EUVD-2026-55601

In the Linux kernel, the following vulnerability has been resolved: xfrm: clear mode callbacks after failed mode setup xfrmstategctask can run long after a failed IPTFS state setup. In the reproduced case, xfrminitstate cached x-modecbs, IPTFS setup returned -ENOMEM before publishing modedata, an...

CVE-2026-68345 arm_mpam: guard MBWU state before adding it to garbage

In the Linux kernel, the following vulnerability has been resolved: armmpam: guard MBWU state before adding it to garbage destroycomponentcfg adds each RIS mbwustate object to the MPAM garbage list when destroying component configuration. However, mbwustate is allocated per RIS and only for RISes...

Missing Release of Resource after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime due to reliance on the finalize process for zeroizing sensitive key material. An attacker can potentially access sensitive cryptographic keys by exploiting delays in garbage collectio...

Missing Release of Resource after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime due to reliance on the finalize process for zeroizing sensitive key material. An attacker can potentially access sensitive cryptographic keys by exploiting delays in garbage collectio...

CVE-2026-13505

In Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series, sensitive key material held by the AES and DESede engines, the SP 800-90A DRBGs, SymmetricSecretKey and the PBKD and scrypt parameter classes was zeroised on garbage collection by...

CVE-2026-13505 Zeroisation of sensitive key material on garbage collection relies on finalization

In Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series, sensitive key material held by the AES and DESede engines, the SP 800-90A DRBGs, SymmetricSecretKey and the PBKD and scrypt parameter classes was zeroised on garbage collection by...

CVE-2026-13505

In Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series, sensitive key material held by the AES and DESede engines, the SP 800-90A DRBGs, SymmetricSecretKey and the PBKD and scrypt parameter classes was zeroised on garbage collection by...

Malicious code in dojo-rn-interview (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42dcf2c659fc0c8b63b90671ae2a865a7811d5eeaaf321aab8355358117be47d [email protected] declares a preinstall script that runs index.js on npm install. The script collects host identifiers via os.hostname,...

MAL-2026-13519 Malicious code in streak-kit-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18948f1c8e71b24d05e1ef6f749995bdc9098d610f791b86dc33f7d41dd8b1d3 The package advertises itself as a streak/calendar math library, but its main entry dist/index.mjs contains a top-level IIFE that, on any...

MAL-2026-13453 Malicious code in pilgrimage-portal-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73b9f604c074795de9d79071f9e8a6c131e0a30159f6ea2a0769ded3df6d5a28 On npm install, the package's postinstall hook runs node ping.js, which reads the installer's hostname via require'os'.hostname and POSTs it, along...

CVE-2026-18258

CVE-2026-18258 affects Scripta/eScriptorium up to version 26.04.1, impacting the Line, LineTranscription, VirtualCollection, tag and process API endpoints. The root cause is authorization bypass where a remote authenticated user can read, modify, and delete other users’ transcription content. Thi...

CVE-2026-10716

Directus contains an authenticated SQL injection vulnerability in the collection creation flow when the instance uses PostgreSQL with PostGIS enabled. An administrator can create a collection with a geometry field whose fields.type value starts with geometry but contains attacker-controlled SQL...

CVE-2026-10716 Directus <12.1.0 - Authenticated time-based SQL injection in PostgreSQL/PostGIS collection creation

Directus contains an authenticated SQL injection vulnerability in the collection creation flow when the instance uses PostgreSQL with PostGIS enabled. An administrator can create a collection with a geometry field whose fields.type value starts with geometry but contains attacker-controlled SQL...

EUVD-2026-53519

Directus contains an authenticated SQL injection vulnerability in the collection creation flow when the instance uses PostgreSQL with PostGIS enabled. An administrator can create a collection with a geometry field whose fields.type value starts with geometry but contains attacker-controlled SQL...

CVE-2026-10716

Directus: Authenticated SQL injection in collection creation when using PostgreSQL with PostGIS. A admin can craft a collection with a geometry field where fields[].type starts with geometry but includes attacker-controlled SQL syntax after the geometry subtype, enabling time-based SQL injection....

CVE-2026-10716 Directus <12.1.0 - Authenticated time-based SQL injection in PostgreSQL/PostGIS collection creation

Directus contains an authenticated SQL injection vulnerability in the collection creation flow when the instance uses PostgreSQL with PostGIS enabled. An administrator can create a collection with a geometry field whose fields.type value starts with geometry but contains attacker-controlled SQL...

EUVD-2026-53474

A vulnerability in the logging subsystem of Cisco RoomOS could allow an authenticated, local attacker with low privileges to access sensitive information. This vulnerability is due to the logging of sensitive information. An attacker could exploit this vulnerability by enabling a specific logging...

MAL-2026-12792 Malicious code in gs-uitk-testing-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58475142ea32c554345513c67fd5ed8a8d6b60fb151e675249e4eb83984c8300 [email protected] declares an npm install lifecycle script scripts.install='node index.js' that loads lib/core.js. That module collects th...

MAL-2026-12795 Malicious code in knowledge-grader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 74d01af74706eee07fb8ed306ec3b830641f63b4c055d605026edff65fd11c8f The package's preinstall hook runs index.js, which collects hostname, username, home directory, DNS servers, package path, and the contents of...

MAL-2026-12813 Malicious code in twilio-functions (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea71d301e90ede6f86f259e827a1cb61ad0b4b0166b70281bdf7896f726eea31 On npm install, the package's postinstall script executes index.js, which collects host identifiers os.hostname, os.userInfo.username, os.homedir,...