CVE-2026-68281

The CVE-2026-68281 entry covers the Linux kernel DRM/imagination driver where the DRM scheduler’s prepare_job() previously failed to account for the dependency between paired geometry and fragment jobs. The fix updates job_count_remaining_native_deps() so that paired job fences are counted as dep...

CVE-2026-68281 drm/imagination: Count paired job fence as dependency in prepare_job()

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Count paired job fence as dependency in preparejob The DRM scheduler's preparejob callback counts the remaining non-signaled native dependencies for a job, preventing job submission until those plus job data and...

CVE-2026-68281 drm/imagination: Count paired job fence as dependency in prepare_job()

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Count paired job fence as dependency in preparejob The DRM scheduler's preparejob callback counts the remaining non-signaled native dependencies for a job, preventing job submission until those plus job data and...

EUVD-2026-55382

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Count paired job fence as dependency in preparejob The DRM scheduler's preparejob callback counts the remaining non-signaled native dependencies for a job, preventing job submission until those plus job data and...

OPENSUSE-SU-2026:21557-1 Security update for gleam

This update for gleam fixes the following issues: Changes in gleam: - Update to 1.18.1: CVE-2026-59247: insufficient verification of data authenticity allows a MITM adversary to substitute forged Hex package contents during dependency resolution bsc1272992 Set minimum required Erlang version to 2...

Malicious code in cubesat-upstream-driver (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f5f2cf32e29ec0daedda5112ca2c560e69b4c4cd77850d6dc52d7a448e343a2 The package is advertised as an 'Upstream driver interface for cubesat orbital command bus' but ships no driver, protocol, or telemetry code. Its sol...

MAL-2026-13666 Malicious code in cubesat-upstream-driver (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f5f2cf32e29ec0daedda5112ca2c560e69b4c4cd77850d6dc52d7a448e343a2 The package is advertised as an 'Upstream driver interface for cubesat orbital command bus' but ships no driver, protocol, or telemetry code. Its sol...

NPM: crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain

NPM: crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain vulnerability discovered by ? in WordPress Npm crypto-js versions 4.0.0...

0pflow (>=0.1.0-dev.2580522, <=0.1.0-dev.f5622ac), @aaarc/recursivelearnmcp (>=0.1.0, <=0.1.3) +414 more potentially affected by CVE-2026-71848 via hono (>=4.12.0, <=4.12.33)

hono NPM version =4.12.0, =0.1.0-dev.2580522, =0.1.0, =0.3.1, =0.0.0-pr-306-20260707164534, =0.1.0, =0.5.5, =0.17.0, =0.6.0, =0.8.0, =0.5.3, =0.17.0, =0.1.4, =0.0.13, =0.1.5 and more Source cves: CVE-2026-71848 Source advisory: SNYK:JS-HONO-18593786...

0pflow (>=0.1.0-dev.2580522, <=0.1.0-dev.f5622ac), @aaarc/recursivelearnmcp (>=0.1.0, <=0.1.3) +414 more potentially affected by CVE-2026-71848 via hono (>=4.12.0, <=4.12.33)

hono NPM version =4.12.0, =0.1.0-dev.2580522, =0.1.0, =0.3.1, =0.0.0-pr-306-20260707164534, =0.1.0, =0.5.5, =0.17.0, =0.6.0, =0.8.0, =0.5.3, =0.17.0, =0.1.4, =0.0.13, =0.1.5 and more Source cves: CVE-2026-71848 Source advisory: OSV:GHSA-54FX-42GC-7VW4...

MAL-2026-13613 Malicious code in big-tss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 022f32d17f1b3fa4c33727aa2309fe4e75706c842ac04b25a48738fdb9aa3d2b [email protected] impersonates the popular big.js arbitrary-precision math library and ships upstream big.js source with an injected block at the top of...

Security update for azure-storage-azcopy

This update for azure-storage-azcopy fixes the following issues: Update to 10.32.6. Security issues fixed: CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266657. CVE-2026-56852:...

CVE-2026-9169

DLL Search Order Hijacking in LUCID Vision Labs Arena SDK 1.0.80.49 on Windows allows a local attacker to execute arbitrary code with the privileges of the application by placing a malicious DLL in a user-controlled directory listed in the PATH environment variable, which the SDK traverses when a...

@ahmedwalid05/instagram-private-api (>=1.43.6-0, <=1.43.9), @alwaysmeticulous/cli (>=2.306.0, <=2.308.0) +159 more potentially affected by CVE-2026-71498 via re2 (>=1.8.4, <=1.26.0)

re2 NPM version =1.8.4, =1.43.6-0, =2.306.0, =2.306.0, =1.43.3, =8.0.0, =8.1.31, =8.0.0, =8.0.0, =1.0.9, =0.0.0-semantic-release, =0.1.1, =1.1.0, =0.0.0-semantic-release, =0.1.1, =0.1.6 and more Source cves: CVE-2026-71498 Source advisory: OSV:GHSA-J4R3-HG7J-8CHG...

@nx/powerpack-shared-fs-cache (>=5.0.0, <=5.0.7) potentially affected by CVE-2026-71476 via @nx/shared-fs-cache (>=5.0.0, <=5.0.7)

@nx/shared-fs-cache NPM version =5.0.0, =5.0.0, =5.0.7 Source cves: CVE-2026-71476 Source advisory: OSV:GHSA-VP3H-GHGH-JR7G...

MAL-2026-13464 Malicious code in vite-svg-parse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f6b581f4ab8d027c727649fae10749a9ac9a59af4619f5576362ab9243cb6c6 The package's exported API getPlugin/setPlugin decodes two base64 string literals at runtime: the first decodes to npm install node-internal-svg-load...

Malicious code in vite-svg-parse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f6b581f4ab8d027c727649fae10749a9ac9a59af4619f5576362ab9243cb6c6 The package's exported API getPlugin/setPlugin decodes two base64 string literals at runtime: the first decodes to npm install node-internal-svg-load...

Arbitrary code execution (RCE) @babel/traverse dependency in Jira Software Data Center

This is a vulnerability in a non-Atlassian Jira Software Data Cente dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk. This vulnerability affects certain versions of Atlassian Jira Software Data Center. The @babel/traverse dependency is affected b...

DoS (Denial of Service) undici Dependency in Jira Software Data Center

This High severity DoS Denial of Service vulnerability was introduced in version 11.3.8 of Jira Software Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an unauthenticated attacker to cause a...

RCE (Remote Code Execution) form-data Dependency in Jira Software Data Center

This High severity RCE Remote Code Execution vulnerability was introduced in versions 9.17.0, 10.0.0, 10.1.1, 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 10.7.1, 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Software Data Center. This RCE Remote Code Execution vulnerability, with a CVSS Score of 8.7 and...