CVE-2026-41311: Uncontrolled Recursion

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to version 10.25.7, a circular block reference in % layout % / % block % causes an infinite recursive loop, consuming all available memory 4GB and crashing the Node.js process with FATAL ERROR: JavaScript he...

Improper Handling of Inconsistent Special Elements

Overview Affected versions of this package are vulnerable to Improper Handling of Inconsistent Special Elements due to inconsistent handling of negation operators in glob pattern processing. An attacker can cause unintended rule matching or bypass intended restrictions by crafting layouts that ar...

CVE-2026-43465 net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ XDP multi-buf programs can modify the layout of the XDP buffer when the program calls bpfxdppulldata or bpfxdpadjusttail. The referenced commit in the fixes tag...

Brave Desktop 1.90.121 Security Fixes

Changed IPFS gateway usage from "ipfs.io" to "inbrowser.link" for IPFS domain resolution. - Fixed broken address bar layout for narrow window widths. - Updated body-sniffing to respect "Content-Disposition: attachment" in de-AMP as reported on HackerOne by newfunction. Upgraded Chromium to...

SUSE CVE-2026-43081

In the Linux kernel, the following vulnerability has been resolved: net: ipa: fix GENERICCMD register field masks for IPA v5.0+ Fix the field masks to match the hardware layout documented in downstream GSI GSIV30EEnGSIEEGENERICCMD. Notably this fixes a WARN I was seeing when I tried to send "stop...

GHSA-QRGM-P9W5-RRFW Craft CMS has Potential Authenticated Remote Code Execution via Malicious Attached Behavior

We identified a vulnerability in the latest version of Craft CMS which contains an input-handling flaw in a Yii object creation path that let any authenticated user inject malicious configuration and execute arbitrary commands on the server. Yii’s dynamic object configuration, as implemented in...

Craft CMS has Potential Authenticated Remote Code Execution via Malicious Attached Behavior

We identified a vulnerability in the latest version of Craft CMS which contains an input-handling flaw in a Yii object creation path that let any authenticated user inject malicious configuration and execute arbitrary commands on the server. Yii’s dynamic object configuration, as implemented in...

BIT-JAVA-MIN-2023-25193

hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger On^2 growth via consecutive marks during the process of looking back for base glyphs when attaching marks...

EUVD-2026-27572

In the Linux kernel, the following vulnerability has been resolved: net: ipa: fix GENERICCMD register field masks for IPA v5.0+ Fix the field masks to match the hardware layout documented in downstream GSI GSIV30EEnGSIEEGENERICCMD. Notably this fixes a WARN I was seeing when I tried to send "stop...

CVE-2026-43081

In the Linux kernel, the following vulnerability has been resolved: net: ipa: fix GENERICCMD register field masks for IPA v5.0+ Fix the field masks to match the hardware layout documented in downstream GSI GSIV30EEnGSIEEGENERICCMD. Notably this fixes a WARN I was seeing when I tried to send "stop...

CVE-2026-43081

The CVE-2026-43081 issue lies in the Linux kernel IPA driver where GENERIC_CMD register field masks for IPA v5.0+ were incorrectly configured, risking system instability. The description across multiple connected sources states this could produce a WARN when sending commands (e.g., to the MPSS re...

CVE-2026-43081 net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+

In the Linux kernel, the following vulnerability has been resolved: net: ipa: fix GENERICCMD register field masks for IPA v5.0+ Fix the field masks to match the hardware layout documented in downstream GSI GSIV30EEnGSIEEGENERICCMD. Notably this fixes a WARN I was seeing when I tried to send "stop...

CVE-2026-43081 net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+

In the Linux kernel, the following vulnerability has been resolved: net: ipa: fix GENERICCMD register field masks for IPA v5.0+ Fix the field masks to match the hardware layout documented in downstream GSI GSIV30EEnGSIEEGENERICCMD. Notably this fixes a WARN I was seeing when I tried to send "stop...

Linux Kernel Security Vulnerabilities

The Linux kernel is the kernel used by the Linux operating system developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from the mismatch between the mask of the GENERICCMD register field in IPA v5.0+ and the hardware layout. Th...

A Novel Byte-Level Flow-To-Image Encoding Method for Network Intrusion Detection Systems

Network-based Intrusion Detection Systems IDS are predominantly trained on tabular flow records, whose one-dimensional representations limit convolutional architectures from exploiting inter-feature spatial correlations. This paper presents a novel byte-level flow-to-image encoding method that...

PT-2026-61398

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the arm ffa firmware component where framework notification messages in the shared RX buffer are not properly validated. Specifically, the system fails to verify the...

com.github.seratch:scalatra-thymeleaf-support_2.9.1 (>=1.0.0, <=2.0.1), com.github.seratch:scalatra-thymeleaf-support_2.9.2 (>=1.0.0, <=2.0.1) +3 more potentially affected by CVE-2026-41901 via org.thymeleaf:thymeleaf (2.0.8)

org.thymeleaf:thymeleaf MAVEN version 2.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - com.github.seratch:scalatra-thymeleaf-support2.9.1 =1.0.0, =1.0.0, =1.0.1, =1.0.2 - org.thymeleaf:thymeleaf-sprin...

nz.net.ultraq.web.thymeleaf:thymeleaf-layout-dialect (1.0.3), org.thymeleaf:thymeleaf-spring3 (2.0.11) potentially affected by CVE-2026-41901 via org.thymeleaf:thymeleaf (2.0.11)

org.thymeleaf:thymeleaf MAVEN version 2.0.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - nz.net.ultraq.web.thymeleaf:thymeleaf-layout-dialect 1.0.3 - org.thymeleaf:thymeleaf-spring3 2.0.11 Source cves:...

com.github.dandelion:datatables-thymeleaf (>=0.9.0, <=0.9.2), nz.net.ultraq.thymeleaf:thymeleaf-layout-dialect (>=1.1, <=1.1.3) +10 more potentially affected by CVE-2026-41901 via org.thymeleaf:thymeleaf (2.0.17)

org.thymeleaf:thymeleaf MAVEN version 2.0.17 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - com.github.dandelion:datatables-thymeleaf =0.9.0, =1.1, =3.0.0-ga, =3.0.0-ga, =3.0.0-ga, =3.0.0-ga, =3.0.0-ga,...

CVE-2026-42369

GV-VMS V20 is a Video Monitoring Software used to gather the feeds of many surveillance cameras and manage other security devices. It is a native application accessed locally, but it is also possible to enable remote access via the "WebCam Server" feature. Once enabled, it is possible to access t...