scorecard

OpenSSF Scorecard...

CVE-2026-92949 vm2 3.9.6 before 3.11.7 Sandbox Bypass via Accessor Descriptor

vm2 versions from 3.9.6 before 3.11.7 fail to properly restrict access to accessor properties on frozen objects, allowing sandboxed scripts to bypass vm.freeze and vm.readonly protections. Attackers can use Object.getOwnPropertyDescriptor or lookupSetter to extract and invoke host object setters...

U.S. Disrupts Xinbi Guarantee Scam Marketplace, Freezes $52.8 Million in Crypto

The U.S. Department of Justice DoJ on Wednesday announced coordinated actions aimed at an illicit online marketplace called Xinbi Guarantee that offered scam services, including seizing Telegram channels used to run the service, confiscating two cryptocurrency wallets, and deploying the Scam Cent...

Astra Linux – Vulnerability in xwayland, xorg-server

A use-after-free flaw was discovered in X.Org and Xwayland. When a device is removed while it is still frozen, the events queued for that device remain active even after the device is freed. Playing back those events will lead to a use-after-free...

Linux Distros Unpatched Vulnerability : CVE-2026-7485

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in frozen BI aggregations in Checkmk 2.5.0p2, 2.4.0p29, 2.3.0p47, and all 2.2.0 versions allows an authenticated user with restricted ho...

CVE-2026-7485

Incorrect authorization in frozen BI aggregations in Checkmk 2.5.0p2, 2.4.0p29, 2.3.0p47, and all 2.2.0 versions allows an authenticated user with restricted host and service visibility to learn the names and the existence of hosts and services they are not authorized to see...

UBUNTU-CVE-2026-7485

Incorrect authorization in frozen BI aggregations in Checkmk 2.5.0p2, 2.4.0p29, 2.3.0p47, and all 2.2.0 versions allows an authenticated user with restricted host and service visibility to learn the names and the existence of hosts and services they are not authorized to see...

CVE-2026-7485

Incorrect authorization in frozen BI aggregations in Checkmk 2.5.0p2, 2.4.0p29, 2.3.0p47, and all 2.2.0 versions allows an authenticated user with restricted host and service visibility to learn the names and the existence of hosts and services they are not authorized to see...

CVE-2026-7485 Frozen BI aggregations leak host and service names to unauthorized users

Incorrect authorization in frozen BI aggregations in Checkmk 2.5.0p2, 2.4.0p29, 2.3.0p47, and all 2.2.0 versions allows an authenticated user with restricted host and service visibility to learn the names and the existence of hosts and services they are not authorized to see...

EUVD-2026-63321

Incorrect authorization in frozen BI aggregations in Checkmk 2.5.0p2, 2.4.0p29, 2.3.0p47, and all 2.2.0 versions allows an authenticated user with restricted host and service visibility to learn the names and the existence of hosts and services they are not authorized to see...

CVE-2026-50577

In ePA 3.x Integration (fbeta-GmbH), request_counter is left unchanged in app/vau/VAUProtokoll.py, causing the server to reuse AES-GCM nonce/key pairs across responses. This enables a network attacker to recover plaintext XORs, exploit the Joux forbidden attack to recover the GHASH key, forge mes...

CVE-2026-68132

In the Linux kernel, the following vulnerability has been resolved: super: fix emergency thaw deadlock on frozen block devices dothawallcallback calls bdevthaw while holding sb-sumount exclusively. If the block device was frozen via bdevfreeze dropping the last block layer freeze reference calls...

AZL-95139 CVE-2026-68132 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: super: fix emergency thaw deadlock on frozen block devices dothawallcallback calls bdevthaw while holding sb-sumount exclusively. If the block device was frozen via bdevfreeze dropping the last block layer freeze reference calls...

UBUNTU-CVE-2026-68132

In the Linux kernel, the following vulnerability has been resolved: super: fix emergency thaw deadlock on frozen block devices dothawallcallback calls bdevthaw while holding sb-sumount exclusively. If the block device was frozen via bdevfreeze dropping the last block layer freeze reference calls...

CVE-2026-68132

CVE-2026-68132 concerns the Linux kernel thaw deadlock involving frozen block devices. The root cause is do_thaw_all_callback() calling bdev_thaw() while holding sb->s_umount, which can lead to a deadlock when a block device frozen via bdev_freeze() drops the last freeze reference and fs_bdev_...

CVE-2026-68132 super: fix emergency thaw deadlock on frozen block devices

In the Linux kernel, the following vulnerability has been resolved: super: fix emergency thaw deadlock on frozen block devices dothawallcallback calls bdevthaw while holding sb-sumount exclusively. If the block device was frozen via bdevfreeze dropping the last block layer freeze reference calls...

EUVD-2026-55513

In the Linux kernel, the following vulnerability has been resolved: super: fix emergency thaw deadlock on frozen block devices dothawallcallback calls bdevthaw while holding sb-sumount exclusively. If the block device was frozen via bdevfreeze dropping the last block layer freeze reference calls...

Linux Distros Unpatched Vulnerability : CVE-2026-68132

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - super: fix emergency thaw deadlock on frozen block devices dothawallcallback calls bdevthaw while holding sb-sumount exclusively. If the block device was frozen...

CVE-2026-48170

scim-patch, a library to perform SCIM patch, prior to version 0.9.1 performs prototype pollution when applying a SCIM PATCH operation whose value object contains a key like "proto.someProp". After one such patch, Object.prototype.someProp is set process-wide, affecting every plain object in the...

CVE-2026-48170

The CVE-2026-48170 issue affects the scim-patch library (SCIM PATCH processing). Before version 0.9.1, PATCH operations with a value object containing keys like proto .someProp can pollute Object.prototype, affecting all plain objects in the Node process. This can enable prototype pollution with ...