A NULL pointer dereference vulnerability in the Linux kernel's cdns3_pci_probe function for the Cadence USBSS controller can cause a kernel crash. This occurs when the second PCI function probes before the first function has set its driver data, leading to a NULL pointer dereference. The issue has been fixed by deferring the probe until the first function completes its initialization.
CVE-2026-98741 is a vulnerability in the Linux kernel ALSA ua101 driver where mismatched capture and playback USB packet sizes can cause out-of-bounds memory writes during PCM node open. This occurs because the driver does not properly relate the endpoints' maximum packet sizes and channel counts, leading to buffer overflows. The issue is fixed by rejecting such mismatched descriptors at probe time. Genuine UA-101/UA-1000 hardware is not affected.
A vulnerability in the Linux kernel's EDAC/altera driver involves the improper use of __init annotation on ECC setup functions. These functions, which run during device probing, may be called after the __init memory is freed due to deferred probing or manual unbind/rebind operations, leading to dereferencing freed memory. The issue is fixed by removing the __init annotation to ensure these functions remain valid at runtime.
CVE-2026-98710 is a memory leak vulnerability in the Linux kernel's iwlegacy wireless driver for the 3945 device. The issue occurs because EEPROM data allocated during device probe is not freed upon device removal after a successful probe, leading to a memory leak. This flaw was identified through manual code inspection and has been fixed in specific Linux kernel commits.
A use-after-free vulnerability exists in the Linux kernel driver for the gp2ap020a00f light sensor. The issue arises because the irq_work queued by the threaded IRQ handler is not flushed by free_irq(), allowing work to run after the device has been freed. This can lead to a use-after-free condition when iio_trigger_poll() is called on a freed trigger. The flaw has been fixed by adding irq_work_sync() calls after free_irq() in the remove and probe error paths.
A vulnerability in the Linux kernel's amd_sfh driver allows out-of-bounds memory access due to lack of validation of PCI BAR 2 size before mapping. This can cause a page fault during device probe if the BAR size is smaller than expected. The issue is fixed by verifying the BAR size is at least 128KB before mapping.
A vulnerability in the Linux kernel's MediaTek Ethernet driver (mtk_eth_soc) was identified where net_devices were not properly unregistered upon probe failure. This caused a state inconsistency leading to a kernel BUG_ON condition. The issue was fixed by ensuring that registered net_devices are properly unregistered before being freed during error handling.
CVE-2026-98486 is a vulnerability in the Linux kernel's ena network driver where a memory leak occurs during probe failure. Specifically, a coherent DMA buffer allocated for MMIO read responses is not freed if the probe fails after initialization, leading to a resource leak. This issue was fixed by ensuring the buffer is properly destroyed in the error path.
UADE versions up to 3.05 have an out-of-bounds read vulnerability in the uade_filemagic() function due to unsigned buffer size subtraction wrapping on short inputs. This flaw allows crafted short modules to bypass format probe bounds checks and read beyond the intended buffer, potentially causing application crashes.
ruoyi-vue-pro through 2026.09 contains a server-side request forgery vulnerability in the yudao-module-ai image service that allows authenticated users to make the server fetch arbitrary URLs by supplying referImageUrl to the midjourney imagine endpoint. Attackers can force Hutool HttpUtil.downloadBytes() requests to loopback, private, or cloud metadata addresses to probe internal-only HTTP services and reach metadata endpoints.
A vulnerability in the Linux kernel IPv4 implementation could cause a UDP length overflow when Path MTU Discovery (PMTU) is set to probe mode and the network device MTU is unusually large. This overflow triggers a warning in the kernel and is caused by improper bounding of fragment size during packet construction. The issue has been fixed in specific kernel commits.
NLTK versions up to 3.10.3 have a path traversal vulnerability in the WekaClassifier component. This flaw allows attackers who control the model filename or model argument to bypass path containment checks and cause the Weka JVM to write or probe files outside of permitted directories.
EdgeEver Desktop versions 1.92.0 through 1.112.0 have a remote code execution vulnerability in the desktop:acp-probe IPC handler. This handler does not verify the sender and executes a caller-supplied executable path. Attackers with script execution in a renderer process can exploit this to launch local executables with the user's privileges.
CVE-2026-57143 is an improper input validation vulnerability in MervinPraison's praisonaiagents before version 1.6.62. The vulnerability involves the searxng_search and search_web SearxNG providers passing an LLM-controlled URL parameter directly to requests.get without validating its scheme, host, port, or resolved address. This allows prompt-injected content to access internal JSON services, probe internal ports, and attempt cloud metadata requests, with the results incorporated into the agent context. The issue is fixed in version 1.6.62.
Edward Dubrovsky, a Canadian cybersecurity executive specializing in ransomware response, was arrested in the United States on suspicion of involvement with the ShinyHunters hacking group. The group recently targeted FBI systems, including the FBI jobs website, allegedly obtaining sensitive information. The FBI attributes the breach to a contractor's failure to patch vulnerable Oracle PeopleSoft software. This arrest is part of an ongoing FBI effort to dismantle the ShinyHunters network, with other key suspects arrested in the Netherlands and Jordan. Dubrovsky faces charges related to conspiracy to extort and interference with commerce by threats. The ShinyHunters group had claimed responsibility for the FBI hack and appeared defiant before their Tor-based site became inaccessible.
LibreNMS versions through 26.9.1.1 have an authorization bypass vulnerability in the SmokePing graph authorization logic. The flaw occurs because the code checks the source probe device rather than the actual target device, allowing restricted users on a probe device to access latency graphs for arbitrary devices. This enables unauthorized viewing of latency data and enumeration of device names.
The npm package react-paginate-v5@99.0.0 is a malicious package designed as a dependency confusion probe. It masquerades under a name similar to the legitimate react-paginate package but uses an implausibly high version number to override internal packages. Upon installation, it executes a preinstall script that performs a DNS lookup to an attacker-controlled domain, confirming the package's installation and revealing resolver metadata. The package has no legitimate functionality and can potentially execute arbitrary shell commands during installation.
Company Research Agent versions up to 2.2.0 have a server-side request forgery (SSRF) vulnerability in the /generate-pdf endpoint. This flaw allows unauthenticated attackers to inject unescaped ReportLab paragraph markup, including inline img elements, causing the server to make outbound requests to internal or external hosts. The responses from these requests can be leaked in the generated PDFs, enabling attackers to probe network reachability and potentially access internal resources.
orderly-plugin-liquidity-heatmap poses as a liquidity heatmap plugin for the Orderly Network orderbook widget, but its only export is an empty stub and a postinstall hook runs `node ./scripts/setup.js` on npm install. When the script detects GitHub Actions (CI and GITHUB_WORKSPACE set), it records the runner's host, user, repository, GITHUB_/ACTIONS_/RUNNER_ variable names, GITHUB_TOKEN presence and length and network egress, and requests an OIDC token from ACTIONS_ID_TOKEN_REQUEST_URL. From 1.0.2 it uses the workflow's GITHUB_TOKEN to commit heatmap-setup-report.json to the default branch of the installing repository, and 1.0.4 also force-pushes a `heatmap-setup-<timestamp>` git tag with the credentials actions/checkout persists in .git/config; 1.0.6 ships the same setup.js as 1.0.4. The npm account dumtban published the six versions between 13:12 and 16:05 UTC on 2026-10-11, each extending the previous one's access to the CI runner.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (dc82bf27be560cba6faa5304a85b992a07f453c6f9d3f6965f9462666309a3d1)
orderly-plugin-liquidity-heatmap@1.0.0 ships a non-functional main (dist/index.js exports registerLiquidityHeatmapPlugin returning an empty function) with no overlay/interceptor/rendering code — the advertised purpose exists only in the README. The sole real behavior is a postinstall script (scripts/setup.js) gated by `process.env.CI && process.env.GITHUB_WORKSPACE`, so the payload fires only inside GitHub Actions. On that trigger it collects runner identity (hostname, user, repo, workflow, platform), enumerates all GITHUB_*/ACTIONS_*/RUNNER_* environment variable names, records GITHUB_TOKEN presence and length, captures the OIDC request URL, the npm registry, egress probe results, and tool versions, and writes the JSON to `<GITHUB_WORKSPACE>/heatmap-setup-report.json` inside the installer's checked-out repository. In addition, when ACTIONS_ID_TOKEN_REQUEST_TOKEN and ACTIONS_ID_TOKEN_REQUEST_URL are set, it uses the installer's OIDC bearer token to call the GitHub ID-token endpoint with `audience=api.github.com` and records the mint result in the same report. The combination of a hollow library stub, CI-environment-only activation, enumeration of secrets-adjacent CI metadata, unauthorized exercise of the workflow's OIDC identity, and placement of the output into the repository workspace where subsequent workflow steps may commit it or upload it as an artifact is a CI-poisoning / supply-chain reconnaissance primitive against the installer's build pipeline.
## Source: ghsa-malware (f25fe3de75e25d7bb2dee4e8cf02e39d79d011bc22a4b52cf0071bf8a73ad2f2)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
CVE-2026-108702 is a medium severity vulnerability in 1Panel-dev CordysCRM versions up to 1.9.3. It involves a missing authorization check on the POST /approval-flow/webhook/test endpoint, allowing any authenticated user to trigger server-side requests to attacker-controlled URLs. This can be exploited to bypass SSRF validation and probe internal network addresses.