CVE-2026-63816

CVE-2026-63816 describes a Linux kernel issue in F2FS where the UAF can occur during garbage collection when handling f2fs_inode_info.atomic_inode. The public descriptions across NVD, SUSE, OSVs, Debian/OSV indicate the code path: gc_data_segment → ra_data_block(cow_inode) → mapping = F2FS_I(inod...

EUVD-2026-45482

In the Linux kernel, the following vulnerability has been resolved: f2fs: atomic: fix UAF issue on f2fsinodeinfo.atomicinode - ioctlF2FSIOCGARBAGECOLLECTRANGE - shrink - f2fsgc - gcdatasegment - radatablockcowinode - mapping = F2FSIinode-atomicinode-imapping : f2fsiscowfilecowinode is true -...

CVE-2026-63816

In the Linux kernel, the following vulnerability has been resolved: f2fs: atomic: fix UAF issue on f2fsinodeinfo.atomicinode - ioctlF2FSIOCGARBAGECOLLECTRANGE - shrink - f2fsgc - gcdatasegment - radatablockcowinode - mapping = F2FSIinode-atomicinode-imapping : f2fsiscowfilecowinode is true -...

CVE-2026-63798 irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove

In the Linux kernel, the following vulnerability has been resolved: irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove The driver allocates domain generic chips using irqallocdomaingenericchips during probe and sets up chained handlers using...

Linux Distros Unpatched Vulnerability : CVE-2026-63816

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - f2fs: atomic: fix UAF issue on f2fsinodeinfo.atomicinode - ioctlF2FSIOCGARBAGECOLLECTRANGE - shrink - f2fsgc - gcdatasegment - radatablockcowinode - mapping =...

PT-2026-61132

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the f2fs component of the Linux kernel. The problem occurs during garbage collection when the system processes the F2FS IOC GARBAGE COLLECT RANGE...

CVE-2026-54498

CVE-2026-54498 affects ViewComponent (Ruby on Rails) where ViewComponent::Base#around_render can return HTML-unsafe strings, bypassing normal escaping and causing XSS. The issue is amplified when ViewComponent::Collection#render_in joins per-item results and marks the whole output html_safe, conv...

CVE-2026-54498 view_component: around_render HTML-Safety Bypass

viewcomponent is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 4.0.0 until 4.12.0, ViewComponent::Basearoundrender can return HTML-unsafe strings that bypass the escaping behavior applied to normal call return values. This creates an XSS risk...

CVE-2026-54498 view_component: around_render HTML-Safety Bypass

viewcomponent is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 4.0.0 until 4.12.0, ViewComponent::Basearoundrender can return HTML-unsafe strings that bypass the escaping behavior applied to normal call return values. This creates an XSS risk...

CVE-2026-54498 view_component: around_render HTML-Safety Bypass

viewcomponent is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 4.0.0 until 4.12.0, ViewComponent::Basearoundrender can return HTML-unsafe strings that bypass the escaping behavior applied to normal call return values. This creates an XSS risk...

[SECURITY] Fedora 43 Update: ansible-collection-ansible-posix-2.2.1-1.fc43

Ansible Collection targeting POSIX and POSIX-ish platforms...

[SECURITY] Fedora 44 Update: ansible-collection-ansible-posix-2.2.1-1.fc44

Ansible Collection targeting POSIX and POSIX-ish platforms...

Nimux 1.0.1

Nimux is a native command surface for authorized security assessments. It combines network enumeration, credential validation, Active Directory operations, Kerberos workflows, remote execution, file movement, secrets collection, DCSync, GPO operations, database clients, and SOCKS routing into one...

Vogls: A Fast Interactive Full-Timing Simulator for Pre-Silicon Power Side-Channel Analysis

Designing hardware circuits resistant to side-channel attacks increasingly relies on simulation to predict device leakage before fabrication. Current functional verification simulators are designed for extended correctness-checking runs and are ill-suited for producing large numbers of short trac...

Fedora 43 : ansible-collection-ansible-posix (2026-50e5126be4)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-50e5126be4 advisory. - Update to 2.2.1. Fixes rhbz2479556. - Mitigates CVE-2026-11837 rhbz2487430, rhbz2487431, rhbz2487432 Tenable has extracted the preceding descripti...

CVE-2026-44174 Kirby: Arbitrary Method Call via REST API search and collection query endpoints

Kirby is an open-source content management system. Prior to 4.9.1 and 5.4.1, Kirby did not validate the model attributes that were used in its collection queries, allowing attackers to include arbitrary model methods in their queries. This includes methods with sensitive data such as password...

CVE-2026-44174 Kirby: Arbitrary Method Call via REST API search and collection query endpoints

Kirby is an open-source content management system. Prior to 4.9.1 and 5.4.1, Kirby did not validate the model attributes that were used in its collection queries, allowing attackers to include arbitrary model methods in their queries. This includes methods with sensitive data such as password...

CVE-2026-44174

Kirby CMS (versions prior to 4.9.1 and 5.4.1) exposes REST API search and collection queries that did not validate model attributes, allowing authenticated users to invoke arbitrary model methods (e.g., password(), root(), loginPasswordless(), delete()) via collection endpoints. This can disclose...

Malicious code in date-utils-light (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99bd644fd9a59518d6f77e8d76c077ffef8a2afdc7ae2b00a6ca87299879a671 Package presents itself as a trivial date-formatting utility index.js exports a one-line ISO date helper but ships a postinstall.js that runs...

MAL-2026-10733 Malicious code in idlive-document-capture-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d428a1956dd86e85bfb6fb83cba2dea11bfc19250c1262d13a88c3bdd8ca07e0 Package name typosquats the legitimate 'idlive' family and ships no library functionality. package.json declares a preinstall lifecycle hook...