CVE-2026-64162

CVE-2026-64162 concerns the Linux kernel idpf driver: a read_dev_clk_lock spinlock could be used before initialization because the lock was not initialized before ptp aux work could run. The issue arises when idpf_ptp_init() initializes read_dev_clk_lock after ptp_schedule_worker() has started an...

CVE-2026-64162 idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init()

In the Linux kernel, the following vulnerability has been resolved: idpf: fix readdevclklock spinlock init in idpfptpinit In idpfptpinit, readdevclklock is initialized after ptpscheduleworker had already been called and after idpfptpsettime64 could reach the lock. The PTP aux worker fires...

CVE-2026-64162 idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init()

In the Linux kernel, the following vulnerability has been resolved: idpf: fix readdevclklock spinlock init in idpfptpinit In idpfptpinit, readdevclklock is initialized after ptpscheduleworker had already been called and after idpfptpsettime64 could reach the lock. The PTP aux worker fires...

CVE-2026-64038 hwmon: (lm90) Stop work before releasing hwmon device

In the Linux kernel, the following vulnerability has been resolved: hwmon: lm90 Stop work before releasing hwmon device Sashiko reports: In lm90probe, the devm action to cancel the alertwork and reportwork lm90restoreconf is registered in lm90initclient before devmhwmondeviceregisterwithinfo is...

AZL-92558 CVE-2026-53377 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/msm: always recover the gpu Previously, in case there was no more work to do, recover worker wouldn't trigger recovery and would instead rely on the gpu going to sleep and then resuming when more work is submitted...

CVE-2026-53377

CVE-2026-53377 affects the Linux kernel DRM MSM driver. The GPU recovery path (Recover_worker) could fail to trigger recovery when no new work is submitted, leaving the GPU hung and potentially causing timeouts or unavailability. The fix changes Recover_worker to always recover the GPU (increment...

PT-2026-61355

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the lm90 hardware monitoring driver. The issue occurs because cleanup actions are executed in reverse order during module unbind or probe failure. If the lm90...

PT-2026-61479

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the idpf ptp init function where the read dev clk lock spinlock is initialized after the ptp schedule worker function has been called. This sequence allows the PTP...

CVE-2026-62210: Allocation of Resources Without Limits or Throttling

OpenClaw versions before 2026.6.1 contain a denial of service vulnerability where remote media URLs can trigger slow-read attacks that exhaust gateway worker resources. Attackers with access to configured input paths can supply remote media URLs that consume gateway resources and reduce...

Malicious code in mfq-private-encoder (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f2c0f78a3c5677481645e05e125f32273435610a1208a17ca4f852cb7f56b0e The package advertises a Python source-code encoder but has no local codec. The encodefile function and public encode API read the user-supplied Pyth...

MAL-2026-10758 Malicious code in mfq-private-encoder (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f2c0f78a3c5677481645e05e125f32273435610a1208a17ca4f852cb7f56b0e The package advertises a Python source-code encoder but has no local codec. The encodefile function and public encode API read the user-supplied Pyth...

MAL-2026-10729 Malicious code in channel-worker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb42c8663e71b69abd887afe5b53f3c9d57bb405dd9e8ec4954eb1bf9bb0c033 The package's runtime code implements a remote command-and-control agent rather than a normal library. bin/cli.js hardcodes the endpoint...

Malicious code in channel-worker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb42c8663e71b69abd887afe5b53f3c9d57bb405dd9e8ec4954eb1bf9bb0c033 The package's runtime code implements a remote command-and-control agent rather than a normal library. bin/cli.js hardcodes the endpoint...

Malicious code in @yuandc/aica (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a9352926e7ceab9460eb3fecae1dfd1bcb9417efa9488e6f7f858149a47e1f31 Package runs a persistent worker invoked via the aica start CLI that long-polls the hardcoded endpoint https://aca.kinghon.com.cn:8843/ for three...

MAL-2026-10724 Malicious code in @yuandc/aica (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a9352926e7ceab9460eb3fecae1dfd1bcb9417efa9488e6f7f858149a47e1f31 Package runs a persistent worker invoked via the aica start CLI that long-polls the hardcoded endpoint https://aca.kinghon.com.cn:8843/ for three...

SUSE CVE-2026-60065

When NGINX Plus is configured to use the Message Queuing Telemetry Transport MQTT filter module ngxstreammqttfiltermodule, unauthenticated attackers can send requests with conditions beyond the attacker's control to cause a heap buffer over-read in the NGINX worker process, leading to a restart...

Linux Distros Unpatched Vulnerability : CVE-2026-60005

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpslicemodule module. When the slice directive and unnamed regex captures are configured or wh...

PT-2026-60402

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'twitter message' Sequoia Template Setting in all versions up to, and including, 4.16.3 due to insufficient input sanitization and output escaping. This makes it possible fo...

Linux Distros Unpatched Vulnerability : CVE-2026-56434

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpssimodule module. This vulnerability may exist when the Server-Side Includes SSI, proxypass,...

CVE-2026-14987: Improper Neutralization of Input During Web Page Generation

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'twittermessage' Sequoia Template Setting in all versions up to, and including, 4.16.3 due to insufficient input sanitization and output escaping. This makes it possible for...