CVE-2026-52791

fuse-overlayfs is an implementation of overlayfs in FUSE for rootless containers. Prior to 1.17, the release-1.x C branch preserves SUID and SGID mode bits in main.c during openOTRUNC and truncate handling on a copied-up file, allowing a low-privileged process to leave the upper-layer file with...

EUVD-2026-50403

fuse-overlayfs is an implementation of overlayfs in FUSE for rootless containers. Prior to 1.17, the release-1.x C branch preserves SUID and SGID mode bits in main.c during openOTRUNC and truncate handling on a copied-up file, allowing a low-privileged process to leave the upper-layer file with...

CVE-2026-64053 block: don't overwrite bip_vcnt in bio_integrity_copy_user()

In the Linux kernel, the following vulnerability has been resolved: block: don't overwrite bipvcnt in biointegritycopyuser biointegrityaddpage already sets bipvcnt to 1 for the bounce segment. Overwriting it with nrvecs breaks bipvcnt = bipmaxvcnt on WRITE bipmaxvcnt is 1, so the gap-merge checks...

PYSEC-2026-2379 Microsoft APM CLI's plugin.json component paths escape plugin root and copy arbitrary host files during install

Summary Microsoft APM normalizes marketplace plugins by copying plugin components referenced in plugin.json into .apm/. The manifest fields agents, skills, commands, and hooks are attacker-controlled, but the implementation does not enforce that those paths remain inside the plugin directory. A...

MAL-2026-10043 Malicious code in chai-as-modified (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab841cd3ab01bfcd1257a214489b41f10e236779e236a0672642777160245a9e Package name is a 1-2 character variant of the widely-used chai-as-promised plugin. The exported function — the entry point users pass to chai.use...

MAL-2026-5590 Malicious code in 0x2ai-demo3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a36d5f023e4740169d1e1e7a56ebe32552cfdc4a05bf50ecc0b648ecea502c0d On npm install, scripts/postinstall.cjs copies the entire payload/ tree into process.env.INITCWD the directory the developer ran the install from usi...

Malicious code in 0x2ai-demo6x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf57dfddd0bfd0def03360ae66ea88dd6d4e875cbcb42880a4277eb2d1df269a On npm install, scripts/postinstall.cjs recursively copies the package's payload/ directory into process.env.INITCWD the installer's project root,...

MAL-2026-5594 Malicious code in 0x2ai-demo7x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7e956073a7db6057e4d42af462dba0299152ca992c113d74c715e90574d0efb On npm install, scripts/postinstall.cjs copies the package's payload/ tree into the installer's project root process.env.INITCWD, placing...

EUVD-2026-35155

In the Linux kernel, the following vulnerability has been resolved: lib/scatterlist: fix length calculations in extractkvectosg Patch series "Fix bugs in extractitertosg", v3. Fix bugs in the kvec and user variants of extractitertosg. This series is growing due to useful remarks made by...

CVE-2026-45403 AnythingLLM: filesystem-copy-file follows nested symlinks and copies files from outside the allowed directory

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to 1.13.0, the AnythingLLM agent filesystem copy tool validates only the top-level source and destination paths. The recursive copy helper then descends into child...

Linux kernel 安全漏洞

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from the fact that the high ESN value in the xfrm AH is not properly considered during asynchronous...

Malicious code in @cometix/claude-code (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9c6fc5df21efcd2949e4c05b4a9a75dbe8142243a3967dc853be7069ecaca24 Package is published under the @cometix scope but its package.json sets author to 'Anthropic ' and ships a README copied verbatim from Anthropic's...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ext4: Fixed the issue where idisksize could exceed isize in partially written cases. It is possible for idisksize to exceed isize, triggering a warning. genericperformwrite: - copied = iovitercopyfromuseratomiclen // copied...

CVE-2026-45539

Microsoft APM (APM CLI) vulnerability affects versions 0.5.4–0.12.4 where two primitive integrators enumerate package files via Path.glob/Path.rglob and read matches with Path.read_text(), following symbolic links. A symlink inside a remote APM dependency under .apm/prompts/ or .apm/agents/ is pr...

CVE-2026-43362

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix in-place encryption corruption in SMB2write SMB2write places write payload in iov1..n as part of rqiov. smb3inittransformrq pointer-shares rqiov, so cryptmessage encrypts iov1 in-place, replacing the original...

Qualcomm Chipsets 资源管理错误漏洞

Qualcomm Chipsets are a series of chipset developed by Qualcomm Incorporated in the United States. Qualcomm Chipsets have a resource management vulnerability, which occurs when data is copied from a released source during the operation of canceling the performance counter selection, resulting in...

CVE-2025-59920

When hours are entered in time@work, version 7.0.5, it performs a query to display the projects assigned to the user. If the query URL is copied and opened in a new browser window, the ‘IDClient’ parameter is vulnerable to a blind authenticated SQL injection. If the request is made with the TWAdm...

CVE-2025-59920

CVE-2025-59920 affects time@work v7.0.5: when hours are entered, a query to display a user’s assigned projects can be exposed. Copying the query URL and opening it in a new browser window makes the ‘IDClient’ parameter vulnerable to blind authenticated SQL injection. If the attacker uses a TWAdmi...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: vhost: vringh: Fixed the check on the return value of copytoiter. The return value of copytoiter cannot be negative; instead of checking for negative values, we should check whether the copied length is equal to the requested...

PT-2025-52954

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel related to thermal zone unregistration, potentially leading to a double-free condition. This issue arises from a copy of the thermal zone parameters...