CVE-2026-64595

In the Linux kernel, the following vulnerability has been resolved: HID: hid-lenovo-go: cancel cfgsetup work in hidgocfgremove hidgocfgprobe initialises drvdata.gocfgsetup and schedules it to run 2 ms later: INITDELAYEDWORK&drvdata.gocfgsetup, &cfgsetup; scheduledelayedwork&drvdata.gocfgsetup,...

CVE-2026-64595 HID: hid-lenovo-go: cancel cfg_setup work in hid_go_cfg_remove()

In the Linux kernel, the following vulnerability has been resolved: HID: hid-lenovo-go: cancel cfgsetup work in hidgocfgremove hidgocfgprobe initialises drvdata.gocfgsetup and schedules it to run 2 ms later: INITDELAYEDWORK&drvdata.gocfgsetup, &cfgsetup; scheduledelayedwork&drvdata.gocfgsetup,...

EUVD-2026-53738

The Google Authenticator WordPress plugin before 0.56 does not verify a CSRF nonce when saving its two-factor setup, allowing attackers to trick a logged-in user into overwriting their own 2FA secret with an attacker-controlled value, which enables two-factor authentication and locks the victim o...

CVE-2026-64595

In the Linux kernel, the following vulnerability has been resolved: HID: hid-lenovo-go: cancel cfgsetup work in hidgocfgremove hidgocfgprobe initialises drvdata.gocfgsetup and schedules it to run 2 ms later: INITDELAYEDWORK&drvdata.gocfgsetup, &cfgsetup; scheduledelayedwork&drvdata.gocfgsetup,...

CVE-2026-66297

Improper Neutralization of Special Elements used in an OS Command OS Command Injection vulnerability in livebook-dev livebook allows command injection into generated deployment setup commands. LivebookWeb.Hub.Teams.DeploymentGroupAgentComponent.dockerinstructions/2 and...

CVE-2026-66297

Improper Neutralization of Special Elements used in an OS Command OS Command Injection vulnerability in livebook-dev livebook allows command injection into generated deployment setup commands. LivebookWeb.Hub.Teams.DeploymentGroupAgentComponent.dockerinstructions/2 and...

CVE-2026-66297 Unescaped deployment environment variables in generated setup commands

Improper Neutralization of Special Elements used in an OS Command OS Command Injection vulnerability in livebook-dev livebook allows command injection into generated deployment setup commands. LivebookWeb.Hub.Teams.DeploymentGroupAgentComponent.dockerinstructions/2 and...

CVE-2026-66297 Unescaped deployment environment variables in generated setup commands

Improper Neutralization of Special Elements used in an OS Command OS Command Injection vulnerability in livebook-dev livebook allows command injection into generated deployment setup commands. LivebookWeb.Hub.Teams.DeploymentGroupAgentComponent.dockerinstructions/2 and...

MAL-2026-12313 Malicious code in @ccfly/setup-darwin-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 409d11825a61bed068425296e83dcc0c87427579f7b5d724ec52e5e87465f2b5 The package ships a prebuilt darwin/x64 Mach-O binary containing a Go agent module github.com/ccfly/rescue that, when executed, connects to a hardcod...

EUVD-2026-53349

WLED's GET /json/cfg endpoint registered in wled00/wledserver.cpp calls serveJson with no settings-PIN check, unlike the /edit endpoint which explicitly checks correctPIN, disclosing the device's general configuration network, hardware, LED setup to any unauthenticated client on the network...

CVE-2026-54418 Leantime - Missing Authorization on TwoFA JSON-RPC Methods Allows Cross-Account 2FA Secret Disclosure and Bypass

Leantime through 3.6.2 exposes the JSON-RPC methods leantime.rpc.TwoFA.TwoFA.getSetupData, saveSecret, verifyAndEnable, and disable2FA, which act on a caller-supplied userId parameter with no ownership check, session pinning, or permission-attribute gate unlike other RPC-exposed methods in the sa...

CVE-2026-18810

A security vulnerability has been detected in H3C NX15 V100R017. Impacted is an unknown function of the file /api/wizard/networkSetup. Such manipulation leads to missing authentication. The attack may be performed from remote. The vendor was contacted early about this disclosure...

CVE-2026-18810 H3C NX15 networkSetup missing authentication

A security vulnerability has been detected in H3C NX15 V100R017. Impacted is an unknown function of the file /api/wizard/networkSetup. Such manipulation leads to missing authentication. The attack may be performed from remote. The vendor was contacted early about this disclosure...

EUVD-2026-52891

A security vulnerability has been detected in H3C NX15 V100R017. Impacted is an unknown function of the file /api/wizard/networkSetup. Such manipulation leads to missing authentication. The attack may be performed from remote. The vendor was contacted early about this disclosure...

Malicious code in @qlik/dts-bundler (npm)

npm/@qlik/dts-bundler is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished b...

Malicious code in @umacloud/cli-linux-musl-x64 (npm)

npm/@umacloud/cli-linux-musl-x64 is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11552 Malicious code in @adminide-stack/yantra-mobile (npm)

npm/@adminide-stack/yantra-mobile is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11574 Malicious code in @nebula.js/sn-layout-container (npm)

npm/@nebula.js/sn-layout-container is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in @qlik/carboncopy (npm)

npm/@qlik/carboncopy is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished by...

Malicious code in example-js-project (npm)

npm/example-js-project is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished ...