CVE-2026-41211

Vite+ is a unified toolchain and entry point for web development. Prior to version 0.1.17, downloadPackageManager accepts an untrusted version string and uses it directly in filesystem paths. A caller can supply ../ segments or an absolute path to escape the VPHOME/packagemanager// cache root and...

PT-2026-34658

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the SocketCAN subsystem of the Linux kernel. The raw release function unregisters raw CAN receive filters through can rx unregister, but the deletion of the...

The vulnerability of the fsl_qspi_probe() function in the drivers/spi/spi-fsl-qspi.c file of the Linux kernel’s SPI device driver allows a hacker to cause a service failure.

The vulnerability of the fslqspiprobe function in the drivers/spi/spi-fsl-qspi.c file of the Linux kernel’s SPI device driver is related to the improper disabling or release of resources. Exploiting this vulnerability could allow an attacker to cause a service failure...

Critical Photon OS Security Update - PHSA-2026-5.0-92-0830

Updates of 'linux', 'xz', 'linux-esx' packages of Photon OS have been released...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: jq (UTSA-2026-014264)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-014264 advisory. jq is a command-line JSON processor. In commits after 69785bf77f86e2ea1b4a20ca86775916889e91c9, the strindices builtin in jq's src/builtin.c passes its arguments...

Wazuh 4.14.5

Wazuh is a free and open source security platform that unifies XDR and SIEM capabilities. It protects workloads across on-premises, virtualized, containerized, and cloud-based environments. This is the source code release...

Linux kernel 安全漏洞

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from the reuse of a freed resource after the release of the ro-uniq operation in rawrcv. This could le...

Fedora 45 : rust-openssl / rust-openssl-sys (2026-8f21bdd167)

The remote Fedora 45 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-8f21bdd167 advisory. Update the openssl crate to version 0.10.78 and the openssl-sys crate to version 0.9.114. Release notes: - openssl 0.10.77 / openssl-sys 0.9.113:...

Relative Path Traversal

Overview Affected versions of this package are vulnerable to Relative Path Traversal via the ToolConfigModel tool and config name handling in the Ruby and Python models. An attacker can write or delete arbitrary files within the shared /plugins directory by supplying tool or config names containi...

Embedded Malicious Code

Overview @bitwarden/cli is an A secure and free password manager for all of your devices. Affected versions of this package are vulnerable to Embedded Malicious Code included in a compromised release that is suspected to be part of the Checkmarx April compromise. The payload is delivered via...

CVE-2026-40937

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-alpha.94, all four notification target admin API endpoints in rustfs/src/admin/handlers/event.rs use a checkpermissions helper that validates authentication only access key + session token, without performing any...

kernel: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix use-after-free in iscsitdecsessionusagecount In iscsitdecsessionusagecount, the function calls complete while holding the sess-sessionusagelock. Similar to the connection usage count logic, the waiter...

CVE-2026-34063

Nimiq's network-libp2p is a Nimiq network implementation based on libp2p. Prior to version 1.3.0, network-libp2p discovery uses a libp2p ConnectionHandler state machine. the handler assumes there is at most one inbound and one outbound discovery substream per connection. if a remote peer...

CVE-2026-31518

A flaw was found in the Linux kernel. When the espintcp component processes network traffic using asynchronous cryptography, a memory leak can occur. This happens because a socket buffer skb is not correctly released if the transmit queue becomes full. This continuous leak of memory can lead to...

CVE-2026-34066 nimiq-blockchain: Peer-triggerable panic during history sync

nimiq-blockchain provides persistent block storage for Nimiq's Rust implementation. Prior to version 1.3.0, HistoryStore::puthistorictxns uses an assert! to enforce invariants about HistoricTransaction.blocknumber must be within the macro block being pushed and within the same epoch. During histo...

CVE-2026-31504

A flaw was found in the Linux kernel. A race condition in the packetrelease function, specifically during a network device up NETDEVUP event, can lead to a Use-After-Free UAF vulnerability. This occurs when a socket is re-registered into a fanout group's array, leaving a dangling pointer. A local...

CVE-2026-31454

A flaw was found in the Linux kernel's XFS file system. This vulnerability occurs when the system incorrectly handles memory, specifically when a critical lock, known as the Address Index List AIL lock, is released too early during certain operations. This premature release can cause a piece of...

EUVD-2026-24933

A client can trigger excessive memory allocation by generating a lot of errors responses over a single DoQ and DoH3 connection, as some resources were not properly released until the end of the connection...

EUVD-2026-24881

In the Linux kernel, the following vulnerability has been resolved: net: fix fanout UAF in packetrelease via NETDEVUP race packetrelease has a race window where NETDEVUP can re-register a socket into a fanout group's arr array. The re-registration is not cleaned up by fanoutrelease, leaving a...

EUVD-2026-24817

In the Linux kernel, the following vulnerability has been resolved: virtionet: Fix UAF on dstops when IFFXMITDSTRELEASE is cleared and napitx is false A UAF issue occurs when the virtionet driver is configured with napitx=N and the device's IFFXMITDSTRELEASE flag is cleared e.g., during the...