PT-2026-69515

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/amdgpu/gfx10 component where the use of the BUG ON function can cause the kernel to crash unnecessarily in certain cases. The BUG ON function is a kernel...

PT-2026-69650

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/amdgpu/sdma5.2 component where the use of the BUG ON function can cause the kernel to crash unnecessarily in certain cases. The BUG ON function is a kernel...

PT-2026-69513

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/amdgpu/gfx12 component where the use of the BUG ON function can cause the kernel to crash unnecessarily in certain cases. The BUG ON function is a kernel...

PT-2026-69512

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/amdgpu/gfx9.4.3 component where the use of the BUG ON function can cause the kernel to crash unnecessarily in certain cases. The fix involves replacing BUG ON...

PT-2026-69816

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A double free and a WARN ON condition exist in the add mtd device error paths. When device register or mtd nvmem add fails, the error handling triggers mtd release via put device or devi...

EEF-CVE-2026-70395 Predicate injection in manage_relationship belongs_to lookup discloses secret lookup keys in Ash

Summary Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash allows an attacker to forge a relationship to a record they cannot name, and to recover the secret value used to look it up. When managerelationship is used with onlookup: :relate on a belongs...

CVE-2026-70395

Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash allows an attacker to forge a relationship to a record they cannot name, and to recover the secret value used to look it up. When managerelationship is used with onlookup: :relate on a belongsto...

shodan

Shodan API client for Go A small Shodan API client and CLI bu...

PT-2026-69309

Name of the Vulnerable Software and Affected Versions ash-project ash versions 1.52.0-rc.11 through 3.31.0 Description Improper Neutralization of Special Elements in Data Query Logic allows an attacker to forge a relationship to a record they cannot name and recover the secret value used for...

RHEA-2025:4438 Red Hat Enhancement Advisory: Red Hat OpenShift Service on AWS 1.0 enhancements

Bulletin has no description...

Malicious code in sme-rko-finance-front-operations-widget-domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13823f2899a1bfed6b46575763e7ee2629fa4d9388130713a88125b1f38d6dae On require of this package, index.js loads compat.js, which downloads a platform-specific native binary from Cloudflare Workers subdomains under...

MAL-2026-13648 Malicious code in sme-rko-finance-front-operations-special-payments (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a7bfbc55631ce8b054b20444bf1e335244c998fcf00d1709f951b1afa4cb242 On require of the package, index.js loads support.js which downloads a platform-specific binary from string-concatenated cloudflare workers.dev...

OSV-2026-1125 Segv on unknown address in match_many_CHARACTER_REV

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=543352138 Crash type: Segv on unknown address Crash state: matchmanyCHARACTERREV countone basicmatch...

Imperva Customers Protected Against Novel HTTP Desync Attacks

TL;DR: Recent Portswigger research introduced novel HTTP desync techniques discovered through an AI-assisted research system called the HTTP Terminator. The findings expand the range of unusual HTTP behaviors that can cause front-end and back-end systems to interpret the same traffic differently...

CVE-2026-71557

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name for example containing...

CVE-2026-71557 go-git: Malicious reference names may modify files outside the reference storage

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name for example containing...

Malicious code in cdktn-provider-azurerm (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e647bdd78382c54b0565b5bde30513112aaebc17e80019da2ebfe1cfe3f9a14e Package name and branding closely mimic HashiCorp's legitimate cdktf-provider-azurerm CDK for Terraform, with a single-character substitution cdktf →...

Malicious code in dolyame-ui-collapseblock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef9992e81f3de4cb9bd4391466d7850e953c19a0772ebbe5992953044466377c On require, shim.js fetches an OS/architecture-specific native binary from hardcoded Cloudflare Workers hosts oob-worker.cf100-416.workers.dev,...

Malicious code in delivery-ci-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8753c683761d897d4f95cbdc7567d80c8e455b1d4ade844d24f0367633806335 index.js unconditionally loads setup.js on require/import. setup.js assembles three Cloudflare Workers hostnames oob-worker.cf102-baf.workers.dev,...

Malicious code in ded-pwa-bnpl-forms-test-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c88783bd76d9572c7374272991386daf62532972933bd87e24294bdb6c83d29e On require of the package, index.js loads helpers.js which downloads a platform-specific binary from attacker-controlled Cloudflare Workers endpoints...