CVE-2026-76054

Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows an actor able to execute code within the scanned project's build to obtain the Black Duck API token via the ambient process environment, which is inherited by subprocesses launched...

JLSEC-2026-1386

HDF5 contains a NULL pointer dereference vulnerability. Processing a crafted HDF5 file containing an attribute with an invalid variable-length datatype type field may cause the application to crash when the attribute is read...

CVE-2026-76054

Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows an actor able to execute code within the scanned project's build to obtain the Black Duck API token via the ambient process environment, which is inherited by subprocesses launched...

CVE-2026-76054

Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows an actor able to execute code within the scanned project's build to obtain the Black Duck API token via the ambient process environment, which is inherited by subprocesses launched...

CVE-2026-76054

CVE-2026-76054 affects Black Duck blackduck-c-cpp versions 1.0.17 through 3.0.6 . When the Black Duck API token is supplied via the BLACKDUCK_API_TOKEN or BD_HUB_TOKEN environment variable, it is inherited by subprocesses launched during build capture and signature scanning. An actor able to exec...

EUVD-2026-64894

Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows an actor able to execute code within the scanned project's build to obtain the Black Duck API token via the ambient process environment, which is inherited by subprocesses launched...

CVE-2026-76054

Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows an actor able to execute code within the scanned project's build to obtain the Black Duck API token via the ambient process environment, which is inherited by subprocesses launched...

WordlistLoader Delivers Amatera via ClickFix, SynkLoader Phishes Windows Passwords

Cybersecurity researchers have flagged two new malware families called WordlistLoader and SynkLoader that's used to deliver next-stage payloads and likely sell access to ransomware groups. According to findings from Gen Digital, WordlistLoader is being used to deliver Amatera Stealer aka ACR...

Tracking PavinLoader across ClickFix and fake download campaigns

In our previous analysis of the malicious RenPy campaigns, we identified a multi-stage loader deployed as part of the infection chain. Further threat hunting has since shown that the same loader, which we track as PavinLoader , is being used across several different campaigns, including ClickFix...

CVE-2026-74679

A flaw was found in the Linux kernel's USB gadget NCM Network Control Model function fncm. A malicious host can exploit an integer overflow vulnerability by supplying a large offset. This overflow causes a signed index variable to become negative, bypassing security checks and leading to an...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Rejects undersized DACLs before parsing ACEs The parsedacl function limits the number of attacker-controlled ACE entries by comparing it with the minimum number of ACE entries that fit within the DACL size. The DACL size...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: Binder: Fixed the issue where dereferencing the null-ptr variable occurred unexpectedly. Syzbot reported several issues introduced by commit 44e602b4e52f „binderalloc: added missing mmaplock calls when using VMA”. In these...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: 1. fs/proc/taskmmu: Fixed the race condition in makeuffdwphugepte where updates to the “Dirty” or “Accessed” status of a page might be lost when PAGEMAPSCAN writes-protects a HUGETLB PTE. 2. fs/proc/taskmmu: The...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: A deadlock occurs when uvcstatusstop is called from asyncctrl.work. If a UVC camera has an asynchronous control, uvcstatusstop may be called from asyncctrl.work: c uvcctrlstatuseventwork uvcctrlstatusevent...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fixed a KASAN slab-out-of-bounds issue in amdgpucoredump’s ring dump operation. The ring content dump in amdgpucoredump involves two separate loops that iterate over adev-rings: the first loop counts rings whose fence...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: pmdomain: imx: Fix i.MX8MP VC8000E power-up sequence According to the errata1: ERR050531: The power-down handshake for VPUNOC may hang during the power-up/down cycling of VC8000E/VPUMIX. Description: There may be a timing issue...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: net: ixp4xxhss: Fixed duplicate HDLC netdev allocations. The ixp4xxhssprobe function allocates two HDLC netdevs. The first one is stored in the ndev variable, initialized, and registered with the registerhdlcdevice function. The...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: ntfs: Validates attribute values during lookups. The ntfsattrfind and ntfsexternalattrfind functions check whether the generic resident attribute values fit within their respective attribute records, and ensure that fixed-size...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: tcp: The task of freeing md5siginfo is delayed beyond the RCU grace period in tcpconnect. The reconciliation of md5 and ao in tcpconnect net/ipv4/tcpoutput.c has two symmetric branches: c if needsmd5 tcpaodestroysocksk, false; el...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: Rejects short AUTHRECEIVE buffers. The nvmetexecuteauthreceive function relies on the AUTHRECEIVE allocation length. It only checks whether the length is non-zero and matches the transfer length. In the SUCCESS1 and...