PT-2026-90179

In the Linux kernel, the following vulnerability has been resolved: power: supply: ucs1002: fix use-after-free on remove ucs1002 has no remove callback, so unbind runs entirely through devm. The alert IRQ handler queues the health poll delayed work, and the work reschedules itself while the chip...

PT-2026-90188

In the Linux kernel, the following vulnerability has been resolved: power: supply: charger-manager: register regulators before exposing sysfs charger manager remove and the err reg extcon probe error path free each charger regulator with regulator put before tearing down the power supply sysfs...

PT-2026-90190

In the Linux kernel, the following vulnerability has been resolved: power: supply: bq256xx: drain usb work before freeing the charger The USB-PHY notifier queues usb work, whose handler calls power supply changedbq-charger. The reset devm action only unregisters the notifier and was registered...

PT-2026-90185

In the Linux kernel, the following vulnerability has been resolved: power: supply: lp8727: fix use-after-free in lp8727 release irq lp8727 isr func, the threaded IRQ handler, is the only caller that arms pchg-work via schedule delayed work. lp8727 release irq currently cancels the work before...

PT-2026-90181

In the Linux kernel, the following vulnerability has been resolved: power: supply: rt9455: quiesce delayed work before teardown The threaded IRQ handler can queue pwr rdy work, max charging time work and batt presence work. pwr rdy work and batt presence work can also queue max charging time work...

PT-2026-90189

In the Linux kernel, the following vulnerability has been resolved: power: supply: bq25890: Fix power supply reference leak bq25890 fw probe acquires a reference to a secondary charger using power supply get by name, but the reference is not released on later probe failures or on driver detach. I...

PT-2026-90191

In the Linux kernel, the following vulnerability has been resolved: power: supply: bq24257: fix use-after-free on remove The STAT-pin interrupt is devm-managed, so it stays armed until the devm cleanup that runs after remove returns. remove cancels bq-iilimit setup work while the threaded handler...

CVE-2026-56864

A flaw was found in golang.org/x/mod/sumdb. A malicious Go checksum database GOSUMDB can serve arbitrary module content that is not recorded in the transparency log. This allows a coordinated Go proxy GOPROXY and GOSUMDB to deliver malicious module content to a client, which cannot be detected by...

Malicious code in etoro-aggregator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7d5f0fb8c06c23afad28686a3d3d689dfc5a3786c73bff2c569fd8b55f2b4ad The package's preinstall.js lifecycle script executes automatically on npm install and performs reconnaissance on the installer host. It collects...

MAL-2026-16118 Malicious code in etoro-charts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e44aff5a1a0b68ff9c9b3456693ef1b8266dce7001dd8b6ff56bed428bbc7c5a On npm install, preinstall.js runs automatically and sends the installer's hostname, username, platform, and current working directory via HTTP GET t...

Malicious code in etoro-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 385c1c361c59557137d095062a9f767a4c0cd0a1ef78b0b26e4654147e137e3c The package's preinstall.js runs automatically on npm install and collects host identifiers os.hostname, os.userInfo.username, process.cwd,...

Malicious code in discord-mfa-solver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a91086c84ad0836c4b32ee5db890c9a6d9543f00e9dd31d18aed8a6acc9bdb3e On require of the package, lib/cache.js reached from index.js executes trymodule'require'catch — a bracket-notation, error-swallowed dynamic require ...

CVE-2026-87875

The cupsUTF32ToUTF8 function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content...

MAL-2026-16077 Malicious code in chai-as-sleek (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 782914cb65e0d30697eb54f50a4c5b740a3a53941abc185759e296c1d2ec8e9e Package published as 'chai-as-sleek' impersonates the pino logger: README, LICENSE, docs/, and index.d.ts are copied verbatim from pino, while...

Malicious code in cat-sis2go-utils (npm)

cat-sis2go-utils is a dependency-confusion package published against the SIS2GO namespace, with versions inflated to 99.0.0 and 99.1.0. It ships no library code index.js is an 87-byte stub, and package.json declares both preinstall and postinstall running node scripts/run.js, so the payload...

Malicious code in @fyxzpediaa/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0747ec3c1ce519798cac2e89f8ec1e1532d428355a13929f0176a11d77a2b175 This fork of Baileys injects a covert remote-directed action into the WhatsApp socket. On every WebSocket connection, socketConnect reconstructs a UR...

MAL-2026-16070 Malicious code in @fyxzpediaa/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0747ec3c1ce519798cac2e89f8ec1e1532d428355a13929f0176a11d77a2b175 This fork of Baileys injects a covert remote-directed action into the WhatsApp socket. On every WebSocket connection, socketConnect reconstructs a UR...

MAL-2026-16069 Malicious code in reactlogo-load (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0f9d76fcf9f229c0a11508004a2be764133c6195530c4d56563eb28c358ab5f The package presents itself as a logo/color utility but its exported loadLogo function extracts a URL from LSB-encoded bits of a PNG, fetches the...

CVE-2026-87063

A flaw was found in konflux-operator-tasks. The Continuous Integration CI process installs the tkn command-line interface CLI from a network download without verifying its integrity through checksums or digital signatures. This vulnerability could allow a compromised distribution channel to...

CVE-2026-87059

A flaw was found in olm-operator-konflux-sample. The bundle builder stage installs and upgrades Python packages using pip, a package installer, without verifying their versions or using hash verification. This allows a malicious or compromised package to be introduced into the build process...