PT-2026-64609

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Ownership and group modifications were ignored when mounting with SMB3 POSIX Extensions, unless CIFS MOUNT CIFS ACL or CIFS MOUNT MODE FROM SID were explicitly set. The issue occurs with...

Linux Distros Unpatched Vulnerability : CVE-2026-64402

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - coresight: ultrasoc-smb: Fix OOB write in smbsyncperfbuffer When the SMB sink is used as a perf AUX sink, smbupdatebuffer calls smbsyncperfbuffer to copy hardwa...

Linux Distros Unpatched Vulnerability : CVE-2026-64359

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nilfs2: reject CLEANSEGMENTS ioctl with out-of-range segment numbers Syzbot reported a hung task in nilfstransactionbegin where multiple tasks performing chmod ...

Linux Distros Unpatched Vulnerability : CVE-2026-64431

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid calling postwritemstfixup for invalid indexblock ntfsicxibsyncwrite calls...

Linux Distros Unpatched Vulnerability : CVE-2026-64301

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - regulator: scmi: fix ofnode refcount leak in scmiregulatorprobe scmiregulatorprobe calls offindnodebyname which takes a reference on the returned device node. O...

Linux Distros Unpatched Vulnerability : CVE-2026-9499

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An out-of-bounds read buffer over-read vulnerability exists in QTextCodec::codecForName in Qt. When the function is called with a QByteArray that is not...

Linux Distros Unpatched Vulnerability : CVE-2026-11605

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND always validates all RRSIG records in an answer, even if they are not...

Linux Distros Unpatched Vulnerability : CVE-2026-64263

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fuse-uring: fix moving cancelled entry to entinuserspace list fuseuringcancel moves entries that are available these have no reqs attached to the entinuserspace...

UBUNTU-CVE-2025-71408

NLTK Natural Language Toolkit before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module that allows an attacker who controls command-line arguments to execute arbitrary Python code. When collocations.py is invoked directly, the main block passes command-line...

CVE-2026-61884 Tycon Systems TPDIN-Monitor-WEB2 Authentication Bypass Using an Alternate Path or Channel

The web management interface of Tycon Systems TPDIN-Monitor-WEB2 does not perform server-side validation of credentials during the login process. By submitting empty values for both credential fields, an unauthenticated remote attacker can bypass the authentication check and establish a valid...

CVE-2026-64644 vulnerabilities

Vulnerabilities for packages: jitsucom-jitsu, langfuse...

GHSA-P63J-VCC4-9VMV vulnerabilities

Vulnerabilities for packages: langfuse...

CVE-2026-64642 vulnerabilities

Vulnerabilities for packages: langfuse...

GHSA-W62V-XXXG-MG59 vulnerabilities

Vulnerabilities for packages: langfuse...

GO-2026-5740 Hugo's Node tool execution allows file system access outside the project directory in github.com/gohugoio/hugo

Hugo's Node tool execution allows file system access outside the project directory in github.com/gohugoio/hugo...

Malicious code in app-data-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc306d8463afd4c0baadf4af1627986a5cb136d516c71415957fa606150008bd Analysis of [email protected] 3 files scanned produced no static or traced findings. No lifecycle hooks fetching or executing remote content, no...

MAL-2026-11054 Malicious code in app-node-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 175a4ca1d8f0f386347ce87b04012ff634cc3dee7b08117e72bcfa1562a213e4 The package's postinstall script test.js executes multiple installer-side attacks on npm install. It recursively walks the installation working...

Malicious code in app-node-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 175a4ca1d8f0f386347ce87b04012ff634cc3dee7b08117e72bcfa1562a213e4 The package's postinstall script test.js executes multiple installer-side attacks on npm install. It recursively walks the installation working...

EUVD-2026-48717

sysPass through version 3.2.11 contains an OS command injection vulnerability that allows authenticated administrators to execute arbitrary commands as the web server process user by setting a malicious backup path and triggering a backup. The FileBackupService builds a tar shell command via stri...

CVE-2026-65709 sysPass 3.2.11 Missing Object-Level Authorization via JSON-RPC API

sysPass through version 3.2.11 contains a missing object-level authorization vulnerability in the JSON-RPC API that allows API token holders to enumerate account metadata, overwrite passwords, and delete accounts across the entire vault without per-account access control. Attackers can invoke...