CVE-2026-46412 Malicious code in @beproduct/nestjs-auth (0.1.2 through 0.1.19) — Mini Shai-Hulud worm

@beproduct/nestjs-auth is a NestJS authentication module for BeProduct IDS Identity Server with OpenID Connect support. Between 2026-05-11 20:19 UTC and 22:56 UTC, an attacker used a compromised npm publish token to publish 18 malicious versions of @beproduct/nestjs-auth 0.1.2 through 0.1.19. The...

EUVD-2026-45992

@beproduct/nestjs-auth is a NestJS authentication module for BeProduct IDS Identity Server with OpenID Connect support. Between 2026-05-11 20:19 UTC and 22:56 UTC, an attacker used a compromised npm publish token to publish 18 malicious versions of @beproduct/nestjs-auth 0.1.2 through 0.1.19. The...

Linux Distros Unpatched Vulnerability : CVE-2026-64051

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Add overflow check to remappfnrange during mmap The call to remappfnrange in...

Linux Distros Unpatched Vulnerability : CVE-2026-63817

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: f2fs: validate compress cache inode only when enabled F2FSCOMPRESSINO uses NMIsbi-maxnid as...

CVE-2026-51385

An issue in safishamsi Open-Source GRAPHIFY v.0.3.2 through v0.4.29 allows a remote attacker to execute arbitrary code via the validateurl, safefetch, buildopener, fetchhtml and downloadbinary functions...

PT-2026-61635

Name of the Vulnerable Software and Affected Versions libvips versions prior to 8.18.2 Description The EXIF decoder fails to verify the range of EXIF tag groups before passing data to libexif. This lack of validation can lead to a null pointer dereference, which is a condition where the software...

PT-2026-61698

you don't need to overthink this 💡 an 11-byte TLS request can freeze server memory. that's the OpenSSL HollowByte vulnerability. here's what happened: a high-severity flaw CVE-2025-35588 discovered in OpenSSL versions 3.4.0, 3.3.0 to 3.3.3, 3.2.0… https://t.co/yXNb1p6oxS...

Linux Distros Unpatched Vulnerability : CVE-2026-35590

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libvips is a fast image processing library with low memory needs. The EXIF decoder within libvips versions before and including 8.18.1 was not verifying the ran...

Important: kernel6.12

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: mm/pagealloc: clear page-private in freepagesprepare CVE-2026-43303 In the Linux kernel, the following vulnerability has been resolved: ipvs: skip ipv6 extension headers for csum checks CVE-2026-45850 In the Linux...

Fedora 44 : wireshark (2026-bc152c9ff6)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-bc152c9ff6 advisory. Latest wireshark version includes fixes for the following CVEs: CVE-2026-15163 CVE-2026-15164 CVE-2026-15165 CVE-2026-15166 CVE-2026-15167...

SUSE CVE-2026-63817

In the Linux kernel, the following vulnerability has been resolved: f2fs: validate compress cache inode only when enabled F2FSCOMPRESSINO uses NMIsbi-maxnid as the synthetic inode number for the compressed page cache inode. That inode only exists when the compresscache mount option is enabled. Wh...

CVE-2026-64106

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Reject restored DTE with out-of-range numeventidbits Userspace can restore an ITS Device Table Entry whose Size field encodes more EventID bits than the virtual ITS supports. The live MAPD path rejects that...

CVE-2026-64051

In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Add overflow check to remappfnrange during mmap The call to remappfnrange in qaicgemobjectmmap is susceptible to remapping beyond the VMA if the BO is too large. This can cause use after free issues when munmap unmaps...

CVE-2026-63882

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix NULL pointer bug in svmrangesetattr The processinfo could be NULL if user doesn't call kfdioctlacquirevm before calling kfdioctlsvm. cherry picked from commit 83a26c812e0529eb040d31a76f73e33e637243d4...

CVE-2026-63879

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix amdgpuhmmrangegetpages The notifier sequence must only be read once or otherwise we could work with invalid pages. While at it also fix the coding style, e.g. drop the pre-initialized return value and use the comm...

EUVD-2026-45791

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Reject restored DTE with out-of-range numeventidbits Userspace can restore an ITS Device Table Entry whose Size field encodes more EventID bits than the virtual ITS supports. The live MAPD path rejects that...

CVE-2026-64106 KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Reject restored DTE with out-of-range numeventidbits Userspace can restore an ITS Device Table Entry whose Size field encodes more EventID bits than the virtual ITS supports. The live MAPD path rejects that...

CVE-2026-64106

Linux kernel KVM arm64 vgic-its vulnerability: a userspace process can restore an ITS Device Table Entry with a Size encoding more EventID bits than the virtual ITS supports. Although MAPD rejects the state, vgic_its_restore_dte() stores the out-of-range value in dev->num_eventid_bits, allowin...

CVE-2026-64063

CVE-2026-64063 affects the Linux kernel's netfslib (network file systems library) subsystem. The bug is in netfs_perform_write(): when a partially written streaming-write folio is overwritten by a subsequent write(), the function fails to discard the attached netfs_folio struct and mishandles par...

CVE-2026-64051

The issue is in the Linux kernel’s accel/qaic driver. A bounds check was missing in remap_pfn_range called by qaic_gem_object_mmap, allowing (re)mapping beyond the VMA when the BO is large. This can yield use-after-free if munmap() only unmaps the VMA while extra mappings remain, enabling potenti...