PT-2026-72961

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free UAF issue exists in the Bluetooth subsystem. The function hci find adv instance returns an adv info pointer that is only valid while hdev-lock is held. However,...

Inclusion of Functionality from Untrusted Control Sphere

Overview @theia/plugin-ext-vscode is a Theia - Plugin Extension for VsCode Affected versions of this package are vulnerable to Inclusion of Functionality from Untrusted Control Sphere due to missing workspace-trust enforcement in the plugin and extension loading path. An attacker can execute...

Inclusion of Functionality from Untrusted Control Sphere

Overview @theia/plugin-ext is a Theia - Plugin Extension Affected versions of this package are vulnerable to Inclusion of Functionality from Untrusted Control Sphere due to missing workspace-trust enforcement in the plugin and extension loading path. An attacker can execute commands with the user...

@popcornsar/che-theia-plugin-ext (7.4.0), @popcornsar/theia-dashboard-extension (7.4.0-v1) +16 more potentially affected by CVE-2026-19884 via @theia/plugin-ext (>=1.0.0, <=1.69.0-next.81)

@theia/plugin-ext NPM version =1.0.0, =1.1.0-next.14531578, =1.46.0-next.72, =1.1.0-next.14531578, =1.1.0-next.14531578, =1.1.0-next.14531578, =1.59.0, =0.0.17, =0.0.6, =0.0.19, =0.0.6, =0.0.21 and more Source cves: CVE-2026-19884 Source advisory: SNYK:JS-THEIAPLUGINEXT-18855352...

@theia/vsx-registry (>=1.1.0-next.14531578, <=1.69.0), openvsx-server (>=1.59.0, <=1.59.1) potentially affected by CVE-2026-19884 via @theia/plugin-ext-vscode (>=1.1.0-next.a62a6b92, <=1.69.0-next.81)

@theia/plugin-ext-vscode NPM version =1.1.0-next.a62a6b92, =1.1.0-next.14531578, =1.59.0, =1.59.1 Source cves: CVE-2026-19884 Source advisory: SNYK:JS-THEIAPLUGINEXTVSCODE-18855353...

CVE-2026-68421

In the Linux kernel, the following vulnerability has been resolved: schedext: Don't warn on core-sched forced idle in putprevtaskscx putprevtaskscx warns when a runnable task drops to a lower schedclass without SCXOPSENQLAST, on the assumption that balanceone would have kept it running. Core...

CVE-2026-68094

In the Linux kernel, the following vulnerability has been resolved: schedext: Preserve rq tracking across local DSQ dispatch dispatchtolocaldsq can run from scxbpfdsqmovetolocal while ops.dispatch has recorded the current rq. Moving a task to a local DSQ may switch to the source or destination rq...

CVE-2026-68421

The CVE-2026-68421 entry concerns the Linux kernel sched_ext path. The issue arises when put_prev_task_scx() warns about a runnable task dropping to a lower sched_class without ENQ_LAST, due to core scheduling forcing idle via an SMT sibling’s core_pick path which bypasses balance_one(). The miti...

EUVD-2026-55607

In the Linux kernel, the following vulnerability has been resolved: schedext: Don't warn on core-sched forced idle in putprevtaskscx putprevtaskscx warns when a runnable task drops to a lower schedclass without SCXOPSENQLAST, on the assumption that balanceone would have kept it running. Core...

EUVD-2026-55475

In the Linux kernel, the following vulnerability has been resolved: schedext: Preserve rq tracking across local DSQ dispatch dispatchtolocaldsq can run from scxbpfdsqmovetolocal while ops.dispatch has recorded the current rq. Moving a task to a local DSQ may switch to the source or destination rq...

SUSE SLES15: apache2-mod_php8 / php8 / php8-bcmath / php8-bz2 / php8-calendar / etc (SUSE-SU-2026:3514-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3514-1 advisory. Update to version 8.2.33. Security issues fixed: - CVE-2026-7260: circular symbolic links in phar archives can lead to unbounded...

Exploit for SQL Injection in Php

CVE-2026-17543 — SQL Injection in PHP ext/pgsql via E'...'...

EulerOS 2.0 SP13 : kernel (EulerOS-SA-2026-3021)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : USB: core: Limit the length of unkillable synchronous timeoutsCVE-2026-43428 usb: typec: ucsi: validate connector number in...

SUSE-SU-2026:3513-1 Security update for php8

This update for php8 fixes the following issues: - CVE-2026-7260: circular symbolic links in phar archives can lead to unbounded recursion and cause C stack exhaustion bsc1273077. - CVE-2026-9672: security issues in libgd bsc1273078. - CVE-2026-17543: improper escaping of backslashes in...

@theia/ai-registry (>=1.73.0-next.2, <=1.73.1), @theia/plugin-dev (>=1.66.0-next.0, <=1.73.1) +4 more potentially affected by CVE-2026-12609 via @theia/plugin-ext (>=1.66.0, <=1.73.1)

@theia/plugin-ext NPM version =1.66.0, =1.73.0-next.2, =1.66.0-next.0, =1.66.0-next.0, =1.66.0-next.0, =1.66.0-next.0, =1.66.0-next.0, =1.73.1 Source cves: CVE-2026-12609 Source advisory: SNYK:JS-THEIAPLUGINEXT-18565098...

MAL-2026-12283 Malicious code in tinkoff-ui-angular-addon-wysiwyg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78e68f5ef666d2dc9c0582121a44516c5b01abcecda034b830e8d13973e16520 The package impersonates a Tinkoff UI Angular addon but ships only a stub class plus a dropper at ext.js that is loaded via index.js on require. On...

CVE-2026-12609: Improper Limitation of a Pathname to a Restricted Directory

In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the @theia/plugin-ext backend exposes the /hostedPlugin/:pluginId/:path HTTP endpoint, which resolves the requested file path with path.resolvelocalPath, filePath without verifying that the resolved path stays within the plugin's...

CLSA-2026-1781139201 TuxCare security update for es5-ext (1 CVE)

TuxCare rebuilt es5-ext to address 1 CVE. Fixed in 0.10.46-tuxcare.1...

CLSA-2026-1773793041 TuxCare security update for es5-ext (1 CVE)

TuxCare rebuilt es5-ext to address 1 CVE. Fixed in 0.10.7-tuxcare.1...

app.cash.backfila:client-misk (>=0.1.0, <=2023.11.24.141218-0357917), app.cash.backfila:client-misk-dynamodb (>=0.1.3-20210127.1838-76ab4fc, <=0.1.4-20210806.0204-5341f38) +1473 more potentially affected by CVE-2026-58059 via org.bouncycastle:bcprov-ext-jdk15on (>=1.47, <=1.70)

org.bouncycastle:bcprov-ext-jdk15on MAVEN version =1.47, =0.1.0, =0.1.3-20210127.1838-76ab4fc, =0.1.3-20210127.1838-76ab4fc, =0.1.3-20210805.0116-93702c4, =0.1.3-20210805.0116-93702c4, =0.1.0, =2023.06.07.114626-93b9d6f, =0.1.0, =0.1.4-20220614.0152-5ae0eef, =3.0.1, =2.10.0-11-1, =1.1.5, =1.0.2,...