CVE-2026-89832 f2fs: fix to clear dirty flag on folio in error path

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to clear dirty flag on folio in error path If node block is corrupted due to chksum mismatch or inconsistent footer info, it needs to drop clear flag of node folio, in order to persist inconsistent node data to storage...

CVE-2026-89832

CVE-2026-89832 affects the f2fs filesystem in the Linux kernel . The root cause is that when a node block is corrupted due to a checksum mismatch or inconsistent footer info, the dirty flag on the node folio was not properly cleared in the error path, causing inconsistent node data to be persiste...

CVE-2026-89802

CVE-2026-89802 is a NULL pointer dereference in the drm/nouveau/uvmm driver of the Linux kernel . When a NOUVEAU_VM_BIND job contains an OP_MAP_SPARSE operation that is processed successfully, op->ops remains NULL because the sparse-map path only creates a region without allocating ops. If a s...

CVE-2026-89802 drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: fix NULL deref unwinding an OPMAPSPARSE op Each bindjobop is zeroed by kzallocobj in bindjobopfromuop, and the OPMAPSPARSE case in nouveauuvmmbindjobsubmit only creates a region, so op-ops stays NULL for a...

Malicious code in chai-as-agile (npm)

Source: amazon-inspector 90d46bc75e0c086e929855baefd9f9f847ebe6e85f8a004c9de72502d0fb6263 On require'chai-as-agile', index.js loads lib/initializeCaller.js which decodes a base64-obfuscated URL to https://ipcheck-hashed.vercel.app/api/auth/6c1d60d35852ef0c05df and POSTs the full contents of...

Malicious code in engin1 (npm)

Source: amazon-inspector 1e843727c643c5d966acaa66461f7e392813a4284cd8181b4bb9b24ddfb8447a The package's main entrypoint index.js invokes an initializer at top level that spawns loader.js as a detached background Node process on every require/import. loader.js issues an HTTPS GET to...

SUSE CVE-2026-89495

In the Linux kernel, the following vulnerability has been resolved: ocfs2: bound namelen in dlmmigraterequesthandler Patch series "ocfs2/dlm: bound peer-controlled lengths in the o2dlm". The o2dlm receive handlers trust u8 length and count fields from the wire without bounding them, so a node in ...

PT-2026-93759

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 1.14.6 Backstage versions 1.15.0 through 1.15.4 Description The @backstage/plugin-techdocs-node package insufficiently validates the mkdocs.yml file provided by an authenticated user with permissions to register or...

CVE-2026-69200: Improperly Controlled Modification of Object Prototype Attributes

node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to node-opcua-client 2.145.0, the internal fieldsToJson method in packages/node-opcua-client/source/alarmsandconditions/clientalarm.ts directly assigns unsanitized field names and allows a proto.pollutedKey path to modify...

CVE-2026-88064: Improper Input Validation

Backstage is an open framework for building developer portals. Prior to 1.14.6 and from 1.15.0 until 1.15.4, the @backstage/plugin-techdocs-node package insufficiently validates mkdocs.yml supplied by an authenticated user who can register or modify a TechDocs source. Unsafe Python YAML tags,...

Linux Distros Unpatched Vulnerability : CVE-2026-89832

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - f2fs: fix to clear dirty flag on folio in error path If node block is corrupted due to chksum mismatch or inconsistent footer info, it needs to drop clear flag ...

CVE-2026-68904: Uncontrolled Resource Consumption

node-opcua is an OPC UA implementation for TypeScript and Node.js. From 2.0.0 until 2.170.0, node-opcua clients using the default keepSessionAlive setting can enter a repeated reconnection cycle when an OPC UA server's clock skew causes BadInvalidTimestamp responses...

CVE-2026-89802: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: fix NULL deref unwinding an OPMAPSPARSE op Each bindjobop is zeroed by kzallocobj in bindjobopfromuop, and the OPMAPSPARSE case in nouveauuvmmbindjobsubmit only creates a region, so op-ops stays NULL for a...

Linux Distros Unpatched Vulnerability : CVE-2026-89982

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - i2c: mux: Fix channel node leak on adapter add failure i2cmuxaddadapter takes a reference to the Device Tree channel node before registering the new adapter. If...

Linux Distros Unpatched Vulnerability : CVE-2026-89802

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/nouveau/uvmm: fix NULL deref unwinding an OPMAPSPARSE op Each bindjobop is zeroed by kzallocobj in bindjobopfromuop, and the OPMAPSPARSE case in...

CVE-2026-92587: Untrusted Search Path

n8n is a workflow automation platform. In versions before 1.123.76, 2.37.7, and 2.38.2, the Git node validated a relative remote URL against the configured repositoryPath but then invoked git with that path as its working directory; git walked up to the enclosing repository's top level and resolv...

PT-2026-93470

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the f2fs component where the f2fs sanity check node footer function does not receive the folio-index value. This leads to the incorrect checking of the same nid node...

PT-2026-93754

Name of the Vulnerable Software and Affected Versions BIND 9 versions 9.11.0 through 9.18.50 BIND 9 versions 9.20.0 through 9.20.27 BIND 9 versions 9.21.0 through 9.21.25 BIND 9 versions 9.11.3-S1 through 9.18.50-S1 BIND 9 versions 9.20.9-S1 through 9.20.27-S1 Description A malformed zone...

Linux Distros Unpatched Vulnerability : CVE-2026-91091

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was identified in GPAC up to f1219cde. The impacted element is the function gfnodelistinsertchild of the file scenegraph/basescenegraph.c of the...

PT-2026-93839

Name of the Vulnerable Software and Affected Versions node-opcua versions 2.0.0 through 2.169.0 Description A combination of bugs in the client implementation leads to unlimited TCP socket accumulation in the FIN-WAIT-2 state during automatic reconnection, resulting in memory exhaustion and proce...