UBUNTU-CVE-2026-101909

Axios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0, ToFormData processes inherited serialization options and visitor properties supplied through prototype pollution. A separate same-process prototype-pollution flaw supplies inherited...

CVE-2026-101903

Axios is a promise-based HTTP client for the browser and Node.js. From 1.16.1 until 1.20.0, the RFC 2397 regular expression allows slash characters on both sides of the media-type separator. An application passes an attacker-controlled malformed data URL containing many slash characters and no...

CVE-2026-101902

A flaw was found in axios. When sending HTTP requests that omit an explicit request method, Axios can inherit properties from the JavaScript prototype chain rather than using safe internal defaults. If an attacker manipulates shared object properties through a separate vulnerability in the same...

CVE-2026-98161

A flaw was found in the Linux kernel's persistent memory pmem subsystem. When processing storage write requests, the driver continues copying data even if a preceding cache flush operation fails, potentially overwriting the error status and reporting success. A local user performing I/O operation...

CVE-2026-101903

A flaw was found in Axios. A remote attacker can exploit this vulnerability by supplying a crafted data URL containing repeated slash characters to an application that processes untrusted inputs. Due to an inefficient regular expression used to parse the URL, handling the malformed input triggers...

CVE-2026-49994 Bluehood: Missing authentication on Bluehood API routes when web auth is enabled

Bluehood monitors local bluetooth activity. Prior to version 0.7.1, when authenabled is set in Bluehood, only the HTML page handlers enforced session validation. The /api/ handlers settings, devices, groups, per-device endpoints including /api/device/mac/notes called no auth check at all. A netwo...

EUVD-2026-88401

Bluehood monitors local bluetooth activity. Prior to version 0.7.1, when authenabled is set in Bluehood, only the HTML page handlers enforced session validation. The /api/ handlers settings, devices, groups, per-device endpoints including /api/device/mac/notes called no auth check at all. A netwo...

CVE-2026-49994 Bluehood: Missing authentication on Bluehood API routes when web auth is enabled

Bluehood monitors local bluetooth activity. Prior to version 0.7.1, when authenabled is set in Bluehood, only the HTML page handlers enforced session validation. The /api/ handlers settings, devices, groups, per-device endpoints including /api/device/mac/notes called no auth check at all. A netwo...

CVE-2026-49994 Bluehood: Missing authentication on Bluehood API routes when web auth is enabled

Bluehood monitors local bluetooth activity. Prior to version 0.7.1, when authenabled is set in Bluehood, only the HTML page handlers enforced session validation. The /api/ handlers settings, devices, groups, per-device endpoints including /api/device/mac/notes called no auth check at all. A netwo...

CVE-2026-101903

Axios is a promise-based HTTP client for the browser and Node.js. From 1.16.1 until 1.20.0, the RFC 2397 regular expression allows slash characters on both sides of the media-type separator. An application passes an attacker-controlled malformed data URL containing many slash characters and no...

CVE-2026-98149

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter subsystem. When updating per-CPU maps on systems configured with non-contiguous CPU identifiers, the kernel incorrectly calculates memory offsets using logical processor IDs instead of dense buffer positions. A local user can explo...

GO-2026-6545 Grafana: Path traversal in the Tempo and Loki data source plugins in github.com/grafana/grafana

Grafana: Path traversal in the Tempo and Loki data source plugins in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabili...

CLSA-2026-1790612737 TuxCare security update for org.springframework.data:spring-data-commons (2 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-commons to address 2 CVEs. Fixed in 3.4.12-tuxcare.1...

CVE-2026-98141

A flaw was found in the Linux kernel's NTFS file system driver. When an index insertion fails during a reparse data update, the driver ignores the error and returns success instead of propagating the failure. A local user creating symbolic links or special files can trigger this issue, causing fi...

CVE-2026-98138

A flaw was found in the Linux kernel's NTFS file system driver. When synchronizing the file system, the driver unconditionally clears the volume's dirty state flag even if errors were previously encountered. A local user capable of triggering a file system synchronization on a volume with recorde...

Dutch Police Arrest ‘Reformed’ Hacker in Shiny Hunters Investigation

Authorities in the Netherlands have arrested a 24-year-old convicted cybercriminal on suspicion of aiding in data thefts and extortions by the prolific hacker group ShinyHunters. In the days immediately following the suspect's arrest, remaining ShinyHunters members dramatically escalated their...

Security Bulletin: IBM DataPower Gateway affected by denial of service due to Coreutils (CVE-2025-5278)

Summary CVE-2025-5278 addressed in IBM DataPower Gateway version 11.0.0.3 Vulnerability Details CVEID:CVE-2025-5278 DESCRIPTION: A flaw was found in GNU Coreutils. The sort utility's begfield function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated...

Security Bulletin: IBM DataPower Gateway affected by request smuggling due to form-data (CVE-2026-12143)

Summary IBM DataPower Gateway addressed CVE-2026-12143 in form-data in versions 11.0.0.3, 10.6.0.11, and 10.5.0.23 Vulnerability Details CVEID:CVE-2026-12143 DESCRIPTION: form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the field argument to...

CVE-2026-98125

A flaw was found in the Linux kernel's Server Message Block SMB client. This flaw allows a local user to read stale or inconsistent file data from a mounted network share. When modifying file ranges using insert or collapse operations, offsets that are not aligned with memory page boundaries fail...

CVE-2026-98124

A flaw was found in the Linux kernel's SMB Server Message Block client subsystem. When file modification operations such as fallocate range requests are performed on a mounted network share, the system fails to invalidate the local file system cache FS-Cache. This flaw allows a local user to read...