CVE-2026-49292

Kiwi TCMS is an open source test management system. Prior to 16.0, the unauthenticated /init-db/ page handled by InitDBView in tcms/core/views.py remains reachable after initial setup and proxies repeated requests to Kiwi/manage.py migrate. The migration command is reentrant, so repeated access...

CVE-2026-49292 Kiwi TCMS: The /init-db/ page renders and responds to requests after first use

Kiwi TCMS is an open source test management system. Prior to 16.0, the unauthenticated /init-db/ page handled by InitDBView in tcms/core/views.py remains reachable after initial setup and proxies repeated requests to Kiwi/manage.py migrate. The migration command is reentrant, so repeated access...

EUVD-2026-82384

Kiwi TCMS is an open source test management system. Prior to 16.0, the unauthenticated /init-db/ page handled by InitDBView in tcms/core/views.py remains reachable after initial setup and proxies repeated requests to Kiwi/manage.py migrate. The migration command is reentrant, so repeated access...

CVE-2026-49292 Kiwi TCMS: The /init-db/ page renders and responds to requests after first use

Kiwi TCMS is an open source test management system. Prior to 16.0, the unauthenticated /init-db/ page handled by InitDBView in tcms/core/views.py remains reachable after initial setup and proxies repeated requests to Kiwi/manage.py migrate. The migration command is reentrant, so repeated access...

PT-2026-93449

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/amdkfd component where the driver allocates device pages even when the migration virtual memory range is a hole on the CPU side specifically when MIGRATE PFN...

PT-2026-93446

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm pagemap migrate populate ram pfn function when populating RAM PFNs with higher-order folios. The problem consists of two main parts: first, higher-order vma...

PT-2026-93608

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds write occurs in the migrate device range and migrate device pfns functions. This happens when a compound folio extends beyond the end of the range provided by the caller...

Duplicate Advisory: Vikunja: Unbounded CSV row cardinality permits API process termination

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-pqf9-h8g4-8gmh. This link is maintained to preserve external references. Original Description vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the POST /api/v2/migration/csv/migrate...

CVE-2026-91969

vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the POST /api/v2/migration/csv/migrate endpoint that fails to limit parsed row cardinality. Authenticated attackers can upload multipart CSV files with millions of tiny records to exhaust process memory and terminate the...

CVE-2026-91969

vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the POST /api/v2/migration/csv/migrate endpoint that fails to limit parsed row cardinality. Authenticated attackers can upload multipart CSV files with millions of tiny records to exhaust process memory and terminate the...

CVE-2026-91969

vikunja versions before 2.6.0 are affected by a resource exhaustion vulnerability in the POST /api/v2/migration/csv/migrate endpoint, which fails to limit the cardinality of parsed CSV rows. An authenticated attacker can upload a multipart CSV file containing millions of tiny records, exhausting ...

CVE-2026-91969: Uncontrolled Resource Consumption

vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the POST /api/v2/migration/csv/migrate endpoint that fails to limit parsed row cardinality. Authenticated attackers can upload multipart CSV files with millions of tiny records to exhaust process memory and terminate the...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: ext4: fixed the idatasem unlock order in ext4indmigrate Fuzzing reported a potential deadlock in jbd2logwaitcommit. This issue occurs when the EXT4IOCMIGRATE ioctl is set to require synchronous updates because the file...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: clocksource: Use migratedisable to avoid calling getrandomu32 in an atomic context. The following bug report occurred with the PREEMPTRT kernel: - Bug: A sleeping function was called from an invalid context at...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerabilities have been resolved: zsmalloc: Fixed races between asynchronous zspage free operations and page migration. The asynchronous zspage free worker attempts to lock the entire page list of a zspage, without protecting against page migration. Since page...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerabilities have been resolved: Nilfs2: Fixed a hang issue in nilfslookupdirtydatabuffers. Syzbot reported a hang issue in migratepagesbatch, called by mbind, and nilfslookupdirtydatabuffers, called in the log writer of nilfs2. While migratepagesbatch locks ...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: migrate: corrected lock ordering for hugetlb file folio operations Syzbot has identified a deadlock analyzed by Lance Yang: 1 Task 5749: Holds foliolock, then attempts to acquire immaprwsem read lock. 2 Task 5754: Holds...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fixed a NULL pointer dereference in svmmigratetoram. ./drivers/gpu/drm/amd/amdkfd/kfdmigrate.c:985:58-62: Error: p is NULL, but it was dereferenced...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: TCP: Fixed issues related to data races around sysctltcpmigratereq. When reading sysctltcpmigratereq, it can be changed concurrently. Therefore, we need to add READONCE to its readers...

SUSE CVE-2026-89756

In the Linux kernel, the following vulnerability has been resolved: mm/migrate: report RCU-tasks quiescent states in migratepagesbatch migratepagesbatch unmaps each folio before moving it, and every unmap runs the mmunotifier invalidate callbacks. On KVM hosts trytomigrate ends up in...