CVE-2026-71505

Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API third-party site account write routes that allows authenticated attackers with third-party creation rights to overwrite the WebPortal password of any company by bypassing per-object access checks tha...

CVE-2026-71510 Dolibarr < 24.0.0 Users REST API SQL Injection via filter parameter

Dolibarr before 24.0.0 contains a SQL injection vulnerability in the users REST API that allows authenticated attackers with user-read rights to extract sensitive data by splicing unsanitized filter parameters into SQL WHERE clauses without column restrictions. Attackers can perform binary search...

kernel: gfs2: Fix use-after-free in iomap inline data write path

A flaw was found in the Linux kernel's GFS2 filesystem. This memory corruption vulnerability, a use-after-free, occurs in the iomap inline data write path. The issue arises because a data buffer is released prematurely while still being referenced, leading to a write to freed memory. This could...

kernel: gfs2: Fix use-after-free in iomap inline data write path

A flaw was found in the Linux kernel's GFS2 filesystem. This memory corruption vulnerability, a use-after-free, occurs in the iomap inline data write path. The issue arises because a data buffer is released prematurely while still being referenced, leading to a write to freed memory. This could...

CVE-2026-74707

A flaw was found in the Linux kernel's xsk AFXDP sockets component. This vulnerability allows a local user to bypass security validation by modifying transmission TX metadata after it has been initially checked but before it is used to prepare hardware requests. This could lead to unexpected syst...

kernel: gfs2: Fix use-after-free in iomap inline data write path

A flaw was found in the Linux kernel's GFS2 filesystem. This memory corruption vulnerability, a use-after-free, occurs in the iomap inline data write path. The issue arises because a data buffer is released prematurely while still being referenced, leading to a write to freed memory. This could...

CVE-2026-74697

A flaw was found in the Linux kernel's bnxten driver. This vulnerability occurs when End of frame padding EOP on the AGG ring overlaps with subsequent data segments. On older network chips, if Relaxed Ordering RO is active, this overlap can cause valid data to be overwritten with zeros. This can...

Malicious code in consumerweb-serverutils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04473d8096a27ae1cbf94652a0087dcf00762f2c7d1ef390bb351f283e743349 consumerweb-serverutils 3.4.3 runs a preinstall lifecycle script that on npm install collects the installer's username, hostname, and current working...

Malicious code in remove-bg-serverless-azure (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcbce8344eb0762c4a9ef029743efe13045422b839444b828c245a09a85fc74e package.json declares preinstall: node index.js, so npm install automatically runs index.js. index.js reads os.hostname, os.userInfo, the user home...

Malicious code in ppb-manticore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2558d8bae443d40330d8166eec921f02de17b395b4359a086a0f12792b026422 On npm install, the package's preinstall lifecycle script collects the installer's OS username, hostname, and current working directory, walks upward...

Malicious code in web-advertising (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc7c0c1f060691740d5149c61d74f3ddd8f6e10107c7621d700ae0819a1e2237 [email protected] declares scripts.preinstall = 'node index.js', so index.js executes automatically on npm install. The script collects...

Malicious code in hydration-ui-dim (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 64f9565680b71c54ed88e29ed3950f1561764f4b86a260a3ebb5eadb528edfa3 On import 'hydration-ui-dim', dist/index.mjs runs a top-level async IIFE that chmods dist/internal/calc-math.dat to 0755 and spawns it detached via...

CVE-2026-74665

A flaw was found in the Linux kernel. Incorrect length accounting for skb socket buffer fragments after an eXpress Data Path XDP program adjusts the fragment area can lead to an out-of-bounds read. This allows an attacker to potentially disclose sensitive kernel pointers and corrupt user-space...

Malicious code in dotish (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2ccb1a1f0c28d673323f0377c9e65232611641c9de3dbb97f92b17779660b20 The package's postinstall lifecycle script auto-runs on npm install and reads the installer's current working directory .env file typically containin...

EUVD-2025-210763

HCL Hive is affected by incorrect default permissions which could allow an attacker unauthorized lateral movement, container breakout, and interception of sensitive internal communications...

CVE-2026-19874

A heap-based buffer overflow vulnerability exists in Konami's Metal Gear Online 3, originating from improper validation of lobby data fields related to kicked players. The affected function processes a list of kicked player identifiers using the lobby data key "kicknum" to determine the number of...

CVE-2026-19874 Konami's Metal Gear Online 3 contains a heap-based buffer overflow

A heap-based buffer overflow vulnerability exists in Konami's Metal Gear Online 3, originating from improper validation of lobby data fields related to kicked players. The affected function processes a list of kicked player identifiers using the lobby data key "kicknum" to determine the number of...

CVE-2026-55648

A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol. An integer overflow vulnerability in the freerdpimagecopyfromicondata function allows a malicious Remote Desktop Protocol RDP server to bypass a bounds check. By sending a specially crafted icon update with large...

What happens to your data when you die? (Lock and Code S07E17)

This week on the Lock and Code podcast … You will die. Your data will not. The afterlife of our information is a recent phenomenon, and some of the companies with the most to sort through are still just figuring it out. As far back as 2007, Facebook was forced to reckon with mass grief when users...

CVE-2026-55564

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server can exploit an out-of-bounds read vulnerability in the glyphcacheget function. By sending crafted glyph fragments, the server can cause the client to read beyond the intended memory buffer. This can lead to a client crash...