MAL-2026-4887 Malicious code in @cloudplatform-single-spa/anti-ddos (npm)

Part of a dependency confusion attack campaign targeting the @cloudplatform-single-spa and @mlspace npm scopes. The attacker npm user mr.4nd3r50n published 139 scoped packages at the inflated version 99.99.99, which resolves ahead of any private registry version via npm's default version...

Linux Distros Unpatched Vulnerability : CVE-2026-48489

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.53, 6.4.41, 7.4.13, and 8.0.13,...

Automatically Attacking Software Reverse Engineering AI Agents

Software tools for reverse engineering executable binary files, such as Ghidra, enable malware analysts to safely conduct robust static analysis without having access to original source code. Coupled with the analytic power of large language models LLM, agentic systems enabled with tools, such as...

MAL-2026-4985 Malicious code in @cloudplatform-single-spa/svp-lbaas (npm)

Part of a dependency confusion attack campaign targeting the @cloudplatform-single-spa and @mlspace npm scopes. The attacker npm user mr.4nd3r50n published 139 scoped packages at the inflated version 99.99.99, which resolves ahead of any private registry version via npm's default version...

CVE-2026-45968

A flaw was found in the Linux kernel's cpuidle subsystem. On certain PowerNV systems, when only a single idle state is available, the cpuidle ladder governor may incorrectly treat state 1 as usable. This can lead to an out-of-bounds index being passed, causing a NULL enter callback to be invoked...

CVE-2025-14688

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows includes Db2 Connect Server could allow an authenticated user to cause a denial of service due to improper neutralization of special elements in data query logic when certain configurations exist...

GHSA-HCF7-66RW-9F5R vulnerabilities

Vulnerabilities for packages: langfuse, langfuse-fips...

GHSA-3QCW-2RHX-2726 vulnerabilities

Vulnerabilities for packages: langfuse, langfuse-fips...

watch-tower

OT/ICS Threat Intelligence Lab Local threat intelligence lab...

CVE-2026-35090

In Slican telephone exchanges it is possible to manage the control panel remotely. An unauthenticated attacker can connect to the modem via a telephone with a specific caller ID. This allows them to bypass admin authentication and gain full access to the service protocol and configuration panel...

CVE-2026-39828 vulnerabilities

Vulnerabilities for packages: kubernetes, helm, k3s, kubescape, trivy, kaf, argocd-image-updater, kots, gitlab-kas, cloud-provider-aws, external-dns, osv-scanner, cilium, loki, kine, minio, prometheus, zarf, kyverno, skaffold, flux-source-controller, flux-image-automation-controller, telegraf, zo...

CVE-2026-46598 vulnerabilities

Vulnerabilities for packages: kubernetes, helm, k3s, kaf, kots, gitlab-kas, cloud-provider-aws, external-dns, cilium, loki, kine, minio, prometheus, podman, kyverno, telegraf, zot, buildah, aactl, knative-serving, spire-server, rancher, nerdctl, cilium-cli, istio, containerd, kubernetes-dashboard...

CVE-2026-39834 vulnerabilities

Vulnerabilities for packages: kubernetes, crossplane-provider-aws-firehose, crossplane-provider-aws-s3, helm, scorecard, crossplane-provider-aws-cloudwatchlogs, glab, src, ko, syft, cloud-provider-aws, pulumi, chezmoi, mods, caddy, minio, crossplane-provider-aws-lambda, flux-kustomize-controller,...

CVE-2026-39832 vulnerabilities

Vulnerabilities for packages: mapotf, commercial-grafana, skaffold, frankenphp-8.4, tekton-pipelines-fips, guac, kubescape, wolfictl, frankenphp-8.3, cg, apko-fips, cloudbeat-fips, go-discover-fips, opentofu-fips, gitlab-rails-ce, syft, chainloop-cli, tigera-operator, knative-kafka-broker-fips,...

CVE-2026-46061

In the Linux kernel, the following vulnerability has been resolved: jbd2: fix deadlock in jbd2journalcancelrevoke Commit f76d4c28a46a "fs/jbd2: use sleeping version of findgetblock" changed jbd2journalcancelrevoke to use findgetblocknonatomic which holds the folio lock instead of iprivatelock. Th...

CVE-2026-46059

In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN For guests with NRIPS disabled, L1 does not provide NextRIP when running an L2 with an injected soft interrupt, instead it advances the current RIP before...

CVE-2026-46044

In the Linux kernel, the following vulnerability has been resolved: ipmi:ssif: Clean up kthread on errors If an error occurs after the ssif kthread is created, but before the main IPMI code starts the ssif interface, the ssif kthread will not be stopped. So make sure the kthread is stopped on an...

CVE-2026-45990

In the Linux kernel, the following vulnerability has been resolved: slub: fix data loss and overflow in krealloc Commit 2cd8231796b5 "mm/slub: allow to set node and align in kvrealloc" introduced the ability to force a reallocation if the original object does not satisfy new alignment or NUMA nod...

CVE-2026-45960

In the Linux kernel, the following vulnerability has been resolved: hfsplus: return error when node already exists in hfsbnodecreate When hfsbnodecreate finds that a node is already hashed which should not happen in normal operation, it currently returns the existing node without incrementing its...

CVE-2026-45927

In the Linux kernel, the following vulnerability has been resolved: bpf: Require frozen map for calculating map hash Currently, bpfmapgetinfobyfd calculates and caches the hash of the map regardless of the map's frozen state. This leads to a TOCTOU bug where userspace can call BPFOBJGETINFOBYFD t...