Linux Distros Unpatched Vulnerability : CVE-2026-63966

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: iio: imu: adis16550: fix stack leak in trigger handler adis16550triggerhandler declares the...

MAL-2026-10950 Malicious code in @iphouse/core (npm)

The @iphouse/core package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms so...

Amazon Linux 2023 : compat-golang-github-cpuguy83-md2man-2-devel, golang-github-cpuguy83-md2man, golang-github-cpuguy83-md2man-devel (ALAS2023-2026-1989)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1989 advisory. On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /...

Linux Distros Unpatched Vulnerability : CVE-2026-53367

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: selinux: fix avdcache auditing The per-task avdcache was incorrectly saving and reusing the...

Linux Distros Unpatched Vulnerability : CVE-2026-42566

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Meshtastic is an open source mesh networking solution. Prior to version 2.7.23.b246bcd, a single node advertising a User.longname that contains a malformed...

MAL-2026-10934 Malicious code in twilio-internal (npm)

The twilio-internal package is one of four byte-identical dependency-confusion squats of Twilio's npm namespace published by user 'yuva2210' maintainer email [email protected], all at the sentinel version 99.99.99 chosen to outrank any internal/private version and win resolution against ...

Linux Distros Unpatched Vulnerability : CVE-2026-64192

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Reject BPFMAPTYPEINODESTORAGE creation if BPF LSM is uninitialized When CONFIGBPFLSM=y is set, BPF inode storage maps BPFMAPTYPEINODESTORAGE are compiled...

Linux Distros Unpatched Vulnerability : CVE-2026-64154

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/msm/adreno: Fix a reference leak in a6xxgpuinit In a6xxgpuinit, node is obtained via ofparsephandle. While there was a manual ofnodeput at the end of the...

Linux Distros Unpatched Vulnerability : CVE-2026-64166

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - firmware: armffa: Check for NULL FF-A ID table while driver registration The bus match callback assumes that every FF-A driver provides an idtable and...

TencentOS Server 3: git-lfs (TSSA-2026:0637)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0637 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

Linux Distros Unpatched Vulnerability : CVE-2026-64093

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - batman-adv: tpmeter: directly shut down timer on cleanup batadvtpsendercleanup was calling timerdeletesync followed by timerdelete to guard against the timer...

Malicious code in zer0onetencent (npm)

The zer0onetencent package was published to the npm registry by user 't2423048543' maintainer email [email protected]. It is described as 'A simple date formatting utility' but ships no such functionality; index.js only exports a hello stub returning the package name, indicating a package...

Malicious code in org-twilio-phone-numbers-utils (npm)

The org-twilio-phone-numbers-utils package is a dependency-confusion squat of Twilio's npm namespace published by user 'yuva2210' maintainer email [email protected] at sentinel versions 99.99.99 and 99.99.100, chosen to outrank any internal/private version and win resolution against a...

Malicious code in markscan (npm)

The markscan package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms so that...

Malicious code in twilio-serverless (npm)

The twilio-serverless package is one of four byte-identical dependency-confusion squats of Twilio's npm namespace published by user 'yuva2210' maintainer email [email protected], all at the sentinel version 99.99.99 chosen to outrank any internal/private version and win resolution agains...

Malicious code in aftermathfi (npm)

The aftermathfi package was published to the npm registry by user 'jet0010001' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign impersonating the Aftermath Finance SDK Aftermath Finance is a DeFi protocol on the Sui blockchain. The package was...

Linux Distros Unpatched Vulnerability : CVE-2026-63963

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers Properly validate the count passed from a device when calling svdmconsumeidentity or...

Fedora 44 : wget1 (2026-1b91a2f126)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-1b91a2f126 advisory. Fix for CVE-2026-15146, CVE-2026-58470, CVE-2026-58471, CVE-2026-58472 Tenable has extracted the preceding description block directly from the Fedor...

Linux Distros Unpatched Vulnerability : CVE-2026-63932

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: iio: chemical: mhz19b: reject oversized serial replies mhz19breceivebuf appends each serdev...

Malicious code in aftermath-sui (npm)

The aftermath-sui package was published to the npm registry by user 'jet0010001' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign impersonating the Aftermath Finance SDK Aftermath Finance is a DeFi protocol on the Sui blockchain. The package was...