Updated continuously

The signal that matters.

Cutting through advisories, vendor PSIRTs, researcher write-ups, and the underground — correlated, deduped, and ranked so your team only sees what moves the needle.

38,675stories tracked

Story velocity

6,127 sources1.7M refsLive

Endpoint Software Vu…Widely Deployed Prod…

SUSE fixes Linux kernel memory leaks in USB gadget EEM and DVB-USB m920x drivers

SUSE published fixes for two Linux kernel memory-leak vulnerabilities affecting supported enterprise and community distributions: CVE-2025-68289 in the USB gadget EEM component and CVE-2023-54266 in the media subsystem's dvb-usb m920x driver. The first flaw occurs in f_eem's eem_unwrap path, where inadequate handling of usb_ep_queue failures could leave allocated resources unreleased; SUSE rated it moderate with a CVSS v3.1 score of 5.5. The second issue affects m920x_i2c_xfer(), where an error returned by m920x_read() could trigger a memory leak; SUSE also rated that flaw moderate, assigning CVSS v3.1 4.7 and CVSS v4.0 5.7.

Timeline

2d agoSUSE updates CVE-2023-54266 page
155d agoSUSE publishes fixes for CVE-2025-68289 across multiple products

Patch & Detection Intelligence·3sources·Updated 3h ago

Latest

Identity Authenticat…Vendor Distribution…+2

python.org API flaw exposed Python release metadata to admin-level forgery

The Python Software Foundation disclosed a critical authentication bypass in the python.org release management API that could have let attackers forge administrator-level requests and modify Python release metadata. The flaw, reported by Splitline Ng of DEVCORE and confirmed by the Python Security Response Team, could have enabled changes to download and verification URLs for official Python installers, creating a path to distribute tampered files through trusted python.org infrastructure. The vulnerable logic reportedly dated back to 2014, affecting the release pipeline for more than a decade, but maintainers said post-incident forensics found no evidence of exploitation.

Patch & Detection Intelligence

5·Updated 3h ago

Widely Deployed Prod…Endpoint Software Vu…+2

SUSE Ships Broad Linux Kernel BPF Fixes for Local DoS and Privilege Bypass Flaws

SUSE has released a broad set of Linux kernel security updates addressing numerous BPF subsystem vulnerabilities that could be exploited locally with low privileges, including a permission-bypass flaw in BPF_PROG_DETACH on tcx and netkit devices tracked as CVE-2026-45932. That issue allowed unauthorized detachment of BPF programs when no program file descriptor was supplied, and was fixed by enforcing CAP_NET_ADMIN or CAP_SYS_ADMIN checks. Other patched flaws include verifier errors such as CVE-2026-43009 and CVE-2026-43030, a use-after-free in bpf_trampoline_link_cgroup_shim (CVE-2026-23319), an out-of-bounds write in devmap upper-device enumeration (CVE-2026-23359), and a nullable pointer dereference bug in map iterator callbacks (CVE-2026-43333).

Breach & Incident Intelligence

19·Updated 3h ago

Industrial Control S…Widely Deployed Prod…+1

Linux Kernel RDMA/iwcm Workqueue Corruption Flaw Patched as CVE-2026-45898

SUSE and upstream kernel maintainers disclosed CVE-2026-45898, an important Linux kernel flaw in the RDMA/iwcm subsystem that can corrupt internal workqueue lists and trigger a kernel BUG. The issue was introduced by commit e1168f0, which allowed unique struct iwcm_work items drawn from a free list to be queued more than once through unconditional queue_work() calls, creating duplicate work entries and list_del corruption under load.

Patch & Detection Intelligence

2·Updated 6h ago

9 sections hidden

Find out if you're exposed

Don't read about it. Know when it affects you.

Mallory correlates every story on this page with your attack surface (assets, vendors, identities, subsidiaries) and surfaces a small set of evidence-based cases instead of 10,000 alerts.

Start Free Trial Request a live demo

Subscribe to the digest

A daily email with top stories, new KEVs, and fresh exploits. No marketing.

Or grab the RSS feeds →