45527 matches found
Security Bulletin: This Power System update is being released to address CVE-2026-18871
Summary Power Systems Firmware is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the service processor can write specially crafted configuration data, causing the host firmware boot stack to crash with possible memory...
Malicious code in twilio-hackerone-poc-afe6937c (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6790435b096935699da3234140accc517ced689047a68e698cae06288939eed9 On npm install, preinstall/postinstall scripts execute id, read environment variables including AWSLAMBDALOGSTREAMNAME, list /var/task, and read pare...
CVE-2026-15689
Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in defaultemailpasswordreset and defaultwelcomesend. Both default emails emit a link of the form $base/login/$code, whose authority comes from the request Host header,...
CVE-2026-15689
Dancer2::Plugin::Auth::Extensible through 0.713 trusts the Host header (or X-Forwarded-Host) to build password-reset and welcome links, enabling unauthenticated link poisoning that can lead to account takeover. No patch version is specified; mitigation is to set a trusted uri_base configuration v...
EUVD-2026-59758
Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in defaultemailpasswordreset and defaultwelcomesend. Both default emails emit a link of the form $base/login/$code, whose authority comes from the request Host header,...
CVE-2026-15689 Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in _default_email_password_reset and _default_welcome_send
Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in defaultemailpasswordreset and defaultwelcomesend. Both default emails emit a link of the form $base/login/$code, whose authority comes from the request Host header,...
CVE-2026-15689
Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in defaultemailpasswordreset and defaultwelcomesend. Both default emails emit a link of the form $base/login/$code, whose authority comes from the request Host header,...
UBUNTU-CVE-2026-74516
In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active Always update x2APIC MSR intercepts for L1 when AVIC is deactivated, even if L2 is active and KVM is using a separate MSR bitmap to run L2. If AVIC is...
CVE-2026-74518 mm/hugetlb: fix list corruption in allocate_file_region_entries()
In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix list corruption in allocatefileregionentries allocatefileregionentries tops up resv-regioncache with freshly allocated fileregion descriptors. The allocation uses GFPKERNEL, so resv-lock is dropped around it: the...
CVE-2026-74516
The CVE-2026-74516 issue affects the Linux kernel (KVM/SMV) where, if AVIC is inhibited while L2 is active, the host may run L1 with AVIC disabled and with x2APIC MSR intercepts also disabled. This allows L1 to access the host APIC state, trigger arbitrary interrupts, modify task priority, and co...
CVE-2026-74516
In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active Always update x2APIC MSR intercepts for L1 when AVIC is deactivated, even if L2 is active and KVM is using a separate MSR bitmap to run L2. If AVIC is...
CVE-2026-74463
In the Linux kernel, the following vulnerability has been resolved: i2c: jz4780: Cache host clock rate at probe to prevent CCF preparelock deadlock Fix a severe AB/BA deadlock between the Common Clock Framework CCF and the I2C adapter lock, which triggers when an I2C-controlled clock generator...
CVE-2026-72483
In the Linux kernel, the following vulnerability has been resolved: usb: host: max3421: Fix shift-out-of-bounds in max3421hubcontrol The max3421hubcontrol function handles USB hub class requests to the virtual root hub. In the default branches of both the ClearPortFeature and SetPortFeature switc...
CVE-2026-72286
In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs The intra-host migration/mirroring feature is not fully implemented for SEV-SNP VMs. The proper migration requires additional SNP-specific state such as...
CVE-2026-74356 vhost: fix vhost_get_avail_idx for a non empty ring
In the Linux kernel, the following vulnerability has been resolved: vhost: fix vhostgetavailidx for a non empty ring vhostgetavailidx is supposed to report whether it has updated vq-availidx. Instead, it returns whether all entries have been consumed, which is usually the same. But not always - i...
PT-2026-73031
Name of the Vulnerable Software and Affected Versions Dancer2::Plugin::Auth::Extensible versions prior to 0.714 Description Password reset link poisoning is possible via the request Host header in the default email password reset and default welcome send functions. Both default emails generate a...
Linux Distros Unpatched Vulnerability : CVE-2026-74512
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - audit: fix potential use-after-free in auditdelrule auditdelrule destroys e-rule.exe via auditremovemarkrule before unlinking the rule from RCU-visible filter...
Linux Distros Unpatched Vulnerability : CVE-2026-74518
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mm/hugetlb: fix list corruption in allocatefileregionentries allocatefileregionentries tops up resv-regioncache with freshly allocated fileregion descriptors. T...
Linux Distros Unpatched Vulnerability : CVE-2026-72085
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: xen: scsiback: Free unsubmitted command instead of double-putting it scsibackgetpendreq obtains a command tag and returns a vscsibkpend whose embedded sec...