Recent Advisories

Severity ID Title Vendor Product Date Type
MEDIUM 4.7 CVE-2026-48986

pam_usb: Infinite loop DoS in process-tree walk when parent process exits during authentication_CVE-2026-48986

pam_usb provides hardware authentication for Linux using removable media. In pam_usb 0.9.1 and earlier, usb_get_process_parent_id() can cause an in...

mcdope pam_usb < 0.9.2 CVE
MEDIUM 5.5 CVE-2026-48985

pam_usb: NULL Dereference Crash in pusb_is_loginctl_local when loginctl Returns Empty Remote Field_CVE-2026-48985

pam_usb provides hardware authentication for Linux using ordinary removable media. In versions 0.9.1 and below, pusb_is_loginctl_local() can cause ...

mcdope pam_usb < 0.9.2 CVE
MEDIUM 4.7 CVE-2026-48984

pam_usb: xfree() does not call explicit_bzero — sensitive cryptographic material may linger in freed heap_CVE-2026-48984

pam_usb provides hardware authentication for Linux using ordinary removable media. In versions 0.9.1 and below, the xfree() memory release helper i...

mcdope pam_usb < 0.9.2 CVE
MEDIUM 5.3 CVE-2026-9692

Mojolicious::Sessions::Storable versions through 0.05 for Perl generate session ids insecurely_CVE-2026-9692

Mojolicious::Sessions::Storable versions through 0.05 for Perl generate session ids insecurely. The default session id generator returns a SHA-1 h...

HAYAJO Mojolicious::Sessions::Storable CVE
MEDIUM 6.7 CVE-2026-55392

NILFS utilities – Undefined Behavior and Out-of-Memory via Unvalidated s_log_block_size_CVE-2026-55392

NILFS utilities through 2.3.0, fixed in commit 26efb5d, nilfs_sb_is_valid() function fails to validate s_log_block_size field in NILFS2 superblock ...

nilfs-dev nilfs-utils CVE
MEDIUM 5.3 CVE-2026-48937

CVE-2026-48937_CVE-2026-48937

A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` frame. This vulnerability affects two su...

nodejs node 22.22.3 CVE
MEDIUM 6.1 CVE-2026-47833

CVE-2026-47833_CVE-2026-47833

setupBpmLogs follows symlink for bpm.log open and chown — container-to-host privilege escalation via /etc/shadow. A compromised process inside a bp...

Cloud Foundry Foundation bpm-release CVE
HIGH 8.4 CVE-2026-12390

Access of resource using incompatible type (‘type confusion’) in AzeoTech DAQFactory_CVE-2026-12390

In AzeoTech DAQFactory versions 21.1 and prior, a Type Confusion vulnerability can be exploited by an attacker using specially crafted .ctl files w...

AzeoTech DAQFactory CVE
MEDIUM 6.9 CVE-2026-56099

OpenBSD mpls_do_error Kernel Stack Memory Disclosure via MPLS Input_CVE-2026-56099

OpenBSD before commit 6a23123 (2026-06-18) contains an out-of-bounds read vulnerability in the mpls_do_error function within sys/netmpls/mpls_input...

openbsd src CVE
MEDIUM 5.8 CVE-2026-48983

pam_usb: TOCTOU race condition in pad directory creation allows symlink substitution_CVE-2026-48983

pam_usb provides hardware authentication for Linux using ordinary removable media. In versions prior to 0.9.2, a symlink race condition exists in p...

mcdope pam_usb < 0.9.2 CVE