CVE-2026-68084 staging: vme_user: fix location monitor leak in tsi148 bridge

In the Linux kernel, the following vulnerability has been resolved: staging: vmeuser: fix location monitor leak in tsi148 bridge tsi148probe allocates a location monitor resource and links it into tsi148bridge-lmresources. The probe error path frees this list, but tsi148remove only frees the dma,...

CVE-2026-68084

The CVE concerns the Linux kernel staging: vme_user component, specifically the tsi148 bridge. The root cause is a leaked location monitor resource (lm_resources) because tsi148_remove() did not free lm_resources when unbinding or unloading, unlike other resources. The fix is to free the lm_resou...

MINI-VP6F-P4MW-W5F9

Bulletin has no description...

MINI-XXXX-6F7R-X43R

Bulletin has no description...

MINI-PRC9-H3F8-PMHF

Bulletin has no description...

Exploit for Incorrect Authorization in Apache Polaris

CVE-2026-64640 — Apache Polaris: credential vending before loc...

Arbitrary Output Location Change in GNU Bison

...

CVE-2026-54214: URL Redirection to Untrusted Site

Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to HTTP header injection through the “cType” URL parameter, which allows arbitrary modification of the Content-Type header in HTTP responses. Because the parameter does not properly restrict control characters such as URL-encoded...

MINI-WFR6-JGFC-G9QX

Bulletin has no description...

CVE-2026-64640 Apache Polaris: register endpoint reads attacker-controlled storage location before allowed-locations validation

Apache Polaris did not consistently validate storage locations supplied during table and view registration. An authenticated principal with permission to register a table or view could, depending on the affected release and registration path, cause Polaris to use the catalog's storage credentials...

CVE-2026-64640 Apache Polaris: register endpoint reads attacker-controlled storage location before allowed-locations validation

Apache Polaris did not consistently validate storage locations supplied during table and view registration. An authenticated principal with permission to register a table or view could, depending on the affected release and registration path, cause Polaris to use the catalog's storage credentials...

MINI-9G73-HP2J-G6F6

Bulletin has no description...

CGA-987Q-F322-CC7W

Bulletin has no description...

CGA-7F72-HFJ4-RPV8

Bulletin has no description...

CGA-FM5W-93VC-V533

Bulletin has no description...

MINI-MW36-WG87-QP73

Bulletin has no description...

MINI-35JH-34WR-PV65

Bulletin has no description...

MINI-FCQF-PM56-7QFJ

Bulletin has no description...

MINI-2X4Q-23HJ-P3F2

Bulletin has no description...

MAL-2026-12043 Malicious code in sextant-cli-linux-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc34f69b5a68c549feccfb32cc2dbfbf2d4c787a4876241027b4299305fd2c53 The package is a platform-specific leaf linux/arm64 whose only shipped artifact is a 12 MB stripped Go binary at bin/sxt. The package.json omits...