CVE-2026-64567 btrfs: reject free space cache with more entries than pages

In the Linux kernel, the following vulnerability has been resolved: btrfs: reject free space cache with more entries than pages When loading a v1 free space cache, loadfreespacecache takes numentries and numbitmaps straight from the on-disk btrfsfreespaceheader. That header is stored in the...

CVE-2026-64568 wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix unsolbcastproberesp double free on alloc failure ieee80211setunsolbcastproberesp calls kfreercu on the old template before allocating the replacement. If the kzalloc then fails, it returns -ENOMEM while...

CVE-2026-64566 xfrm: iptfs: propagate SKBFL_SHARED_FRAG in iptfs_skb_add_frags()

In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: propagate SKBFLSHAREDFRAG in iptfsskbaddfrags When iptfsskbaddfrags copies frag references from the source frag walk into a new SKB, it increments the page reference count via skbfragref but does not propagate...

CVE-2026-70375

HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability CWE-78 in the Git deployer component. GitDeployer.pullRepo in src/Server/Entity/Deployer/GitDeployer.js executes AppService.exec, interpolating the configured branch value directly into a shell command with no escaping...

QuickFox Supply Chain Attack Delivers FDMTP Backdoor via Trojanized Windows Installer

Cybersecurity researchers have disclosed what has been described as a "long-standing supply chain attack" on QuickFox, a virtual private network VPN and network acceleration tool designed for overseas Chinese users. According to Fortinet FortiGuard Labs, the supply chain attack has been ongoing...

CVE-2026-70375 HashBrown CMS - OS Command Injection via Git Deployer Branch Field

HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability CWE-78 in the Git deployer component. GitDeployer.pullRepo in src/Server/Entity/Deployer/GitDeployer.js executes AppService.exec, interpolating the configured branch value directly into a shell command with no escaping...

CVE-2026-70375 HashBrown CMS - OS Command Injection via Git Deployer Branch Field

HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability CWE-78 in the Git deployer component. GitDeployer.pullRepo in src/Server/Entity/Deployer/GitDeployer.js executes AppService.exec, interpolating the configured branch value directly into a shell command with no escaping...

CVE-2026-70375 HashBrown CMS - OS Command Injection via Git Deployer Branch Field

HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability CWE-78 in the Git deployer component. GitDeployer.pullRepo in src/Server/Entity/Deployer/GitDeployer.js executes AppService.exec, interpolating the configured branch value directly into a shell command with no escaping...

CVE-2026-70375

HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability CWE-78 in the Git deployer component. GitDeployer.pullRepo in src/Server/Entity/Deployer/GitDeployer.js executes AppService.execgit checkout $this.branch || 'master', interpolating the configured branch value directly into...

EUVD-2026-53098

HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability CWE-78 in the Git deployer component. GitDeployer.pullRepo in src/Server/Entity/Deployer/GitDeployer.js executes AppService.execgit checkout $this.branch || 'master', interpolating the configured branch value directly into...

CVE-2026-70375

CVE-2026-70375 : HashBrown CMS <1.4.6 has an OS Command Injection in the Git deployer. GitDeployer.pullRepo() runs AppService.exec(git checkout ${this.branch || 'master'}) with the branch value interpolated directly, and GitDeployer.validate() only rejects a single quote in repo/branch/usernam...

Exploit for CVE-2025-64513

milvus-auth-audit Milvus authentication security detection sc...

Malicious code in @zzzgenesis00/mnemonic-to-key (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3af286f89deaee9dcce3d85f9bd53bc2b03e63dccf0073c74988b3f3a3763e8 On npm install, postinstall.js executes and enumerates installer-side secrets: files under /.ssh non-.pub private keys, /.npmrc, /.gitconfig,...

MAL-2026-12056 Malicious code in @zzzgenesis00/mnemonic-to-key (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3af286f89deaee9dcce3d85f9bd53bc2b03e63dccf0073c74988b3f3a3763e8 On npm install, postinstall.js executes and enumerates installer-side secrets: files under /.ssh non-.pub private keys, /.npmrc, /.gitconfig,...

MAL-2026-12058 Malicious code in @zzzgenesis00/spl-token-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ad6fd0f8ef16ee23b458b541d9cdfc73147e768ec9f8676ed50b30996231813 postinstall.js runs unconditionally on npm install and harvests installer-side secrets before transmitting them off-host. Collected data includes hos...

Malicious code in @zzzgenesis00/spl-token-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ad6fd0f8ef16ee23b458b541d9cdfc73147e768ec9f8676ed50b30996231813 postinstall.js runs unconditionally on npm install and harvests installer-side secrets before transmitting them off-host. Collected data includes hos...

Malicious code in @zzzgenesis00/ethers-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a206d278a371fdbb349d679797e7835b5e0ba40d1ac186b3287beb0a23540f09 The package's postinstall.js runs automatically on npm install and harvests installer-owned secrets: it scrapes a curated env-var allowlist NPMTOKEN,...

MAL-2026-12031 Malicious code in @zzzgenesis00/ethers-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a206d278a371fdbb349d679797e7835b5e0ba40d1ac186b3287beb0a23540f09 The package's postinstall.js runs automatically on npm install and harvests installer-owned secrets: it scrapes a curated env-var allowlist NPMTOKEN,...

Malicious code in @zzzgenesis00/bip39-mnemonic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f370f7bfdab3817c323daee33d8de48e5171c41dad3f1bff2f1335e04a65060 Package impersonates the bitcoinjs/bip39 project author field set to 'bitcoinjs-lib' and ships a postinstall.js that runs on npm install. The script...

MAL-2026-12030 Malicious code in @zzzgenesis00/bip39-mnemonic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f370f7bfdab3817c323daee33d8de48e5171c41dad3f1bff2f1335e04a65060 Package impersonates the bitcoinjs/bip39 project author field set to 'bitcoinjs-lib' and ships a postinstall.js that runs on npm install. The script...