CVE-2026-74572: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: fix deadlock between metadata writeback and transaction commit When writing out metadata extent buffers in a zoned filesystem, btreewritepages holds fsinfo-zonedmetaiolock across the whole writeback loop, including...

PT-2026-73024

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A deadlock occurs in the btrfs zoned filesystem during metadata writeback and transaction commit. The btree writepages function holds the fs info-zoned meta io lock throughout the...

CVE-2026-72108: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: dm thin metadata: fix metadata snapshot consistency on commit failure reservemetadatasnap and releasemetadatasnap modify the superblock's heldroot directly in the blockmanager's buffer. If the subsequent metadata commit fails, th...

PT-2026-72246

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the net/sched component where the tcf ct handle fragments function calls nf ct handle fragments without saving and restoring the skb-cb control buffer. Because the...

PT-2026-72261

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the net/mlx5e macsec component. When an offloaded MACsec RX SC is deleted, the macsec del rxsc ctx function frees the metadata dst object unconditionally...

PT-2026-72348

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the OCFS2 file system where the ocfs2 validate inode block function accepts any non-zero i mode value. This allows malformed on-disk fields to be copied into the in-co...

SUSE CVE-2026-16033

A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained file creation. When processing image metadata templates, LXD fails to properly sanitize or restrict template file paths from escaping the instance templates directory specifically affecti...

SUSE CVE-2026-66898

A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during backup import and restore operations. When importing or restoring a backup archive, LXD fails to validate instance and storage volume names contained within the archive metadata. An attacker can exploi...

MAL-2026-14051 Malicious code in @velliajs/discord (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c86edd3f7edd7d111df5621cb884fd0ef3d870c6c0719d587b7bb0f16f65b8d The package presents itself as a discord.js clone repository field points at the real github.com/discordjs/discord.js.git, README instructs import...

CVE-2026-72552

A flaw was found in Dub. This server-side request forgery SSRF vulnerability allows an unauthenticated remote attacker to force the server to make HTTP requests to arbitrary internal or external hosts. This can be exploited via the metatags edge endpoint, which processes caller-supplied URLs...

CVE-2026-46380

compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the HTTPSFetcher.dofetch method passes a user-supplied URL directly to requests.get without validation. This allows an attacker to perform Server-Side Request Forgery, targeting internal...

CVE-2026-46380 compliance-trestle Vulnerable to SSRF in Remote Fetching Subsystem

compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the HTTPSFetcher.dofetch method passes a user-supplied URL directly to requests.get without validation. This allows an attacker to perform Server-Side Request Forgery, targeting internal...

CVE-2026-46380

CVE-2026-46380 : In compliance-trestle, the HTTPSFetcher._do_fetch() method passes a user-supplied URL directly to requests.get() without validation, enabling Server-Side Request Forgery (SSRF) to internal services or cloud metadata endpoints. Affected versions: before 3.12.2 and 4.0.3. Mitigatio...

CVE-2026-46380 compliance-trestle Vulnerable to SSRF in Remote Fetching Subsystem

compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the HTTPSFetcher.dofetch method passes a user-supplied URL directly to requests.get without validation. This allows an attacker to perform Server-Side Request Forgery, targeting internal...

CVE-2026-46380 compliance-trestle Vulnerable to SSRF in Remote Fetching Subsystem

compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the HTTPSFetcher.dofetch method passes a user-supplied URL directly to requests.get without validation. This allows an attacker to perform Server-Side Request Forgery, targeting internal...

CVE-2026-46380

compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the HTTPSFetcher.dofetch method passes a user-supplied URL directly to requests.get without validation. This allows an attacker to perform Server-Side Request Forgery, targeting internal...

EUVD-2026-58712

compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the HTTPSFetcher.dofetch method passes a user-supplied URL directly to requests.get without validation. This allows an attacker to perform Server-Side Request Forgery, targeting internal...

CVE-2026-73651

A flaw was found in TypeORM. TypeORM's migration:generate command, used for generating database migrations, embeds database schema metadata into JavaScript or TypeScript template literals. This process incorrectly escapes backticks but fails to escape interpolation, creating a vulnerability. An...

MAL-2026-14036 Malicious code in notafollower1226 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdc72e98071e37ff58c3bb327f995c9c586b81a22180a8004b6564026cbc629f The package.json postinstall script auto-executes on npm install. It queries the ECS container metadata endpoint ECSCONTAINERMETADATAURIV4/task to...

MAL-2026-14035 Malicious code in notafollower122 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83409fb8c0dc76764a944064219de6a4d59d6b24413db5e36d897681f3183add package.json declares a postinstall lifecycle script that runs automatically on npm install. The script uses childprocess to query the AWS ECS...