CVE-2026-74298: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix FRMR set pinned push error path Add destruction of FRMR handles in case the push to the pool fails. This prevents resources leak in case pool page allocation fails...

CVE-2026-72064: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: mana: Sync page pool RX frags for CPU MANA allocates RX buffers from page pool fragments when fragcount is greater than 1. In that case the buffers remain DMA mapped by page pool and the RX completion path does not call...

CVE-2026-72059: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: destroy DMA pool on CLDMA late init failure t7xxcldmalateinit creates mdctrl-gpddmapool before initializing the TX and RX rings. If any ring initialization fails, the error path frees the already initialized ring...

Linux Distros Unpatched Vulnerability : CVE-2026-74269

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bnxt: fix head underflow on XDP head-grow The xdp.py test testxdpnativeadjstheadgrowdata crashes when run on a bnxt machine and also crashes in NIPA. It seems...

curl: Windows SSPI connection-pool probe can reuse a connection under the wrong user

Summary : A fresh transfer can reuse a keep-alive connection authenticated under another Windows user because the SSPI isolation check trusts a connection ID that a health probe can set. Root cause : Curlcpoolconnseemshealthy calls Curlattachconnection, which sets data-state.recentconnid, while...

CVE-2026-72685

A flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to submit a single small document containing a crafted user-supplied input. Processing one such document occupies a worker thread from a bounded pool for a disproportionate amount of time, degrading the...

Malicious code in resource-lease-pool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 731d4ed32c1947117f9e7243c0179f5076213414505bf38176e660653df025f1 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in semaphore-job-pool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 894dd3724c09345add605b1ec247a8b2780a964fe89316f23fc0e57266ac35d7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14010 Malicious code in semaphore-job-pool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 894dd3724c09345add605b1ec247a8b2780a964fe89316f23fc0e57266ac35d7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14008 Malicious code in resource-lease-pool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 731d4ed32c1947117f9e7243c0179f5076213414505bf38176e660653df025f1 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious Package

Overview semaphore-job-pool is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview resource-lease-pool is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

c3p0: c3p0: Remote code execution via deserialization vulnerability

A flaw was found in c3p0, a JDBC Connection pooling library. This vulnerability allows a remote attacker to potentially execute arbitrary code by crafting a malicious data source object. When an application deserializes this object and automatically resolves its properties, it can trigger...

PT-2026-71794

Name of the Vulnerable Software and Affected Versions Elasticsearch affected versions not specified Description A flaw allows a low-privileged authenticated user with indexing permissions to submit a small document containing crafted input. Processing this document occupies a worker thread from a...

Linux Distros Unpatched Vulnerability : CVE-2026-63299

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code paths fail to verify...

CVE-2026-71194

In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NOTIFY requests. When two zones with the same name exist across different pools, the lookup fails with a deterministic error, causing the handler to return REFUSED for all DNS...

UBUNTU-CVE-2026-71194

In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NOTIFY requests. When two zones with the same name exist across different pools, the lookup fails with a deterministic error, causing the handler to return REFUSED for all DNS...

UBUNTU-CVE-2026-71193

In OpenStack Designate before 22.0.1, zone creation checks issubzone, issuperzone, and the duplicate-zone DB constraint are scoped to the target pool only. An authenticated user can bypass these checks by scheduling a zone to a different pool via the AttributeFilter scheduler, creating an...

CVE-2026-71194

In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NOTIFY requests. When two zones with the same name exist across different pools, the lookup fails with a deterministic error, causing the handler to return REFUSED for all DNS...

CVE-2026-71194

In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NOTIFY requests. When two zones with the same name exist across different pools, the lookup fails with a deterministic error, causing the handler to return REFUSED for all DNS...