MAL-2026-10934 Malicious code in twilio-internal (npm)

The twilio-internal package is one of four byte-identical dependency-confusion squats of Twilio's npm namespace published by user 'yuva2210' maintainer email [email protected], all at the sentinel version 99.99.99 chosen to outrank any internal/private version and win resolution against ...

Linux Distros Unpatched Vulnerability : CVE-2026-63884

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/i915: Fix potential UAF in TTM object purge TLDR: The bo-ttm object might be changed by calling ttmbovalidate, move casting it to an i915tt object later to...

Linux Distros Unpatched Vulnerability : CVE-2026-64106

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: arm64: vgic-its: Reject restored DTE with out-of-range numeventidbits Userspace can restore an ITS Device Table Entry whose Size field encodes more EventID...

Oracle Linux 10 : yggdrasil-worker-package-manager (ELSA-2026-19128)

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-19128 advisory. 0.2.3-7 - Bump release for rebuild 0.2.3-6 - Bump release for rebuild Tenable has extracted the preceding description block directly from the Oracle Linux...

Malicious code in supplyhub (npm)

The npm package supplyhub is a credential / SSH-key stealer. Its package.json declares a postinstall lifecycle hook postinstall: node postinstall.js that executes automatically on npm install, before the package is ever imported. postinstall.js uses fs.readFileSync to read the user's SSH private...

MAL-2026-10944 Malicious code in zer0onetencent (npm)

The zer0onetencent package was published to the npm registry by user 't2423048543' maintainer email [email protected]. It is described as 'A simple date formatting utility' but ships no such functionality; index.js only exports a hello stub returning the package name, indicating a package...

yggdrasil-worker-package-manager security update

0.2.3-7 - Bump release for rebuild 0.2.3-6 - Bump release for rebuild...

CVE-2026-64099

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Fix use-after-free of CPU job query arrays on error path The CPU job ioctl's fail label calls kvfree on cpujob's timestamp and performance query arrays after v3djobcleanup, which drops the job's last reference and frees...

CVE-2026-64100 drm/msm: Fix shrinker deadlock

In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix shrinker deadlock With PROVELOCKING on an Snapdragon X1 and VM reclaim pressure, we see: ====================================================== WARNING: possible circular locking dependency detected 7.0.0-debug+ 43...

CVE-2026-64099

The CVE-2026-64099 entry describes a Linux kernel vulnerability in DRM/V3D where CPU job query arrays could be read after the job is freed on error paths, causing a use-after-free. The root cause is reading cpu_job after v3d_job_cleanup() and in early failure paths, where v3d_job_deallocate() zer...

CVE-2026-64039

CVE-2026-64039 relates to the Linux kernel’s drm/msm/snapshot code, where dumping of unaligned regions caused issues because the snapshotting aligned data segments to 16 bytes. The fix removes length alignment and prints the last registers in the region more accurately; it also addresses a 16x me...

CVE-2026-63963 usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers Properly validate the count passed from a device when calling svdmconsumeidentity or svdmconsumeidentitysopprime as the device-controlled value could index of...

EUVD-2026-45736

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers Properly validate the count passed from a device when calling svdmconsumeidentity or svdmconsumeidentitysopprime as the device-controlled value could index of...

CVE-2026-63962

The CVE-2026-63962 entry describes a Linux kernel vulnerability in usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes(). The root cause is that svdm_consume_modes() checked pmdata->altmodes against the array size only once before looping over the count, not at every ite...

CVE-2026-63884 drm/i915: Fix potential UAF in TTM object purge

In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix potential UAF in TTM object purge TLDR: The bo-ttm object might be changed by calling ttmbovalidate, move casting it to an i915tt object later to actually get the right pointer. A user reported hitting the following...

CVE-2026-63863

The CVE-2026-63863 entry concerns the Linux kernel drm/gpusvm subsystem. The issue is a unbalanced unlock of gpusvm notifier_lock detected during drm_gpusvm_scan_mm(), where a path under err_free calls drm_gpusvm_notifier_lock() after unlocking, leading to a bad unlock balance warning. Connected ...

CVE-2026-63863 drm/gpusvm: Fix unbalanced unlock in drm_gpusvm_scan_mm()

In the Linux kernel, the following vulnerability has been resolved: drm/gpusvm: Fix unbalanced unlock in drmgpusvmscanmm There is a unbalanced lock/unlock to gpusvm notifier lock: 931.045868 ===================================== 931.046509 WARNING: bad unlock balance detected! 931.047149...

CVE-2026-53377

CVE-2026-53377 affects the Linux kernel DRM MSM driver. The GPU recovery path (Recover_worker) could fail to trigger recovery when no new work is submitted, leaving the GPU hung and potentially causing timeouts or unavailability. The fix changes Recover_worker to always recover the GPU (increment...

CVE-2026-53377 drm/msm: always recover the gpu

In the Linux kernel, the following vulnerability has been resolved: drm/msm: always recover the gpu Previously, in case there was no more work to do, recover worker wouldn't trigger recovery and would instead rely on the gpu going to sleep and then resuming when more work is submitted...

CVE-2026-53377

In the Linux kernel, the following vulnerability has been resolved: drm/msm: always recover the gpu Previously, in case there was no more work to do, recover worker wouldn't trigger recovery and would instead rely on the gpu going to sleep and then resuming when more work is submitted...