Unity Linux 20.1050e Security Update: kernel (UTSA-2026-073356)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-073356 advisory. In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Reject restored DTE with out-of-range numeventidbits Userspace can restore ...

OESA-2026-3695 libsoup3 security update

Libsoup is an HTTP library implementation in C. It was originally part of a SOAP Simple Object Access Protocol implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. Security Fixes: A heap out-of-bounds read flaw was found in libsoup. When parsing...

OESA-2026-3694 libsoup3 security update

Libsoup is an HTTP library implementation in C. It was originally part of a SOAP Simple Object Access Protocol implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. Security Fixes: A heap out-of-bounds read flaw was found in libsoup. When parsing...

OESA-2026-3693 libsoup security update

libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications. Security Fixes: A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTT...

OESA-2026-3691 libsoup security update

libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications. Security Fixes: A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTT...

OESA-2026-3690 libsoup security update

libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications. Security Fixes: A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTT...

WordPress JCH Optimize plugin 4.2.1-5.0.0 - Admin+ Path Traversal vulnerability

Admin+ Path Traversal vulnerability discovered by Krugov Artyom in WordPress Plugin JCH Optimize versions 4.2.1-5.0.0...

CVE-2026-80807 nilfs2: reject invalid block index in GC ioctl

In the Linux kernel, the following vulnerability has been resolved: nilfs2: reject invalid block index in GC ioctl Syzbot reported list corruption caused by a double listaddtail call on bh-bassocbuffers within nilfslookupdirtydatabuffers. Analysis revealed that the root cause was the insertion of...

CVE-2026-80807

CVE-2026-80807 affects the nilfs2 filesystem in the Linux kernel . The root cause is a missing range check on vd_offset and vd_vblocknr fields in the nilfs_vdesc structure during the garbage-collection (GC) ioctl. An attacker or fuzzer can supply artificially crafted parameters that cause a page/...

EUVD-2026-71242

In the Linux kernel, the following vulnerability has been resolved: nilfs2: reject invalid block index in GC ioctl Syzbot reported list corruption caused by a double listaddtail call on bh-bassocbuffers within nilfslookupdirtydatabuffers. Analysis revealed that the root cause was the insertion of...

Malicious Package

Overview btree-range-store is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

kernel: iomap: fix out-of-bounds bitmap_set() with zero-length range

A flaw was found in the Linux kernel's iomap subsystem. An unsigned subtraction underflow occurs when ifssetrangedirty or ifssetrangeuptodate are called with a zero-length range. This can lead to an out-of-bounds write via bitmapset, potentially allowing a local attacker to cause memory corruptio...

kernel: iomap: fix out-of-bounds bitmap_set() with zero-length range

A flaw was found in the Linux kernel's iomap subsystem. An unsigned subtraction underflow occurs when ifssetrangedirty or ifssetrangeuptodate are called with a zero-length range. This can lead to an out-of-bounds write via bitmapset, potentially allowing a local attacker to cause memory corruptio...

The vulnerability of the arena_alloc_pages() function in the kernel/bpf/arena.c module, which is part of the BPF interpreter support for Linux kernel, allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the arenaallocpages function in the kernel/bpf/arena.c module, which is part of the Linux kernel’s BPF interpreter support, relates to the comparison of numerical ranges without any minimum checks during request processing. Exploiting this vulnerability could allow an attacke...

GHSA-XQQH-3W52-Q8P7 vulnerabilities

Vulnerabilities for packages: ruby4.0-rails, ruby3.4-rails, ruby3.2-rails, ruby3.3-rails...

Malicious code in btree-range-store (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e7b5c5ccd56296e8ac25007af040c62f078c5953946fdae9fc1c67b0178f65f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15876 Malicious code in btree-range-store (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e7b5c5ccd56296e8ac25007af040c62f078c5953946fdae9fc1c67b0178f65f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

CVE-2026-63381 affecting package libevent for versions less than 2.1.13-1

CVE-2026-63381 affecting package libevent for versions less than 2.1.13-1. An upgraded version of the package is available that resolves this issue...

DRUPAL-CONTRIB-2026-133

This module enables you to delete Webform submissions in bulk using a specified date range. The module doesn't sufficiently restrict access to the delete form. A separate PHP fatal error issue may prevent exploitation in practice on Drupal 10+...

6thbridge-hexa-docs (0.0.1), @12-labours/mapintegratedvuer (>=1.0.0-beta.0, <=1.0.0-beta.14) +1082 more potentially affected by CVE-2026-83610 via @xmldom/xmldom (>=0.9.0, <=0.9.11)

@xmldom/xmldom NPM version =0.9.0, =1.0.0-beta.0, =0.0.1, =0.0.1, =0.0.1, =2.4.4, =0.1.30-develop-map-0, =0.1.0, =0.3.2-beta.0, =2.0.2, =0.8.1, =0.1.0, =0.8.0, =0.1.0, =0.2.2 and more Source cves: CVE-2026-83610 Source advisory: OSV:GHSA-6GMQ-8VP8-GCM6...