The npm package dotenv-preflight@1.0.0 is a malicious package that masquerades as a dotenv-related utility but contains heavily obfuscated JavaScript code. This obfuscation is unusual for such tooling and is indicative of concealed malicious behavior, likely credential theft or data exfiltration. The package name is similar to legitimate dotenv packages, increasing the risk of accidental installation. The malicious code executes upon requiring the package, potentially compromising any project that includes it.
A vulnerability in the Linux kernel's KVM x86 memory management unit (MMU) was resolved. The issue involved improper checking of write tracking across all address spaces, which could lead to incorrect handling of shadow pages and trigger kernel bugs. This affects specific linux-aws kernel versions. The CVSS score is 7.1, indicating a medium severity with high confidentiality impact and high availability impact.
Citrix has fixed eight vulnerabilities in NetScaler ADC and NetScaler Gateway affecting certain versions prior to specific patch releases. These vulnerabilities also impact Secure Private Access Hybrid deployments using NetScaler instances. The advisory applies only to customer-managed NetScaler ADC and Gateway systems; Citrix-managed cloud services receive updates directly from the vendor.
A stored cross-site scripting (XSS) vulnerability exists in the Mediawiki Cargo extension up to version 3.9.4 due to improper neutralization of input during web page generation. This vulnerability allows malicious input to be stored and later executed in users' browsers. The issue is identified as CWE-79. No official patch or fix information is provided in the available data.
The @zeronexcode/baileys npm package version 7.0.0-zeronex.8 contains malicious code that causes the user's WhatsApp account to automatically follow a hardcoded channel without user consent. This behavior triggers whenever a connection is opened and cannot be disabled by the user.
A memory management vulnerability in the Linux kernel's rtl8723bs staging driver was fixed. The issue involved incorrect freeing of a vmalloc-allocated buffer using kfree(), which can cause memory corruption. The fix replaces the improper kfree() call with the correct vfree() via rtw_hal_data_deinit(). The vulnerability affects specific linux-azure kernel versions and has a medium severity rating.
A vulnerability in the Linux kernel's nvdimm pmem subsystem allowed data writes to proceed after a failed REQ_PREFLUSH flush due to improper error handling in pmem_submit_bio(). This could cause the bio operation to complete successfully despite a failed ordering barrier, potentially leading to data integrity issues. The flaw has been resolved by ensuring the REQ_PREFLUSH flush is run synchronously before copying bio data and completing the bio with the flush error if it fails.
A vulnerability in the Linux kernel's SMB server component caused a tree connection leak in the smb2_tree_connect() function. This issue was resolved by fixing the handling of tree connections when the function ksmbd_iov_pin_rsp() fails, ensuring proper disconnection of the new tree connection to prevent resource leaks. The vulnerability affects specific versions of linux-hwe-edge kernel releases. The CVSS score is 5.5, indicating a medium severity with impact primarily on availability.
A medium severity vulnerability in the Linux kernel's netfilter nf_nat_sip module was resolved. The issue occurs when NAT modifies the packet length, causing an offset pointer to become incorrect if the packet shrinks. This can lead to skipping bytes and missing subsequent Contact headers during SIP header parsing, potentially causing NAT to fail on those headers and possibly leaking internal network details.
In the Linux kernel, the following vulnerability has been resolved: net: hsr: free learned nodes on device setup failure hsr_dev_finalize() can fail after a lower-device RX handler has already been registered (slave A is added before the failable slave B and interlink adds). RX handlers run in softirq regardless of the master's state, so frames received in that window can learn dynamic nodes into node_db, and the error unwind never releases them. Free both owned dynamic databases in the unwind, mirroring hsr_dellink(). proxy_node_db is provably empty on every current error exit (only interlink RX feeds it, and the interlink add is the last failable step) and is freed for symmetry. The order is safe: hsr_del_port() unregisters each RX handler with synchronize_net() before hsr_del_nodes() runs, which removes remaining entries with list_del_rcu() and defers their release with call_rcu() for readers already under RCU.
A vulnerability in the Linux kernel's ACPI platform code related to unsafe and inefficient use of acpi_get_first_physical_node() has been resolved by switching to acpi_bus_get_primary_device(). This change prevents potential issues caused by the device returned by acpi_get_first_physical_node() possibly being freed at any time and reduces redundant calls. The vulnerability affects specific linux-azure kernel versions.
A vulnerability in the Linux kernel's ext4 filesystem was fixed to address a transaction overflow during writeback. The issue involved insufficient reservation of transaction credits for extent conversion, which could lead to problems when handling large folios with multiple extents and extent tree node allocations. The fix ensures correct upper bound credit estimation using ext4_meta_trans_blocks().
A vulnerability in the Linux kernel's BPF subsystem was fixed by marking the bpf_refcount field as unique, correcting an oversight where it was not properly marked. This flaw could impact system availability but does not affect confidentiality or integrity. The issue affects specific versions of the linux-hwe-edge kernel. The vulnerability has a medium severity rating with a CVSS score of 5.5.
A vulnerability in the Linux kernel's RDMA/srpt subsystem was fixed that involved improper cleanup of counters and pointers when srpt_alloc_rw_ctxs() fails partway through processing. This flaw could cause incorrect accounting of send queue credits, potentially leading to resource mismanagement. The issue affects specific linux-azure kernel versions listed. The vulnerability has a high CVSS score of 9.8, indicating critical impact on confidentiality, integrity, and availability.
A memory leak vulnerability in the Linux kernel's rtl8723bs driver staging area has been resolved. The issue involves management transmit frame and buffer leaks on certain error paths in functions handling beacon, probe response, and association response frames. These leaks cause progressive exhaustion of management-TX pools, eventually preventing the interface from sending necessary management frames. The vulnerability has a medium severity rating with a CVSS score of 5.5 and affects specific linux-azure kernel versions.
A medium severity vulnerability (CVE-2026-100077) in the Linux kernel's drm/msm driver was resolved. The issue involved unsafe retiring of hung GPU submits before recovery, which could cause GPU page faults due to premature buffer object (BO) freeing. The fix ensures submits are retired only after GPU recovery completes.
A vulnerability in the Linux kernel's iwlwifi driver was fixed by correcting the argument passed to the function iwl_mei_write_cyclic_buf(). The first argument should be the cldev, but the q_head pointer was incorrectly passed instead. This flaw affects specific versions of the linux-hwe-edge kernel and has a medium severity rating.
A vulnerability in the Linux kernel's USB Type-C UCSI driver was resolved. The issue involved debugfs entries created by ucsi_register() not being properly unregistered by ucsi_unregister(), causing conflicts when the same UCSI instance is unregistered and registered repeatedly. This could lead to errors and instability during remote processor restarts. The fix ensures debugfs entries are unregistered during ucsi_unregister() and clears related pointers to prevent repeated unregister issues.