AlmaLinux 10 : glibc (ALSA-2026:42694)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:42694 advisory. glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings CVE-2026-5928 glibc: glibc:...

EUVD-2026-46400

Trezor Safe 3, Safe 5, and Safe 7 firmware contains a confirmation-binding flaw in the Ethereum signtx / signtxeip1559 flow. For contract interactions, the device confirms only the initial calldata chunk while the signature commits to the full streamed calldata. An attacker could present calldata...

CVE-2026-65058 Trezor Safe improper security check in on-device display

Trezor Safe 3, Safe 5, and Safe 7 firmware contains a confirmation-binding flaw in the Ethereum signtx / signtxeip1559 flow. For contract interactions, the device confirms only the initial calldata chunk while the signature commits to the full streamed calldata. An attacker could present calldata...

CVE-2026-65058 Trezor Safe improper security check in on-device display

Trezor Safe 3, Safe 5, and Safe 7 firmware contains a confirmation-binding flaw in the Ethereum signtx / signtxeip1559 flow. For contract interactions, the device confirms only the initial calldata chunk while the signature commits to the full streamed calldata. An attacker could present calldata...

glibc: glibc: Out-of-bounds write via TSIG record processing

A flaw was found in glibc, the GNU C Library. Specifically, deprecated functions responsible for printing TSIG Transaction Signature records fail to properly manage memory buffers. This oversight can lead to an out-of-bounds write when processing specially crafted TSIG records. An attacker could...

glibc: glibc: Application crash or uninitialized memory read via crafted DNS response

A flaw was found in glibc GNU C Library. The deprecated functions nsprintrrf, nsprintrr, and fpnquery do not properly validate the length of RDATA Resource Record Data in a DNS Domain Name System response when processing specific record types like LOC, CERT, TKEY, or TSIG. A remote attacker could...

CVE-2026-55219

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.5, the credit payment implementation in app/Livewire/Invoices/Show.php executes a pessimistic row lock lockForUpdate outside of an active database transaction. Because MySQL/MariaDB...

CVE-2026-55219

CVE-2026-55219 – Paymenter race condition (version

CVE-2026-55219 Paymenter: Race condition in payWithCredit() enables credit double-spend

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.5, the credit payment implementation in app/Livewire/Invoices/Show.php executes a pessimistic row lock lockForUpdate outside of an active database transaction. Because MySQL/MariaDB...

CVE-2026-64187

In the Linux kernel, the following vulnerability has been resolved: xfs: fail recovery on a committed log item with no regions If the first op of a transaction is a bare transaction header len == sizeofstruct xfstransheader, xlogrecoveraddtotrans adds an item but no region, leaving it on ritemq...

CVE-2026-64187

Technical details for CVE-2026-64187 are not publicly provided in the supplied documents. Monitor for updates.

MAL-2026-10878 Malicious code in @dxcl/transaction-js (npm)

--- -= Per source details. Do not edit below this line.=-...

SUSE CVE-2026-63821

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: usb: fix memory leaks on USB write failures When rtwusbwriteport fails to submit a USB Request Block URB e.g., due to device disconnect or ENOMEM, the completion callback is never executed. Currently, the driver...

CVE-2026-64136

In the Linux kernel, the following vulnerability has been resolved: smb: client: protect tccount increment in smb2findsmbsesstconunlocked Commit 96c4af418586 "cifs: Fix locking usage for tcon fields" refactored cifs code to change cifstcpseslock for tclock around tccount changes. There was missin...

CVE-2026-63858

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: add hook transactions for device deletions Restore the flag that indicates that the hook is going away, ie. NFTHOOKREMOVE, but add a new transaction object to track deletion of hooks without altering the...

EUVD-2026-45542

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: add hook transactions for device deletions Restore the flag that indicates that the hook is going away, ie. NFTHOOKREMOVE, but add a new transaction object to track deletion of hooks without altering the...

CVE-2026-63821

In the Linux kernel, the wifi driver stack for rtw88/USB fixed memory leaks when USB write submissions fail. Specifically, rtw_usb_write_port() failures in rtw_usb_write_data() and rtw_usb_tx_agg_skb() could leave allocated skbs and a txcb/aggregated skbs unfreed due to a missing completion callb...

CVE-2026-59252

Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to drain the fee-payer wallet, resulting in denial of service for legitimate clients. When the mpp Elixir library is configured as fee payer feepayer: true, the MPP.Methods.Tempo payment meth...

CVE-2026-59252

The CVE-2026-59252 entry describes a missing gas_limit validation in ZenHive mpp when configured as a fee payer (fee_payer: true). The MPP.Methods.Tempo payment method co-signs and broadcasts a client-supplied EVM transaction without ensuring the client-supplied gas_limit is sufficient, allowing ...

CVE-2026-59252 Missing gas_limit validation in mpp Tempo fee-payer enables wallet drain

Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to drain the fee-payer wallet, resulting in denial of service for legitimate clients. When the mpp Elixir library is configured as fee payer feepayer: true, the MPP.Methods.Tempo payment meth...