CVE-2026-68082 libceph: fix two unsafe bare decodes in decode_lockers()

In the Linux kernel, the following vulnerability has been resolved: libceph: fix two unsafe bare decodes in decodelockers decodelockers in clslockclient.c contains two bare decode operations that allow a malicious or compromised OSD to trigger slab-out-of-bounds reads: 1. cephdecode32p at the...

MAL-2026-13630 Malicious code in @rbx-ts/services (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9476bbe7c2ce12348142e93deffe53c9d4d6dfef3400030af81cff902bac5935 This package impersonates the @rbxts/services Roblox typings library and re-exports its public API in index.js as cover. Its postinstall script...

CVE-2026-65819

gopacket provides packet processing capabilities for Go. Through version 1.7.0, multiple layer decoders use attacker-controlled lengths, counts, or offsets before validating them against packet buffers, allowing a crafted packet decoded through DecodingLayerParser or DecodeFromBytes to trigger an...

EUVD-2026-54609

gopacket provides packet processing capabilities for Go. Through version 1.7.0, multiple layer decoders use attacker-controlled lengths, counts, or offsets before validating them against packet buffers, allowing a crafted packet decoded through DecodingLayerParser or DecodeFromBytes to trigger an...

CVE-2026-65819

CVE-2026-65819 affects gopacket before version 1.7.0, where multiple layer decoders may read attacker-controlled lengths, counts, or offsets before validating buffers. A crafted packet decoded via DecodingLayerParser or DecodeFromBytes can trigger an unrecovered panic, enabling unauthenticated re...

CVE-2026-65819 gopacket: Multiple layer decoders panic on crafted packets (out-of-bounds/underflow) enabling unauthenticated remote DoS via DecodingLayerParser

gopacket provides packet processing capabilities for Go. Through version 1.7.0, multiple layer decoders use attacker-controlled lengths, counts, or offsets before validating them against packet buffers, allowing a crafted packet decoded through DecodingLayerParser or DecodeFromBytes to trigger an...

CVE-2026-65819 gopacket: Multiple layer decoders panic on crafted packets (out-of-bounds/underflow) enabling unauthenticated remote DoS via DecodingLayerParser

gopacket provides packet processing capabilities for Go. Through version 1.7.0, multiple layer decoders use attacker-controlled lengths, counts, or offsets before validating them against packet buffers, allowing a crafted packet decoded through DecodingLayerParser or DecodeFromBytes to trigger an...

CVE-2026-65819

gopacket provides packet processing capabilities for Go. Through version 1.7.0, multiple layer decoders use attacker-controlled lengths, counts, or offsets before validating them against packet buffers, allowing a crafted packet decoded through DecodingLayerParser or DecodeFromBytes to trigger an...

CVE-2026-71313

A flaw was found in rclone, a command-line program for syncing files. The local backend's filename encoder, when configured in certain ways, can improperly decode remote filenames. This allows an attacker to craft a source object that, when processed, can create or overwrite files outside the...

UBUNTU-CVE-2026-70629

FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder libavcodec/rscc.c that allows attackers to disclose heap memory contents by supplying a crafted video file with a compressed tile that decompresses fewer bytes...

MAL-2026-13464 Malicious code in vite-svg-parse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f6b581f4ab8d027c727649fae10749a9ac9a59af4619f5576362ab9243cb6c6 The package's exported API getPlugin/setPlugin decodes two base64 string literals at runtime: the first decodes to npm install node-internal-svg-load...

Malicious code in vite-svg-parse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f6b581f4ab8d027c727649fae10749a9ac9a59af4619f5576362ab9243cb6c6 The package's exported API getPlugin/setPlugin decodes two base64 string literals at runtime: the first decodes to npm install node-internal-svg-load...

MAL-2026-13404 Malicious code in tsihealth-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 554372f29af60ad8e6e5a33171a736baddcc652772b0452c81a4010d3f1e5218 index.js is a top-level self-decoding IIFE that XOR-decodes a URI-encoded payload keyed on the enclosing function's own source and evals the result a...

CVE-2026-67304

A null pointer dereference flaw in FreeRDP allows a remote attacker to cause a denial of service DoS via specially crafted smartcard requests. If reader-state decoding fails, the system attempts to free uninitialized states during cleanup, resulting in a process crash. Mitigation To mitigate this...

SUSE CVE-2026-44223

vLLM is an inference and serving engine for large language models LLMs. From 0.18.0 to before 0.20.0, the extracthiddenstates speculative decoding proposer in vLLM returns a tensor with an incorrect shape after the first decode step, causing a RuntimeError that crashes the EngineCore process. The...

EulerOS 2.0 SP13 : mutt (EulerOS-SA-2026-2982)

According to the versions of the mutt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : mutt before 2.3.2 sometimes uses strfcpy instead of memcpy for the IMAP authcram MD5 digest.CVE-2026-43859 In mutt before 2.3.2, the imapauthgss...

RockyLinux 10 : freerdp (RLSA-2026:50747)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:50747 advisory. FreeRDP: FreeRDP: Remote code execution via heap out-of-bounds write in RemoteFX decoding CVE-2026-55827 Tenable has extracted the preceding description block...

EulerOS 2.0 SP15 : mutt (EulerOS-SA-2026-2898)

According to the versions of the mutt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : mutt before 2.3.2 sometimes truncates the hashpasswd by one byte for IMAP authcram MD5 digest.CVE-2026-43860 mutt before 2.3.2 has an infinite loop ...

Malicious code in dolyame-boxy-desktop-bnpl-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44d48270624de1daefb72838205deed5f5ad8e91d15d34e8b953a15367d02945 On require of the package, runtime.js selects an OS/arch-specific payload linuxx64, linuxarm64, darwin, win32, downloads a binary from...

MAL-2026-12540 Malicious code in chai-as-inspired (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc4795830ed2849aaf2a6eaa488fbecc42a31c2d6d212fe34e635c16217e46ed chai-as-inspired is a typosquat resembling chai/pino packages. Its middleware entrypoint index.js spawns a detached node lib/caller.js child on...