VulnCheck KEV: CVE-2024-45811

Vite a frontend build tooling framework for javascript. In affected versions the contents of arbitrary files can be returned to the browser. @fs denies access to files outside of Vite serving allow list. Adding ?import&raw to the URL bypasses this limitation and returns the file content if it...

CVE-2026-89617: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate dirty page table on log replay Each DIRPAGEENTRY ends in a pagelcns array whose length is the on-disk lcnsfollow field. checkrstbl validates the table bookkeeping but never checks that this array fits in the...

PT-2026-96361

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f fs: Prevent deadlock during ep0 read loop Currently, ffs ep0 read holds ffs-mutex when it prepares to go to sleep waiting for an event. When no setup events are pending, it calls wait event interruptible exclusive...

PT-2026-90486

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference can occur in the iomap bio read folio range sync function. This happens because fs bio integrity alloc may not allocate a bio integrity payload when PI...

CVE-2026-89615: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound pagelcns index by the log record The copylcns loop and the redo shorten loop index pagelcns at j + i, where i runs up to the log record's lcnsfollow. That count is checked only against the record's own length, not...

PT-2026-96516

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound page lcns index by the log record The copy lcns loop and the redo shorten loop index page lcns at j + i, where i runs up to the log record's lcns follow. That count is checked only against the record's own length,...

CVE-2026-89616: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix info-leak on partial LZNT decompress in nireadframe nireadframe decompresses an LZNT $DATA frame into the vmapped target pages and then trusts decompresslznt's return value: uncsize = decompresslzntframeondisk,...

PT-2026-96398

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate dirty page table on log replay Each DIR PAGE ENTRY ends in a page lcns array whose length is the on-disk lcns follow field. check rstbl validates the table bookkeeping but never checks that this array fits in t...

PT-2026-90366

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the CephFS client kernel when processing CEPH MSG MDS MAP messages. The function ceph mdsmap decode in fs/ceph/mdsmap.c reads the num export targets...

PT-2026-96518

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix info-leak on partial LZNT decompress in ni read frame ni read frame decompresses an LZNT $DATA frame into the vmapped target pages and then trusts decompress lznt's return value: unc size = decompress lzntframe...

CVE-2026-88044

rclone versions 1.70.0 through 1.75.1 are affected by an authentication proxy bypass in the serve/start RC interface. The FTP and S3 constructors in cmd/serve/ftp/ftp.go and cmd/serve/s3/server.go incorrectly check the process-global proxy.Opt.AuthProxy value instead of the per-server request-loc...

CVE-2026-88014

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.0 until 1.75.1, the archive ZIP backend method Fs.readZip in backend/archive/zip/zip.go accepts archive/zip.File.Name values from an untrusted central directory and exposes...

CVE-2026-72978

Allocation of resources without limits or throttling in Active Directory Federation Services AD FS allows an unauthorized attacker to deny service over a network...

CVE-2026-72978

Active Directory Federation Services (AD FS) contains a resource allocation without limits or throttling flaw that allows an unauthorized, network-based attacker to deny service . The impact is limited to availability—no confidentiality or integrity compromise. NVD scores it 7.5 (HIGH) while Micr...

Active Directory Federation Services (AD FS) Denial of Service Vulnerability

Allocation of resources without limits or throttling in Active Directory Federation Services AD FS allows an unauthorized attacker to deny service over a network...

PT-2026-87889

Name of the Vulnerable Software and Affected Versions Active Directory Federation Services affected versions not specified Description An issue exists where resources are allocated without limits or throttling, which allows an unauthorized attacker to cause a denial of service over a network...

CVE-2026-72978: Allocation of Resources Without Limits or Throttling

Allocation of resources without limits or throttling in Active Directory Federation Services AD FS allows an unauthorized attacker to deny service over a network...

CLSA-2026-1788560472 TuxCare security update for tar-fs (3 CVEs)

TuxCare rebuilt tar-fs to address 3 CVEs. Fixed in 3.0.4-tuxcare.1...

PT-2026-90894

In the Linux kernel, the following vulnerability has been resolved: selinux: do not cancel a policy conversion that never started sel write load calls selinux policy cancel when sel make policy nodes fails, and that helper dereferences the outgoing policy to cancel its sidtab conversion. On the...

The vulnerability of the invalidate_dquots() function in the fs/quota/dquot.c file of the Linux kernel file system allows a attacker to trigger a service failure.

The vulnerability of the invalidatedquots function in the fs/quota/dquot.c file of the Linux kernel file system is related to incorrect initialization of resources. Exploiting this vulnerability could allow an attacker to cause service failures...