CVE-2026-63867 mptcp: close TOCTOU race while computing rcv_wnd

In the Linux kernel, the following vulnerability has been resolved: mptcp: close TOCTOU race while computing rcvwnd The MPTCP output path access locklessly the MPTCP-level ackseq in multiple times, using possibly different values for the dataack in the DSS option and to compute the announced rcv...

CVE-2026-63867 mptcp: close TOCTOU race while computing rcv_wnd

In the Linux kernel, the following vulnerability has been resolved: mptcp: close TOCTOU race while computing rcvwnd The MPTCP output path access locklessly the MPTCP-level ackseq in multiple times, using possibly different values for the dataack in the DSS option and to compute the announced rcv...

CVE-2026-63834

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tpmeter: restrict number of unacked list entries When the unackedlist is unbound, an attacker could send messages with small lengths and appropriated seqno + gaps to force the receiver to allocate more and more...

CVE-2026-63834

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tpmeter: restrict number of unacked list entries When the unackedlist is unbound, an attacker could send messages with small lengths and appropriated seqno + gaps to force the receiver to allocate more and more...

CVE-2026-63834

The CVE concerns the Linux kernel’s batman-adv tp_meter: unacked_list can be pressured to grow (via crafted small messages, seqno gaps) if the list is unbounded. The result is potential out-of-memory or high CPU usage from scanning a large unacked_list. If a limit is applied, the implementation m...

CVE-2026-63834 batman-adv: tp_meter: restrict number of unacked list entries

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tpmeter: restrict number of unacked list entries When the unackedlist is unbound, an attacker could send messages with small lengths and appropriated seqno + gaps to force the receiver to allocate more and more...

PT-2026-61391

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds write occurs in the statmount mnt idmap function. The function uses seq printf to write a mapping and manually increments seq-count to include a NUL separator. If seq...

PT-2026-61353

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The css rstat updated function, exposed as a BPF kfunc, fails to validate the cpu argument provided by the caller before using it for per-cpu rstat lookups. A BPF iter/cgroup program wit...

PT-2026-61230

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An unintended behavior in the TCP conntrack state machine allows a connection to be forced into the CLOSE state via an RST packet with an invalid sequence number. After a SYN packet is...

PT-2026-61341

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the TCP implementation where a stale per-CPU tcp tw isn variable can leak, enabling Initial Sequence Number ISN prediction. The issue occurs because the system assumes t...

PT-2026-61150

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A denial of service issue exists in the batman-adv module. An attacker can send messages with small lengths and specific sequence numbers and gaps to force the receiver to allocate an...

CVE-2026-46377

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.10.1, the escape sequence handler in Tokenizer.parseCurRune in selector/lexer/tokenize.go increments past a trailing backslash in a quoted string such as "\ or '\ and then reads...

UBUNTU-CVE-2026-46377

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.10.1, the escape sequence handler in Tokenizer.parseCurRune in selector/lexer/tokenize.go increments past a trailing backslash in a quoted string such as "\ or '\ and then reads...

CVE-2026-45133

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, when the parser is exposed to attacker-controlled input, deeply nested mappings or sequences cause both the block-level Parser::parseBlock and inline...

CVE-2025-62826

Summary: CVE-2025-62826 describes an HTTP Response Splitting (CWE-113) in Fortinet FortiOS and FortiProxy products. Affected versions: FortiOS 7.6.0–7.6.4, FortiOS 7.4 all versions, FortiOS 7.2 all versions; FortiProxy 7.6.0–7.6.4, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions. Root ca...

glib2: Fix of 4 CVEs

CVE-2026-58010: heap buffer over-read off-by-one in gvstupleisnormal in glib/gvariant-serialiser.c when checking untrusted tuple GVariant data for normal form - CVE-2026-58012: buffer over-read in gregexreplace/gregexreplaceeval when a GREGEXRAW match ends in a truncated multi-byte sequence and a...

EUVD-2026-34016

Tesla has CRLF injection in request Content-Type header via addcontenttypeparam...

USN-8526-1: libheif vulnerabilities

Xianrui Dong discovered that libheif had an out-of-bounds read in its HEIF sequence track parser. An attacker could possibly use this issue to cause a denial of service or obtain sensitive information. This issue only affected Ubuntu 26.04 LTS. CVE-2026-47254 Junyi Liu discovered that libheif had...

PYSEC-2026-3121 Out of bounds read in Tensorflow

Impact The implementation of shape inference for ReverseSequence does not fully validate the value of batchdim and can result in a heap OOB read: python import tensorflow as tf @tf.function def test: y = tf.rawops.ReverseSequence input = 'aaa','bbb', seqlengths = 1,1,1, seqdim = -10, batchdim = -...

PYSEC-2026-1814 PyJWT Issuer field partial matches allowed

Summary The wrong string if check is run for iss checking, resulting in "acb" being accepted for "abc". Details This is a bug introduced in version 2.10.0: checking the "iss" claim changed from isinstanceissuer, list to isinstanceissuer, Sequence. diff - if isinstanceissuer, list: + if...