Companion Sitemap Generator < 4.5.3 - Cross-Site Scripting

The plugin does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin. id: CVE-2023-1780 info: name: Companion Sitemap Generator 4.5.3 - Cross-Site Scripting author:...

CVE-2026-64498

A flaw was found in the Linux kernel's Industrial I/O IIO subsystem, specifically within the hardware consumer buffer hw-consumer. Due to an oversight in memory management, a dedicated memory region scanmask was not properly released when its associated buffer was freed. A local attacker with low...

MAL-2026-11126 Malicious code in app-sim-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8470a75b327a72623ec4379302a2fc6ecdbaa302acf4fa1e39f1c688103562be package.json declares a postinstall hook that runs node test.js on npm install; test.js invokes fromstr2 and fromstr1 in index.js. fromstr2 fetches...

MAL-2026-11125 Malicious code in api-rust-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 268179cffa6aef31ad248757e61fc892cb826bde059502b3e2c3a74277951e05 On npm install, the package's postinstall hook node test.js executes two payloads against the installer host. First, it fetches an attacker-controlle...

Xerox AltaLink Abuse Scan Feature to Delete Files (CVE-2021-28670)

Xerox AltaLink B8045/B8090 before 103.008.030.32000, C8030/C8035 before 103.001.030.32000, C8045/C8055 before 103.002.030.32000 and C8070 before 103.003.030.32000 allow unauthorized users, by leveraging the Scan To Mailbox feature, to delete arbitrary files from the disk. This plugin only works...

UBUNTU-CVE-2026-64318

In the Linux kernel, the following vulnerability has been resolved: partitions: aix: bound the ppcount scan to the ppe array aixpartition reads the physical volume descriptor into a fixed-size struct pvd and then scans its physical-partition-extent array: int numpps = be16tocpupvd-ppcount; ... fo...

UBUNTU-CVE-2026-64417

In the Linux kernel, the following vulnerability has been resolved: mm: shrinker: fix NULL pointer dereference in debugfs shrinkerdebugfsadd creates both "count" and "scan" debugfs files unconditionally. That assumes every shrinker implements both countobjects and scanobjects, which is not...

UBUNTU-CVE-2026-64498

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: hw-consumer: free scanmask on buffer release The scanmask lifetime changed in commit 9a2e1233d38c "iio: buffer: hw-consumer: remove redundant scanmask flexible array". Before that change, the scan mask storage was...

CVE-2026-64498 iio: buffer: hw-consumer: free scan_mask on buffer release

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: hw-consumer: free scanmask on buffer release The scanmask lifetime changed in commit 9a2e1233d38c "iio: buffer: hw-consumer: remove redundant scanmask flexible array". Before that change, the scan mask storage was...

EUVD-2026-48842

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: hw-consumer: free scanmask on buffer release The scanmask lifetime changed in commit 9a2e1233d38c "iio: buffer: hw-consumer: remove redundant scanmask flexible array". Before that change, the scan mask storage was...

CVE-2026-64498

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: hw-consumer: free scanmask on buffer release The scanmask lifetime changed in commit 9a2e1233d38c "iio: buffer: hw-consumer: remove redundant scanmask flexible array". Before that change, the scan mask storage was...

CVE-2026-64498

The CVE-2026-64498 issue affects the Linux kernel IIO subsystem (iio: buffer: hw-consumer). The root cause was a lifetime change for scan_mask: it moved to a separate bitmap allocation (buffer.scan_mask) but iio_hw_buf_release() remained unchanged, risking improper cleanup. The fix ensures the sc...

EUVD-2026-48961

In the Linux kernel, the following vulnerability has been resolved: mm: shrinker: fix NULL pointer dereference in debugfs shrinkerdebugfsadd creates both "count" and "scan" debugfs files unconditionally. That assumes every shrinker implements both countobjects and scanobjects, which is not...

CVE-2026-64417

CVE-2026-64417 relates to the Linux kernel mm shrinker and a NULL pointer dereference in debugfs. The issue arose because shrinker_debugfs_add() created both the optional debugfs files “count” and “scan” unconditionally, assuming every shrinker implements both count_objects() and scan_objects(). ...

CVE-2026-64417 mm: shrinker: fix NULL pointer dereference in debugfs

In the Linux kernel, the following vulnerability has been resolved: mm: shrinker: fix NULL pointer dereference in debugfs shrinkerdebugfsadd creates both "count" and "scan" debugfs files unconditionally. That assumes every shrinker implements both countobjects and scanobjects, which is not...

Linux Distros Unpatched Vulnerability : CVE-2026-64498

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iio: buffer: hw-consumer: free scanmask on buffer release The scanmask lifetime changed in commit 9a2e1233d38c iio: buffer: hw-consumer: remove redundant scanma...

CVE-2026-14172

Rapid7 InsightVM, Nexpose, and the Insight Agent execute discovered executables during authenticated assessment without validating file ownership, allowing a local low-privileged user to run code as the scan credential Scan Engine or as root/SYSTEM Insight Agent. Fixed in Scan Engine content...

EUVD-2026-48487

Rapid7 InsightVM, Nexpose, and the Insight Agent execute discovered executables during authenticated assessment without validating file ownership, allowing a local low-privileged user to run code as the scan credential Scan Engine or as root/SYSTEM Insight Agent. Fixed in Scan Engine content...

CVE-2026-14172

CVE-2026-14172 affects Rapid7 InsightVM, Nexpose, and the Insight Agent. The issue allows a local, low-privilege user to execute discovered executables during authenticated assessments due to lack of file ownership validation, enabling code execution as the scan credential (Scan Engine) or as roo...

SUSE CVE-2026-63863

In the Linux kernel, the following vulnerability has been resolved: drm/gpusvm: Fix unbalanced unlock in drmgpusvmscanmm There is a unbalanced lock/unlock to gpusvm notifier lock: 931.045868 ===================================== 931.046509 WARNING: bad unlock balance detected! 931.047149...