CVE-2026-64593 btrfs: do not trim a device which is not writeable

In the Linux kernel, the following vulnerability has been resolved: btrfs: do not trim a device which is not writeable BUG There is a bug report that btrfs/242 can randomly fail with the following NULL pointer dereference: run fstests btrfs/242 at 2026-06-01 10:25:08 BTRFS: device fsid...

PT-2026-70201

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.0.0-RC1 through 5.10.5 Craft CMS versions 4.0.0-RC1 through 4.18.1 Description A theoretical path traversal weakness exists in the ensurePathIsContained function of the Local file system class. The issue arises because the...

ROS-20260806-73-0024

The vulnerabilities of the functions ocfs2extentmapgetblocks, ocfs2fiemapinline, and ocfs2fiemap in the fs/ocfs2/extentmap.c module of the Linux operating system are related to improper locking mechanisms. Exploitation of these vulnerabilities could allow an attacker to cause service failures...

EulerOS 2.0 SP15 : kernel (EulerOS-SA-2026-2889)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : mm: blk-cgroup: fix use-after-free in cgwbreleaseworkfnCVE-2026-31586 e1000/e1000e: Fix leak in DMA error cleanupCVE-2026-43445 futex: Clear stale...

Linux Distros Unpatched Vulnerability : CVE-2026-64594

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: gadget: ffs: initialize resetwork at allocation time ffsfskillsb unconditionally calls cancelworksync on ffs-resetwork when a functionfs instance is...

TencentOS Server 3: grafana (TSSA-2026:0805)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0805 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

EulerOS 2.0 SP13 : kernel (EulerOS-SA-2026-2971)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : USB: core: Limit the length of unkillable synchronous timeoutsCVE-2026-43428 usb: typec: ucsi: validate connector number in...

CVE-2026-7869

IBM Langflow OSS 1.0.0 through 1.10.3 is vulnerable to Path Traversal in the Knowledge Bases API POST /api/v1/knowledgebases. This occurs because user-supplied knowledge base names are used directly to create file paths without proper sanitization or containment checks. An authenticated attacker...

CVE-2026-70428

Jenkins versions 2.575 and earlier (including LTS 2.568.1 and earlier ) contain a path traversal vulnerability (CVE-2026-70428) caused by the software's failure to properly identify file paths in file parameter names. Attackers possessing Item/Configure and Item/Build permissions can exploit this...

CVE-2026-70428

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file parameter names, allowing attackers with Item/Configure and Item/Build permission to write files to arbitrary locations on the controller file system...

CVE-2026-7646

IBM Langflow OSS 1.0.0 through 1.10.3 allows users to read arbitrary files from the server filesystem, including other users' uploaded documents, the JWT signing secret, the SQLite database, and process environment variables, by sending a crafted MCP resources/read request with a URL-encoded path...

CVE-2026-7646 Langflow is affected by security vulnerabilities in Model Context Protocol features

IBM Langflow OSS 1.0.0 through 1.10.3 allows users to read arbitrary files from the server filesystem, including other users' uploaded documents, the JWT signing secret, the SQLite database, and process environment variables, by sending a crafted MCP resources/read request with a URL-encoded path...

Malicious code in boxy-adapter-tramvai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d20d5167abc8703b7b09a0d9698e6d0fd060f4378dfa11ab469af3e6805cfc8e On library load, index.js requires./runtime.js, which selects a platform-specific staging path, fetches an opaque binary from obfuscated Cloudflare...

Malicious code in boxy-fixture-pfa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a15e41a397b63d04216419ddd8ec88f37cb68c5d35997ad840543e034f87d8f On require of the package, polyfill.js downloads a platform-specific binary from hardcoded destinations reassembled at runtime from split-string arra...

Malicious code in boxy-temper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3410beb63f55222c2e4d1823fae16f5de4cc07ec2ba428712d482737c72bbd2 index.js requires bridge.js on module load. bridge.js selects a platform-specific URL from a list of Cloudflare Workers hostnames whose strings are...

Cross-site Request Forgery (CSRF)

Overview @theia/filesystem is a Theia - FileSystem Extension Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF through the NodeFileUploadService handler in the filesystem backend code. An attacker can overwrite any filesystem path the backend process can write by...

Malicious code in @kyronixai/executer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48b2b754238c0894255adde45556c981418ba0ddc726afe30cc94f514f255297 The package's public API opens a WebSocket to the hardcoded endpoint wss://kyronix.harshitnakrani.me/ws/executer and dispatches incoming...

MAL-2026-12505 Malicious code in @kyronixai/executer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48b2b754238c0894255adde45556c981418ba0ddc726afe30cc94f514f255297 The package's public API opens a WebSocket to the hardcoded endpoint wss://kyronix.harshitnakrani.me/ws/executer and dispatches incoming...

CVE-2026-71269

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

Malicious code in helixbox-connect (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45774464be73a3ba586a4eb9af5a89b3f2439a4f49a80c0b69eb4668cfcf7f89 The helixbox-connect bin opens a WebSocket to the hardcoded relay wss://helixbox-relay.onrender.com and dispatches messages from the peer into local...