A vulnerability in the Linux kernel's mtd: virt-concat component causes a memory management issue where a duplicate generated name string is not freed properly. This occurs during MTD registration when the function mtd_virt_concat_create_join() encounters an already registered virtual concat name and skips freeing the newly allocated string. The issue has been resolved by ensuring the temporary name is freed before continuing.
The npm package @devmikets/hyperliquid-sdk version 1.9.6 contains malicious code delivered via a typosquatted tarball URL for the 'inquirer' dependency. This causes arbitrary code execution on any system installing this package version. The package mimics a legitimate trading SDK but includes a suspicious dependency that acts as a delivery vector for malware. Systems with this package installed should be considered fully compromised.
Multiple vulnerabilities affect the Go programming language versions prior to 1.26.6. These include issues such as privilege escalation via incorrect Punycode label processing. A fix is available in version 1.26.6. The vulnerabilities have been rated as important by Red Hat and are addressed in their security advisories.
Multiple vulnerabilities in OpenSSL, including CVE-2026-14456, allow remote attackers to cause denial of service by exploiting improper handling of QUIC server incoming channel queues and other protocol processing errors. These issues affect various Ubuntu LTS releases and Debian versions prior to 4.0.2. Fixes are available in updated OpenSSL packages.
Multiple security vulnerabilities have been identified in the Red Hat Build of Apache Camel for Quarkus, affecting components such as sshd-core, libthrift, and org.hl7.fhir.utilities. These include unauthorized command execution, denial of service, XML external entity injection, and regular expression backtracking issues. An update to version 4.18 is available that addresses these vulnerabilities.
CVE-2024-37891 is a vulnerability in urllib3's handling of the Proxy-Authorization HTTP header during cross-origin redirects. When the Proxy-Authorization header is set manually without using urllib3's proxy support, it is not stripped on redirects, potentially exposing sensitive authentication information. This scenario requires specific conditions, including manual header setting without proxy support, enabled HTTP redirects, and redirects to a malicious origin. The vulnerability affects icloudpd versions from 1.17.3 up to but not including 1.25.1. A fix is available in version 1.25.1.
Multiple vulnerabilities have been identified in Rsync, a tool used for synchronizing files and directories. The information provided does not specify the nature, impact, or affected versions of these vulnerabilities. No CVSS score or detailed technical data is available.
Multiple security vulnerabilities have been identified in the Node.js 24 module for Red Hat Enterprise Linux 8. These include arbitrary code execution and denial of service issues in SQLite and brace-expansion components, as well as server-side request forgery (SSRF) and trust-boundary bypass vulnerabilities in the ip-address package. Red Hat has released an important security update that fixes these issues in version 5.36.00.16 of the affected packages.
CVE-2026-68438 is a medium-severity vulnerability in the Linux kernel related to the smp_call_function_single() CSD lock acquisition in debug mode. The issue arises because the lock acquisition was not atomic, allowing multiple CPUs to concurrently prepare the same destination CPU CSD, potentially causing a soft-lockup or panic. The vulnerability has been addressed by making the CSD lock acquisition atomic when debugging is enabled.
A vulnerability in Nmap, a free and open-source network scanning utility, has been published that allows for a denial of service (DoS) condition. The affected versions include all versions up to and including 7.99. No CVSS score or detailed technical impact information is provided.
This entry reports multiple vulnerabilities related to Intel processors. The description is minimal, stating only that the processor is the central computing unit of a computer. No specific technical details, impact, or affected versions are provided.
Red Hat OpenShift AI released version 2.25.10 with updated images addressing multiple security issues identified by several CVEs including CVE-2026-15154. The advisory lists a broad range of CWEs indicating various types of vulnerabilities but does not detail specific fixes or impacts for CVE-2026-15154. The update is critical and users are advised to upgrade following Red Hat's official documentation.
A vulnerability in the GNU C Library (glibc) prior to version 2.44 allows an attacker to cause a denial of service due to incorrect memory handling in the wordexp function when called with the WRDE_APPEND flag. This flaw affects Linux and other Unix-based systems that rely on glibc for system calls and basic functionality. The issue has been fixed in version 2.44.
This entry references multiple vulnerabilities in the Linux kernel, which is the core component of the Linux operating system. However, no specific details about the nature, impact, or affected versions of these vulnerabilities are provided.
A denial of service vulnerability exists in the brace-expansion component used in Red Hat Enterprise Linux. This flaw allows unbounded intermediate arrays to be created, potentially causing service disruption. The issue affects versions prior to 5.36.00.16 and is fixed in version 5.36.00.16.
A vulnerability in the Linux kernel's timekeeping subsystem caused the jiffies clocksource to be used before it was registered during early boot. This led to the max_delta_raw field being zero, preventing time from progressing and causing long boot delays on some systems, such as XEN HVM. The issue has been fixed by ensuring the jiffies clocksource is registered before its first usage.
A vulnerability in the Linux kernel's Industrial I/O (iio) core subsystem was fixed to address uninitialized data usage in debugfs. The issue occurs when the file position pointer (*ppos) is non-zero, causing simple_write_to_buffer() not to initialize the start of the buffer, which is improper behavior. The fix involves checking for non-zero *ppos values early in the function and returning an error to prevent misuse.
A Linux kernel vulnerability in the HID wacom driver was fixed by changing memory allocation from GFP_KERNEL to GFP_ATOMIC in the wacom_wac_queue_flush() function. This function is called in an atomic context where sleeping is not allowed, and using GFP_KERNEL could cause a 'scheduling while atomic' bug. The fix prevents potential kernel instability by ensuring proper allocation behavior in this context.
Multiple security vulnerabilities have been identified in Netty and related components used in Red Hat builds of Apache Camel and Quarkus. These include TLS hostname verification bypass, denial of service due to connection leaks and excessive resource allocation, server impersonation, credential disclosure via cleartext logging, remote unauthenticated file read, server-side template injection, authorization bypass, and information disclosure via CORS header manipulation. Red Hat has released security updates addressing these issues in Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 and Red Hat build of Quarkus 3.27.5.SP1.
CVE-2026-64596 addresses a Linux kernel issue where pseudo-filesystems created by init_pseudo() did not have the SB_I_NOEXEC and SB_I_NODEV flags set by default. This omission caused warnings when anonymous-inode files backed by dma-buf were memory-mapped without the SB_I_NOEXEC flag, especially with CONFIG_DEBUG_VFS enabled. The fix ensures these flags are set by default, preventing executable mappings of pseudo-filesystem file descriptors, which now fail with -EPERM as intended.