kernel: xen: AMD Zen 2 Processors: Privilege escalation via improper CPU cache isolation

A flaw was found in AMD Zen 2-based processors, affecting components such as the kernel and Xen hypervisor. Improper isolation of shared resources within the CPU operation cache could allow an attacker to corrupt instructions executed at a different privilege level. This could potentially result ...

CVE-2026-70598

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.0, 41.2.1, and 42.0.0-beta.3, offscreen rendering frame data received from the GPU process was not fully validated by the main process. A compromised GPU process could...

Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size

Impact In offscreen rendering mode, frame data received from the GPU process was not fully validated by the main process. A compromised GPU process could cause the main process to read out-of-bounds memory while producing paint event images, disclosing memory or crashing the app. Apps are only...

NPM: Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size

NPM: Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size vulnerability discovered by ? in WordPress Npm electron versions 39.8.10...

GHSA-PFMC-3MGC-P6FP Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size

Impact In offscreen rendering mode, frame data received from the GPU process was not fully validated by the main process. A compromised GPU process could cause the main process to read out-of-bounds memory while producing paint event images, disclosing memory or crashing the app. Apps are only...

EUVD-2026-53420

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.0, 41.2.1, and 42.0.0-beta.3, offscreen rendering frame data received from the GPU process was not fully validated by the main process. A compromised GPU process could...

CVE-2026-70598 Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.0, 41.2.1, and 42.0.0-beta.3, offscreen rendering frame data received from the GPU process was not fully validated by the main process. A compromised GPU process could...

CVE-2026-70598 Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.0, 41.2.1, and 42.0.0-beta.3, offscreen rendering frame data received from the GPU process was not fully validated by the main process. A compromised GPU process could...

CVE-2026-70598

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.0, 41.2.1, and 42.0.0-beta.3, offscreen rendering frame data received from the GPU process was not fully validated by the main process. A compromised GPU process could...

python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations

A flaw was found in Python. Its incremental HTML parser can be exploited by a remote attacker. By sending specially crafted, uncontrolled data with repeated, incomplete markup declarations, the attacker can cause the system to consume excessive central processing unit CPU resources. This leads to...

Malicious code in json-validator-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 255dbc17164a6243a92bab0b4d71132efad3028b53e73d7d2924a1d7ccd1e8cf The package advertises itself as a JSON/XML validator but lib/core.js contains a multi-stage dropper triggered on any call to the public API...

MAL-2026-12000 Malicious code in streak-math-metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3769541ab9576413a88f4e32ef21b55090b7efc17fd44750269f9e19e854abb1 The package's module entry dist/index.mjs runs a top-level IIFE on import that chmods dist/math-calc.bin to 0755 and spawns it detached...

CVE-2026-0163

CVE-2026-0163 concerns the Android Video Processing Unit (VPU) driver, where multiple functions in vpu_ioctl.c have a use-after-free defect. This leads to remote elevation of privilege with no additional execution privileges required and no user interaction needed. The issue is categorized in the...

MAL-2026-11947 Malicious code in @servicetitan/unit-tests (npm)

npm/@servicetitan/unit-tests is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

CVE-2026-64561

A flaw was found in KVM in the Linux kernel. This vulnerability occurs due to improper validation of memory management unit MMU page roots after these pages are made available. An attacker could exploit this by triggering a scenario where KVM attempts to map memory into an invalid root, causing...

UBUNTU-CVE-2026-64561

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Check for invalid/obsolete root after making MMU pages available Check for a "stale" page fault, i.e. for an invalid and/or obsolete root, after making MMU pages available for the shadow MMU. If reclaiming shadow pages...

CVE-2026-64561

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Check for invalid/obsolete root after making MMU pages available Check for a "stale" page fault, i.e. for an invalid and/or obsolete root, after making MMU pages available for the shadow MMU. If reclaiming shadow pages...

EUVD-2026-52602

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Check for invalid/obsolete root after making MMU pages available Check for a "stale" page fault, i.e. for an invalid and/or obsolete root, after making MMU pages available for the shadow MMU. If reclaiming shadow pages...

CVE-2026-64561

CVE-2026-64561 is a Linux kernel vulnerability in KVM/x86 shadow MMU where, after reclaiming shadow MMU pages, an invalid/obsolete root could be created and then mapped. If a stale root is zapped and a child shadow page inherits that role, new child pages can be created as invalid, violating KVM’...

CVE-2026-67296 FreeRDP before 3.29.0 Denial of Service via RDPEI PDU

FreeRDP before 3.29.0 contains a denial of service vulnerability in the RDPEI server channel handler that fails to validate maximum PDU body length before stream allocation. A malicious RDP client can send a header-only RDPEI message with a large declared body length to force excessive memory...