulnerability has been resolved: net: wwan: mhiwwanmbim: guard against a cyclic NDP chain The NDP traversal in mhimbimrx only stops when wNextNdpIndex is zero. Nothing requires the offsets to advance, so a modem that points an NDP at itself, or at an earlier NDP...

CLEANSTART-2026-PF50810 When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint

Security vulnerability affects the temporal-server package. When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint...

CLEANSTART-2026-HI32575 When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will...

Security vulnerability affects the temporal-server package. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the...