CVE-2026-93606

A flaw was found in vm2. An attacker running untrusted code within the sandbox can bypass isolation controls to achieve arbitrary code execution on the host system. This issue is caused by improper sanitization of host Promise objects, which allows sandboxed scripts to manipulate Promise...

Host Validation Bypass

Apache Parquet is vulnerable to host validation bypass. The vulnerability is due to the pluggable KmsClient implementation not performing host validation for a file‑controlled KMS URL, where the URL from the Parquet file is forwarded without checks and a malicious actor can inject a hostile host,...

CVE-2026-17577

The SSL Zen plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'uri' and 'host' parameters in versions up to, and including, 4.7.42. The sslzenmessages::getMessages function builds the 'tokenmissmatch' message using base64decodesanitizetextfield$REQUEST'uri' and optional...

CVE-2026-17577 SSL Zen <= 4.7.42 - Reflected Cross-Site Scripting via 'uri' Parameter

The SSL Zen plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'uri' and 'host' parameters in versions up to, and including, 4.7.42. The sslzenmessages::getMessages function builds the 'tokenmissmatch' message using base64decodesanitizetextfield$REQUEST'uri' and optional...

CVE-2026-17577

The SSL Zen plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) in versions up to and including 4.7.42 . The flaw exists in the ssl_zen_messages::getMessages() function, which processes the uri and host parameters. Because the application uses base64_decode() on the output ...

CVE-2026-17577 SSL Zen <= 4.7.42 - Reflected Cross-Site Scripting via 'uri' Parameter

The SSL Zen plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'uri' and 'host' parameters in versions up to, and including, 4.7.42. The sslzenmessages::getMessages function builds the 'tokenmissmatch' message using base64decodesanitizetextfield$REQUEST'uri' and optional...

EUVD-2026-86593

The SSL Zen plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'uri' and 'host' parameters in versions up to, and including, 4.7.42. The sslzenmessages::getMessages function builds the 'tokenmissmatch' message using base64decodesanitizetextfield$REQUEST'uri' and optional...

MAL-2026-17169 Malicious code in @alphaspace/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42d10ba1427af01794dfb0a6b39a05f969547455e9d86d75f18601b1d035c507 preinstall.js runs unconditionally on npm install and POSTs a JSON payload to a hardcoded Pipedream collector at...

Malicious code in @alphaspace/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42d10ba1427af01794dfb0a6b39a05f969547455e9d86d75f18601b1d035c507 preinstall.js runs unconditionally on npm install and POSTs a JSON payload to a hardcoded Pipedream collector at...

OESA-2026-4082 docker security update

Security Fixes: Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to create empty files or...

OESA-2026-4074 flatpak-builder security update

Flatpak-builder is a tool for building flatpaks from sources. Security Fixes: A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the...

Linux Distros Unpatched Vulnerability : CVE-2026-93225

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - phy: fsl-imx8mq-usb: fix typec switch leak on probe error path If probe fails after imx95usbphygettca succeeds, the typec switch leaks because the only cleanup...

Linux Distros Unpatched Vulnerability : CVE-2026-97931

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: us122l: Prevent write upgrades for read mappings The hwdep mmap callback rejects read-buffer mappings that are initially writable, but leaves VMMAYWRITE s...

Linux Distros Unpatched Vulnerability : CVE-2026-97550

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xfs: fix unit conversions in perbinval computation LOLLM noticed that we're doing the unit conversion in the perbinval computation backwards --...

Linux Distros Unpatched Vulnerability : CVE-2026-97529

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: qla2xxx: Validate BSG requestlen before reading vendorcmd The FC BSG transport allocates job-request via memdupuser using the exact user-supplied...

Linux Distros Unpatched Vulnerability : CVE-2026-98003

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iommu/amd: Do not reallocate GA log buffers on resume Commit c5e1a1eb9279 iommu/amd: Simplify and Consolidate Virtual APIC AVIC Enablement moved the GA log...

Linux Distros Unpatched Vulnerability : CVE-2026-97575

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: v4l2-ctrls: validate AV1 tile counts The stateless AV1 decoders use tileinfo.tilecols and tilerows as loop bounds and as indices into the mistarts and...

Linux Distros Unpatched Vulnerability : CVE-2026-97600

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ieee802154: cc2520: fix FIFOP work use-after-free The FIFOP interrupt handler queues cc2520fifopirqwork. On removal, cc2520remove only flushes the work. The...

Linux Distros Unpatched Vulnerability : CVE-2026-97531

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: qla2xxx: Skip vport under deletion in report ID acquisition qla24xxreportidacquisition format-1 handling walks ha-vplist under vportslock, takes a...

Linux Distros Unpatched Vulnerability : CVE-2026-97971

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nstree: check listing permission before taking a namespace reference legitimizens takes a reference on the candidate namespace before maylistns has decided...