ALSA-2026:61766 Moderate: glib2 security update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fixes: glib: buffer over-read in...

Linux Distros Unpatched Vulnerability : CVE-2026-80603

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: nfconntrackirc: fix parsedcc off-by-one OOB read parsedcc treats dataend as an inclusive end pointer, but its only caller passes datalimit = ibptr +...

Fedora 44 : rpki-client (2026-fb17adc9de)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-fb17adc9de advisory. rpki-client 9.9 - Introduce a backoff retry mechanism for non-functional CAs, eventually settling on retrying broken CAs only once per day. Backoff helps...

SUSE CVE-2026-76172

fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes the scheme back out verbatim, unlike the host component which is re-escaped. As a result an input whose scheme carries...

MAL-2026-15528 Malicious code in axis-datagrid (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b8e97884917400dda89c79754629edd51961e893d64fa580de04bb82bd0cab3 package.json declares a dependency whose key equals the package's own name axis-datagrid and whose source is the bare HTTPS URL...

MAL-2026-15538 Malicious code in librastandardlib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 519c28eb8d9df0a16d93e1b1c486f1ad4a9092a9bf958aed56f273cfe1fcfc14 package.json at line 11 declares a dependency whose key equals the package's own name librastandardlib and whose value is an off-registry HTTPS URL...

Malicious code in librastandardlib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 519c28eb8d9df0a16d93e1b1c486f1ad4a9092a9bf958aed56f273cfe1fcfc14 package.json at line 11 declares a dependency whose key equals the package's own name librastandardlib and whose value is an off-registry HTTPS URL...

Malicious code in vui-gateway (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0411fd70c7f76d71355fcd1ab650dac43afefc55b802d86ad4755b06456bb1ad package.json declares a dependency whose key equals this package's own name vui-gateway and whose source is an off-registry HTTPS URL,...

MAL-2026-15546 Malicious code in vui-gateway (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0411fd70c7f76d71355fcd1ab650dac43afefc55b802d86ad4755b06456bb1ad package.json declares a dependency whose key equals this package's own name vui-gateway and whose source is an off-registry HTTPS URL,...

MAL-2026-15533 Malicious code in data-value (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa1f0fee2d6635331e603f520ba2954b11ac9e85bbd5b66f27c18be5940c3041 package.json declares the package's own name 'data-value' as a dependency whose source is an arbitrary HTTPS URL...

Malicious code in ring-device-settings-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3ea2aed3d7e8c0b9c99532d6714c486a5ad685418ebbd96c67b44b63f79fe01 package.json declares a dependency whose key equals the package's own name ring-device-settings-library and whose value is a raw HTTPS URL pointing a...

Malicious code in alimama-minisite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3efd48d631afe828271bb266e4ddb8f2f6d0a8305294f56bde57d614c1cbfef package.json declares a self-named dependency alimama-minisite whose value is the off-registry URL https://repo.securityctrl.com/alimama-minisite...

MAL-2026-15495 Malicious code in alimama-minisite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3efd48d631afe828271bb266e4ddb8f2f6d0a8305294f56bde57d614c1cbfef package.json declares a self-named dependency alimama-minisite whose value is the off-registry URL https://repo.securityctrl.com/alimama-minisite...

Malicious code in npm-extension (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a6c4f2b94932e8bcb68c0a146d536b7e3a00d48041aa5a6fc9edf9f82ae5244 package.json declares a dependency whose value is a bare HTTPS URL https://repo.securityctrl.com/npm-extension rather than a registry version range. ...

SUSE CVE-2026-74361

In the Linux kernel, the following vulnerability has been resolved: nvme: fix FDP fdpcidx bounds check The fdpcidx bounds check sets n = NUMFDPC + 1 but used instead of =, incorrectly accepting fdpidx when it equals n i.e. NUMFDPC + 1...

SUSE CVE-2026-80603

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrackirc: fix parsedcc off-by-one OOB read parsedcc treats dataend as an inclusive end pointer, but its only caller passes datalimit = ibptr + datalen, which points one past the last valid byte. The newline searc...

SUSE CVE-2026-80712

In the Linux kernel, the following vulnerability has been resolved: spi: spi-qpic-snand: write the feature value before executing SETFEATURE qcomspisendcmdaddr programs NANDFLASHCMD/NANDEXECCMD and submits the descriptors, which makes the controller execute the command immediately. For...

Chromium: CVE-2026-79148 Off-by-one error in DevTools

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

CVE-2026-80712

In the Linux kernel, the following vulnerability has been resolved: spi: spi-qpic-snand: write the feature value before executing SETFEATURE qcomspisendcmdaddr programs NANDFLASHCMD/NANDEXECCMD and submits the descriptors, which makes the controller execute the command immediately. For...

CVE-2026-80603

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrackirc: fix parsedcc off-by-one OOB read parsedcc treats dataend as an inclusive end pointer, but its only caller passes datalimit = ibptr + datalen, which points one past the last valid byte. The newline searc...