CVE-2026-64556

A flaw was found in the Linux kernel's performance monitoring unit PMU subsystem. This vulnerability occurs when a performance event group leader is removed during process execution, but its associated events siblings remain active and linked to a stale list. This inconsistent state can lead to a...

CVE-2026-64556

In the Linux kernel, the following vulnerability has been resolved: perf/core: Detach event groups during removeonexec perfeventremoveonexec removes events by calling perfeventexitevent. For top-level events, this removes the event from the context with DETACHEXIT only. This can leave inconsisten...

CVE-2026-64365

A flaw was found in the Linux kernel's letsketch Human Interface Device HID driver. This vulnerability, a Use-After-Free UAF, occurs because a timer is not properly shut down when the device is removed or during an error in its setup. This can cause the system to attempt to access memory that has...

CVE-2026-64421

A flaw was found in the Linux kernel's imx8-isi media driver. This use-after-free vulnerability occurs during the removal of the driver due to an incorrect order of cleanup operations. A local attacker could potentially exploit this to cause a denial of service or achieve arbitrary code execution...

MAL-2026-11176 Malicious code in @bowozzz/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4722e281a0d76eb608340d11a90f25453d5804124aebdd842b462fb03986891f Package is a fork of the Baileys WhatsApp Web library. A single static pattern fired on lib/Utils/generics.js where the tokens 'ping' and 'GET' appea...

Malicious code in @joyfill/components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90bed9c7a2d887bec8559ce5eb8d86d3af53b17bfcc685a0469c2f1727979f78 No a static rule matches and no traced behavioral findings were produced for @joyfill/[email protected]. The package artifact does no...

MAL-2026-11168 Malicious code in postcss-motion-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4534713b2409f1fe5588befb885030edc2eafddf215d1103e70f9024c64cbc35 Package is advertised as a small PostCSS plugin that injects CSS variables and adds -webkit- prefixes, but its main index.js is a 164 KB single-file...

DEBIAN-CVE-2026-16313

A flaw was found in sg3utils. The sginq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev...

CVE-2026-16313

A flaw was found in sg3utils. The sginq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev...

CVE-2026-64481

A flaw was found in the Linux kernel's ALSA sound driver for the cs35l41 component. This vulnerability occurs because the driver fails to properly remove controls and cancel firmware load work during component unbinding or device removal, especially when firmware autostart is disabled. This can...

CVE-2026-41637

A flaw was found in Unbound, a Domain Name System DNS resolver. A remote attacker can exploit this vulnerability by sending and immediately terminating DNS-over-QUIC DoQ queries. This improper handling of terminated queries can lead to a build-up of pending responses, causing a degradation of...

CVE-2026-64326

A flaw was found in the Linux kernel's block device handling. When a block device is unexpectedly removed, the bdevmarkdead function can unconditionally attempt to synchronize the device, even if it is no longer present. This can lead to a system hang, effectively causing a Denial of Service DoS,...

CVE-2026-66299

Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web...

EUVD-2026-49855

Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web...

EUVD-2026-29482

Pocket ID: OIDC refresh token flow bypasses authorization revocation, account disabling, and group restrictions...

CVE-2026-64244

A flaw was found in the Linux kernel's memory management. This vulnerability occurs when a memory block fails to register, but its associated memory map is not properly cleared during device removal. This can lead to a system warning and potential instability or a kernel crash, allowing a local...

CVE-2026-64238

A flaw was found in the Linux kernel's gpio: shared component. A too wide critical section, intended to protect the offset field in the struct gpiosharedentry, can lead to a potential deadlock. This occurs during the removal of a shared General Purpose Input/Output GPIO proxy's parent. A successf...

grafana security, bug fix, and enhancement update

An update is available for grafana. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Grafana is an open source, feature rich metrics dashboard and graph editor fo...

EUVD-2021-34857

An issue was discovered in Quest KACE Systems Deployment Appliance SMA 11.0.273. Certain API endpoints contain a rate-limiting feature to minimize a brute-force attack. This protection can be bypassed by removing the kboxid cookie...

PT-2026-65477

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. With the introduction of Grant Table v2 came the requirement to be able to switch between versions. Switching from v1 to v2 reduces the number of valid grant references, ...