CVE-2026-72059: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: destroy DMA pool on CLDMA late init failure t7xxcldmalateinit creates mdctrl-gpddmapool before initializing the TX and RX rings. If any ring initialization fails, the error path frees the already initialized ring...

CVE-2026-72064: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: mana: Sync page pool RX frags for CPU MANA allocates RX buffers from page pool fragments when fragcount is greater than 1. In that case the buffers remain DMA mapped by page pool and the RX completion path does not call...

PT-2026-72253

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the MANA driver where RX buffers are allocated from page pool fragments when the frag count is greater than 1. In these instances, buffers remain DMA mapped by the pag...

PT-2026-72248

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the t7xx cldma late init function. The function creates md ctrl-gpd dmapool before initializing the TX and RX rings. If the initialization of any ring fails, the...

PT-2026-72697

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ALSA sequencer where stale FIFO cells can be relinked during a pool resize operation. This occurs because snd seq fifo event in duplicates events before acquiring...

PT-2026-72575

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/panthor component where a potential invalid pointer dereference can occur within the group process tiler oom function. This happens when the heaps variable is ...

PT-2026-72819

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds access issue exists in the nvme setup descriptor pools function. The function indexes the dev-descriptor pools array using a numa node value provided by nvme init hctx...

PT-2026-72735

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix FRMR aging push to queue error flow Aging pools with pinned handles requires moving handles from the active queue to a non-empty inactive queue that might fail on new page allocation, we are currently not handling...

Linux Distros Unpatched Vulnerability : CVE-2026-74269

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bnxt: fix head underflow on XDP head-grow The xdp.py test testxdpnativeadjstheadgrowdata crashes when run on a bnxt machine and also crashes in NIPA. It seems...

PT-2026-72705

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An underflow issue exists in the bnxt rx multi page skb function when handling XDP head-grow. The problem occurs during the construction of the skb head using the expression napi build...

PT-2026-72662

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the dma-axi-dmac component of the dmaengine. On architectures such as Microblaze or arm64 where DMA DIRECT REMAP is enabled, the dma alloc coherent function may remap...

curl: Windows SSPI connection-pool probe can reuse a connection under the wrong user

Summary : A fresh transfer can reuse a keep-alive connection authenticated under another Windows user because the SSPI isolation check trusts a connection ID that a health probe can set. Root cause : Curlcpoolconnseemshealthy calls Curlattachconnection, which sets data-state.recentconnid, while...

CVE-2026-72685

A flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to submit a single small document containing a crafted user-supplied input. Processing one such document occupies a worker thread from a bounded pool for a disproportionate amount of time, degrading the...

Malicious code in resource-lease-pool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 731d4ed32c1947117f9e7243c0179f5076213414505bf38176e660653df025f1 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14010 Malicious code in semaphore-job-pool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 894dd3724c09345add605b1ec247a8b2780a964fe89316f23fc0e57266ac35d7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14008 Malicious code in resource-lease-pool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 731d4ed32c1947117f9e7243c0179f5076213414505bf38176e660653df025f1 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in semaphore-job-pool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 894dd3724c09345add605b1ec247a8b2780a964fe89316f23fc0e57266ac35d7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious Package

Overview resource-lease-pool is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview semaphore-job-pool is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

c3p0: c3p0: Remote code execution via deserialization vulnerability

A flaw was found in c3p0, a JDBC Connection pooling library. This vulnerability allows a remote attacker to potentially execute arbitrary code by crafting a malicious data source object. When an application deserializes this object and automatically resolves its properties, it can trigger...