CVE-2026-18915

Invocation of process using visible sensitive information vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-otp-lock allows System Footprinting. This issue affects eta-otp-lock: before 1.0.4...

CVE-2026-18915 Exposure of OTP Secret Through Process Command-Line Arguments in TÜBİTAK BİLGEM's eta-otp-lock

Invocation of process using visible sensitive information vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-otp-lock allows System Footprinting. This issue affects eta-otp-lock: before 1.0.4...

EUVD-2026-53819

Invocation of process using visible sensitive information vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-otp-lock allows System Footprinting. This issue affects eta-otp-lock: before 1.0.4...

CVE-2026-18915

Invocation of process using visible sensitive information vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-otp-lock allows System Footprinting. This issue affects eta-otp-lock: before 1.0.4...

CVE-2026-18915

CVE-2026-18915 affects eta-otp-lock (TÜBİTAK BİLGEM) prior to 1.0.4. The vulnerability is described as a vulnerability where a process can expose visible sensitive information, enabling system footprinting via command-line access. The CVSS 3.1 score is 5.0 (Medium), with local attack vector (AV:L...

CVE-2026-18915 Exposure of OTP Secret Through Process Command-Line Arguments in TÜBİTAK BİLGEM's eta-otp-lock

Invocation of process using visible sensitive information vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-otp-lock allows System Footprinting. This issue affects eta-otp-lock: before 1.0.4...

CVE-2026-64603 platform/x86: intel-hid: Protect ACPI notify handler against recursion

In the Linux kernel, the following vulnerability has been resolved: platform/x86: intel-hid: Protect ACPI notify handler against recursion Since commit e2ffcda16290 "ACPI: OSL: Allow Notify handlers to run on all CPUs" ACPI notify handlers like the intel-hid notifyhandler may run on multiple CPU...

CVE-2026-64586 wifi: brcmfmac: drain bus_reset work on device removal

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: drain busreset work on device removal brcmffwcrashed and the debugfs "reset" entry both schedule drvr-busreset, whose callback recovers drvr through containerof and dereferences it. The removal path frees drvr...

RLSA-2026:49871 Moderate: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: Linux kernel: Denial of Service due to NULL function pointer race in timer shutdown CVE-2025-68214 kernel: procfs: avoid fetching build ID while holding VMA lock CVE-2026-23199 Bug Fixes...

PT-2026-68450

Name of the Vulnerable Software and Affected Versions eta-otp-lock versions prior to 1.0.4 Description The software contains an issue where processes are invoked using visible sensitive information, which can be leveraged to perform system footprinting. System footprinting is a technique used to...

CVE-2026-18915: Invocation of Process Using Visible Sensitive Information

Invocation of process using visible sensitive information vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-otp-lock allows System Footprinting. This issue affects eta-otp-lock: before 1.0.4...

EulerOS 2.0 SP15 : httpd (EulerOS-SA-2026-2929)

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A NULL pointer dereference in moddavlock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious...

Linux Distros Unpatched Vulnerability : CVE-2026-64586

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: brcmfmac: drain busreset work on device removal brcmffwcrashed and the debugfs reset entry both schedule drvr-busreset, whose callback recovers drvr throu...

keycloak: Keycloak: Brute-force protection bypass in CIBA flow

A flaw was found in Keycloak, an open-source identity and access management solution. When a user account is temporarily locked due to repeated failed login attempts, an attacker with valid client credentials can exploit the Client-Initiated Backchannel Authentication CIBA flow to bypass this...

keycloak: Keycloak: Brute-force protection bypass in CIBA flow

A flaw was found in Keycloak, an open-source identity and access management solution. When a user account is temporarily locked due to repeated failed login attempts, an attacker with valid client credentials can exploit the Client-Initiated Backchannel Authentication CIBA flow to bypass this...

MAL-2026-13318 Malicious code in dolyame-boxy-independent-bnpl-info-slider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc1752274e08bd28f5be07afaa71cafeea1e7822330016892d0f06abd6c50681 On require of the package, index.js loads vendor.js which downloads a platform-specific binary from a string-concatenation-obfuscated list of...

MAL-2026-13341 Malicious code in dolyame-boxy-mobile-bnpl-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 405339008cf0f3e8c17a5e982b006c85c7f9f8110bbdc6531b4c6f71c2fbabb0 On require of the package, shim.js assembles remote hostnames at runtime by joining split string fragments four Cloudflare Workers subdomains such as...

Malicious code in dwhetlfront-dwhetlfront-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fad333b1a33066fabeca9799bee065c5d6431467699a187a25d6ef56a9cbea7f On require of the package, index.js loads support.js which selects a platform-specific payload URL, downloads bytes from Cloudflare workers.dev hosts...

MAL-2026-13202 Malicious code in dwhetlfront-dwhetlfront-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fad333b1a33066fabeca9799bee065c5d6431467699a187a25d6ef56a9cbea7f On require of the package, index.js loads support.js which selects a platform-specific payload URL, downloads bytes from Cloudflare workers.dev hosts...

Malicious code in bigops-activity-headers-interceptor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 276084c74a91d1e2369091a4da29068c4c3c46b3e1cc782a2fcbbf1d4261e9ec On require'bigops-activity-headers-interceptor', index.js loads helpers.js which auto-invokes start. The module fetches a platform-specific binary fr...