CVE-2026-71967 OP-TEE OS 4.10.0 NULL Pointer Dereference DoS via Widevine PTA open_session

OP-TEE OS through 4.10.0, fixed in commit 0aadfc2, contains a null pointer dereference vulnerability in the Widevine pseudo-TA opensession handler that allows Normal World clients to cause a denial of service when CFGWIDEVINEPTA is enabled. Attackers can open a session directly on the Widevine PT...

CVE-2026-68264

The CVE-2026-68264 entry describes a Linux kernel issue in the drm/xe/pt module where xe_pt_update_ops_init() fails to reset current_op (and related flags) during retry paths in vm_bind, causing repeated increments of current_op. After multiple retries, current_op can exceed the allocated xe_vma_...

Linux Distros Unpatched Vulnerability : CVE-2026-71968

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OP-TEE OS through 4.10.0, fixed in commit 8794043, contains a use-after-free vulnerability in the Trusted Application loader that allows attackers with the...

Linux Distros Unpatched Vulnerability : CVE-2026-71967

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OP-TEE OS through 4.10.0, fixed in commit 0aadfc2, contains a null pointer dereference vulnerability in the Widevine pseudo-TA opensession handler that allows...

Linux Distros Unpatched Vulnerability : CVE-2026-71969

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OP-TEE OS through 4.10.0, fixed in commit 7b8b494, contains a buffer underwrite vulnerability in the RSA NOPAD encrypt and decrypt operations within the mbedTLS...

Oracle Linux 8 : kernel (ELSA-2026-50978)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-50978 advisory. - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache Dennis Chen RHEL-188786 CVE-2025-54518 Tenable has extracted the preceding...

MAL-2026-12875 Malicious code in bnpl-blocks-atom-bnpl-feedback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 058b0a78e0960f56198334ba1623fa948a0b198e4480910e73e44e48ad2704d0 On require'bnpl-blocks-atom-bnpl-feedback', index.js loads bridge.js which selects a platform-specific asset, downloads an unsigned binary via HTTPS...

Malicious code in devplatform-nx-stylelint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16573678cf46c8aabbd843cd3bbbbe258474f3768d15ad6f1178921b6ad964bf The package presents itself as an Nx stylelint helper but its main entry requires platform.js, which on load downloads a platform-specific executable...

SUSE-SU-2026:3423-1 Security update for xen

This update for xen fixes the following issues - CVE-2026-42493: x86 shadow paging is deprecated bsc1271528. - CVE-2026-42494,CVE-2026-42495,CVE-2026-62423,CVE-2026-62424,CVE-2026-62425: buffer overruns in libfsimage iso9660 handling bsc1271530. - CVE-2026-62426,CVE-2026-62427: sysctl and...

SUSE-SU-2026:3409-1 Security update for xen

This update for xen fixes the following issues - CVE-2026-42493: x86 shadow paging is deprecated bsc1271528. - CVE-2026-42494,CVE-2026-42495,CVE-2026-62423,CVE-2026-62424,CVE-2026-62425: buffer overruns in libfsimage iso9660 handling bsc1271530. - CVE-2026-62426,CVE-2026-62427: sysctl and...

Linux Distros Unpatched Vulnerability : CVE-2026-62433

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Parts of the DMOP handling code assumes the caller has provided the required number of buffers for the given operation without any checking being done. As a...

CVE-2026-62433

Parts of the DMOP handling code assumes the caller has provided the required number of buffers for the given operation without any checking being done. As a result, certain operations might access stack rubble as structures are possibly uninitialized...

kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default

Summary ValidationHandler.Load in getkin/kin-openapi silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which always returns nil without performing any credential check. Because this substitution happens unconditionally when the caller omits the field, every OpenAPI security...

PYSEC-2026-3337 TensorFlow vulnerable to `CHECK` failures in `UnbatchGradOp`

Impact The UnbatchGradOp function takes an argument id that is assumed to be a scalar. A nonscalar id can trigger a CHECK failure and crash the program. python import numpy as np import tensorflow as tf id is not scalar tf.rawops.UnbatchGradoriginalinput= tf.constant1,batchindex=tf.constant0,0,0 ...

PYSEC-2026-3132 TensorFlow vulnerable to null-dereference in `mlir::tfg::GraphDefImporter::ConvertNodeDef`

Impact When mlir::tfg::GraphDefImporter::ConvertNodeDef tries to convert NodeDefs without an op name, it crashes. cpp Status GraphDefImporter::ConvertNodeDefOpBuilder &builder, ConversionState &s, const NodeDef &node VLOG4 opdef; else auto it = functionopdefs.findnode.op; if it ==...

PYSEC-2026-3351 TensorFlow vulnerable to `CHECK` failure in `AvgPoolOp`

Impact The AvgPoolOp function takes an argument ksize that must be positive but is not checked. A negative ksize can trigger a CHECK failure and crash the program. python import tensorflow as tf import numpy as np value = np.ones1, 1, 1, 1 ksize = 1, 1e20, 1, 1 strides = 1, 1, 1, 1 padding = 'SAM...

PYSEC-2026-3254 Integer overflow in Tensorflow

Impact The implementation of OpLevelCostEstimator::CalculateOutputSize is vulnerable to an integer overflow if an attacker can create an operation which would involve tensors with large enough number of elements: cc for const auto& dim : outputshape.dim outputsize = dim.size; Here, we can have a...

PYSEC-2026-3229 Uninitialized variable access in Tensorflow

Impact The implementation of AssignOp can result in copying unitialized data to a new tensor. This later results in undefined behavior. The implementation has a check that the left hand side of the assignment is initialized to minimize number of allocations, but does not check that the right hand...

PYSEC-2026-1015 TensorFlow vulnerable to assertion fail on MLIR empty edge names

Impact When mlir::tfg::ConvertGenericFunctionToFunctionDef is given empty function attributes, it crashes. cpp // We pre-allocate the array of operands and populate it using the // outputnametoposition and controloutputtoposition populated // previously. SmallVector retvalsfunc.retsize +...

CVE-2026-44362

OP-TEE (trusted execution environment for Arm TrustZone) has a vulnerability in subkey rollback protection affecting versions 3.20.0 through 4.10.x; during TA loading, shdr_load_pub_key() fails to propagate subkey_version into the runtime structure, so key->version stays zero. When check_updat...