Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: perf: Fix for perfpendingtask UaF According to syzbot, it is possible for perfpendingtask to continue running after the event has been freed. There are two related but distinct cases: - The taskwork was already queued before the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: WireGuard: netlink: Check for a dangling peer via isdead instead of an empty list If all peers are removed using wgpeerremoveall, rather than setting peerlist to empty, the peer is added to a temporary list at the beginning of...

Malicious code in @syncraft-labs/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0efe219063a966d0d2025d6c3274cbc7e9f3c0b3a1e9cdf81c7adf6dbae4d4ac The ESM build shipped at dist/index.js contains a heavily obfuscated payload hex-identifier string-array + rotator produced by an obfuscator.io-style...

MAL-2026-14367 Malicious code in @syncraft-labs/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0efe219063a966d0d2025d6c3274cbc7e9f3c0b3a1e9cdf81c7adf6dbae4d4ac The ESM build shipped at dist/index.js contains a heavily obfuscated payload hex-identifier string-array + rotator produced by an obfuscator.io-style...

EUVD-2026-61159

Plainpad through 1.1.1, fixed in commit d3823fc, contains a missing rate limiting vulnerability that allows unauthenticated attackers to send unbounded login requests to the POST /v1/sessions endpoint due to dead code in App\Http\Kernel.php that is never instantiated under the Laravel 11+ skeleto...

MAL-2026-14065 Malicious code in akamai-sensor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1a8cc3668ec9751c1ef60bf602f1e08f2f2fdf8dce999e442c484458f932178 Package published under a name impersonating Akamai's sensordata anti-bot SDK. index.js contains a /... / comment whose body is encoded in invisible...

CVE-2026-74503

In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Clear SNDRVTIMERIFLGDEAD once the close completes sndtimercloselocked marks an instance with SNDRVTIMERIFLGDEAD and returns early when the flag is already set, but the flag is never cleared again. A completed close...

CVE-2026-72451

In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix xfrm state cache insertion race The xfrm input state cache insertion code checks the validity of the state before acquiring the global xfrmstatelock. Thus it's possible for someone else to kill the state after it passed...

EUVD-2026-59350

In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix xfrm state cache insertion race The xfrm input state cache insertion code checks the validity of the state before acquiring the global xfrmstatelock. Thus it's possible for someone else to kill the state after it passed...

PT-2026-72639

In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix xfrm state cache insertion race The xfrm input state cache insertion code checks the validity of the state before acquiring the global xfrm state lock. Thus it's possible for someone else to kill the state after it pass...

CVE-2026-47227

Admidio is an open-source user management solution. modules/categories.php checks that the supplied type parameter ANN, EVT, ROL, USF, … corresponds to a module the actor administers. The follow-up "is this specific category editable by me" check at lines 56-61 is dead code because it compares...

CVE-2026-47227

Admidio is an open-source user management solution. modules/categories.php checks that the supplied type parameter ANN, EVT, ROL, USF, … corresponds to a module the actor administers. The follow-up "is this specific category editable by me" check at lines 56-61 is dead code because it compares...

CVE-2026-47227 Admidio module-administrator can delete or reorder categories owned by other modules via dead authorization check in `modules/categories.php`

Admidio is an open-source user management solution. modules/categories.php checks that the supplied type parameter ANN, EVT, ROL, USF, … corresponds to a module the actor administers. The follow-up "is this specific category editable by me" check at lines 56-61 is dead code because it compares...

EUVD-2026-57204

Admidio is an open-source user management solution. modules/categories.php checks that the supplied type parameter ANN, EVT, ROL, USF, … corresponds to a module the actor administers. The follow-up "is this specific category editable by me" check at lines 56-61 is dead code because it compares...

PT-2026-70212

Name of the Vulnerable Software and Affected Versions Velociraptor affected versions not specified Description The NTFS parsing library contains multiple out-of-bounds and memory exhaustion bugs. These issues can be triggered when the software processes maliciously crafted NTFS images, such as...

Malicious code in postcss-theme-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8d6afcada49b5397e1b4d6a41d4ec0b31903593e65219c919e0d310d3941a40 packages/core/src/index.ts and plugin.ts compiled into dist/index.cjs referenced by main contain a top-level async IIFE that executes on require of t...

Malicious code in akamaijs-sensor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14a4955c82b04226b267bc55691b0b9c08770710a7038b58e75bfdd009d046fe The package presents itself as an Akamai sensor generator but ships two coupled malicious mechanisms. index.js contains a / / comment filled with...

ECHO-4FE1-0166-DEAD

Bulletin has no description...

CVE-2026-64326

A flaw was found in the Linux kernel's block device handling. When a block device is unexpectedly removed, the bdevmarkdead function can unconditionally attempt to synchronize the device, even if it is no longer present. This can lead to a system hang, effectively causing a Denial of Service DoS,...

CVE-2026-64326

In the Linux kernel, the following vulnerability has been resolved: block: skip syncblockdev on surprise removal in bdevmarkdead bdevmarkdead's @surprise == true means the device is already gone. The filesystem callback fsbdevmarkdead honours this and skips syncfilesystem, but the bare block devi...