EUVD-2026-53819

Invocation of process using visible sensitive information vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-otp-lock allows System Footprinting. This issue affects eta-otp-lock: before 1.0.4...

CVE-2026-18915 Exposure of OTP Secret Through Process Command-Line Arguments in TÜBİTAK BİLGEM's eta-otp-lock

Invocation of process using visible sensitive information vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-otp-lock allows System Footprinting. This issue affects eta-otp-lock: before 1.0.4...

CVE-2026-64603 platform/x86: intel-hid: Protect ACPI notify handler against recursion

In the Linux kernel, the following vulnerability has been resolved: platform/x86: intel-hid: Protect ACPI notify handler against recursion Since commit e2ffcda16290 "ACPI: OSL: Allow Notify handlers to run on all CPUs" ACPI notify handlers like the intel-hid notifyhandler may run on multiple CPU...

CVE-2026-64586 wifi: brcmfmac: drain bus_reset work on device removal

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: drain busreset work on device removal brcmffwcrashed and the debugfs "reset" entry both schedule drvr-busreset, whose callback recovers drvr through containerof and dereferences it. The removal path frees drvr...

RLSA-2026:49871 Moderate: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: Linux kernel: Denial of Service due to NULL function pointer race in timer shutdown CVE-2025-68214 kernel: procfs: avoid fetching build ID while holding VMA lock CVE-2026-23199 Bug Fixes...

Linux Distros Unpatched Vulnerability : CVE-2026-64586

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: brcmfmac: drain busreset work on device removal brcmffwcrashed and the debugfs reset entry both schedule drvr-busreset, whose callback recovers drvr throu...

keycloak: Keycloak: Brute-force protection bypass in CIBA flow

A flaw was found in Keycloak, an open-source identity and access management solution. When a user account is temporarily locked due to repeated failed login attempts, an attacker with valid client credentials can exploit the Client-Initiated Backchannel Authentication CIBA flow to bypass this...

keycloak: Keycloak: Brute-force protection bypass in CIBA flow

A flaw was found in Keycloak, an open-source identity and access management solution. When a user account is temporarily locked due to repeated failed login attempts, an attacker with valid client credentials can exploit the Client-Initiated Backchannel Authentication CIBA flow to bypass this...

MAL-2026-13318 Malicious code in dolyame-boxy-independent-bnpl-info-slider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc1752274e08bd28f5be07afaa71cafeea1e7822330016892d0f06abd6c50681 On require of the package, index.js loads vendor.js which downloads a platform-specific binary from a string-concatenation-obfuscated list of...

Malicious code in bigops-activity-headers-interceptor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 276084c74a91d1e2369091a4da29068c4c3c46b3e1cc782a2fcbbf1d4261e9ec On require'bigops-activity-headers-interceptor', index.js loads helpers.js which auto-invokes start. The module fetches a platform-specific binary fr...

MAL-2026-12830 Malicious code in bigops-activity-headers-interceptor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 276084c74a91d1e2369091a4da29068c4c3c46b3e1cc782a2fcbbf1d4261e9ec On require'bigops-activity-headers-interceptor', index.js loads helpers.js which auto-invokes start. The module fetches a platform-specific binary fr...

Malicious code in async-mutex-lock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e195fef439eb6af3d28576857a30030e4bd839406fa36b2f939279743f12188e The package is advertised as a mutex-lock utility but ships none of the documented API no Mutex/lock/unlock. Its sole export, getPlugin in index.js,...

MAL-2026-12411 Malicious code in pfp-block-mobile-vacancy-description (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29681869c5fcf5be10eebd7b614f602f3232d1f4645b028d817436b5dfabeae5 On require of the package, index.js loads loader.js which unconditionally executes init. init selects an OS-specific payload path, downloads an opaqu...

CVE-2026-16604

CVE-2026-16604 affects the Passster WordPress plugin prior to 4.3.6. The vulnerability arises when a password-protected block’s content is inadvertently included in the public page response before the password is verified, allowing unauthenticated users to recover the protected content without kn...

Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically

Summary The built-in knowledge search tools let a chat participant choose the pattern used to grep knowledge files. Patterns containing regex metacharacters were compiled with Python's backtracking re engine and run against every line of every reachable file, with no time limit anywhere on that...

CVE-2026-70493 Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, the built-in knowledge search path in backend/openwebui/tools/knowledgefs.py and backend/openwebui/tools/builtin.py let a chat participant choose a pattern used to grep knowledge files...

kernel: procfs: avoid fetching build ID while holding VMA lock

A deadlock vulnerability was found in the procfs PROCMAPQUERY ioctl handler. When fetching the optional build ID while holding the VMA lock mmaplock, a circular lock dependency can occur with the inode mutex, causing a system deadlock...

Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-2014)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2014 advisory. In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU in ip6output CVE-2025-40158 In the Linux kernel, the following vulnerability has been resolved: gpio: Fix...

CVE-2026-18651

A flaw was found in 389 Directory Server. During SASL PLAIN authentication, the server installs connection-level bind credentials before performing the account-lock check. If the account is subsequently found to be locked, the bind is reported as failed to the client, but the already-installed...

UBUNTU-CVE-2026-18651

A flaw was found in 389 Directory Server. During SASL PLAIN authentication, the server installs connection-level bind credentials before performing the account-lock check. If the account is subsequently found to be locked, the bind is reported as failed to the client, but the already-installed...