PT-2026-86197

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists when processing VLAN-tagged frames where the transport header is incorrectly set. In the packet parse headers function, skb set network header is called to advance the...

Linux Distros Unpatched Vulnerability : CVE-2026-80799

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers nfcllcpparsegbtlv and nfcllcpparseconnectiontlv contain three related bugs in their TLV parsing loops:...

CVE-2026-85093: Incorrect Authorization

Cheshire Cat AI's GET /memory/collections/collectionid/points endpoint fails to apply per-user filtering when retrieving episodic memory points. Authenticated attackers with MEMORY:READ permission can retrieve all users' stored conversation messages and personal data by paginating through the...

The vulnerability of the tegra_hte_map_to_line_id() function in the drivers/hte/hte-tegra194.c module of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the tegrahtemaptolineid function in the drivers/hte/hte-tegra194.c module of the Linux operating system is related to a single-shift offset error. Exploiting this vulnerability could allow an attacker to cause a service failure...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-105550)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-105550 advisory. In the Linux kernel, the following vulnerability has been resolved: cifs: validate DFS referral string offsets parsedfsreferrals validates that the response header a...

CVE-2026-53670

PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, in the Prevail eBPF verifier, EbpfTransformer::add silently skips offset-variable updates when the destination register carries a non-singleton typeset two or more simultaneously possible...

CVE-2026-53670

PREVAIL , a polynomial-runtime eBPF verifier using an abstract interpretation layer, is vulnerable to a verifier bypass prior to version 0.2.4 . In the EbpfTransformer::add() function, offset-variable updates are silently skipped when the destination register carries a non-singleton typeset (two ...

EUVD-2026-70244

PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, in the Prevail eBPF verifier, EbpfTransformer::add silently skips offset-variable updates when the destination register carries a non-singleton typeset two or more simultaneously possible...

CVE-2026-53670 PREVAIL: Non-singleton typeset in add() skips offset update, allowing OOB access to pass eBPF verification

PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, in the Prevail eBPF verifier, EbpfTransformer::add silently skips offset-variable updates when the destination register carries a non-singleton typeset two or more simultaneously possible...

CVE-2026-53670 PREVAIL: Non-singleton typeset in add() skips offset update, allowing OOB access to pass eBPF verification

PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, in the Prevail eBPF verifier, EbpfTransformer::add silently skips offset-variable updates when the destination register carries a non-singleton typeset two or more simultaneously possible...

CVE-2026-53670 PREVAIL: Non-singleton typeset in add() skips offset update, allowing OOB access to pass eBPF verification

PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, in the Prevail eBPF verifier, EbpfTransformer::add silently skips offset-variable updates when the destination register carries a non-singleton typeset two or more simultaneously possible...

PT-2026-84840

PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, in the Prevail eBPF verifier, EbpfTransformer::add silently skips offset-variable updates when the destination register carries a non-singleton typeset two or more simultaneously possible...

Exploit for Out-of-bounds Write in Fortinet Fortiproxy

FortiGate SSL-VPN kit recovered in the wild Research arch...

SUSE CVE-2026-72135

In the Linux kernel, the following vulnerability has been resolved: tpm: Make the TPM character devices non-seekable The TPM character devices expose a sequential command/response interface, but their open handlers leave FMODEPREAD and FMODEPWRITE enabled. After a command leaves a response pendin...

CVE-2026-80700

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate external BO copy bounds for both stride paths vmwexternalbocopy trusts caller-supplied offsets, strides, and heights and operates on imported dma-buf vmaps: - The equal-stride memcpy bound was clamped after...

EUVD-2026-66495

In the Linux kernel, the following vulnerability has been resolved: fbdev: bound mode sysfs output to the sysfs buffer modestring uses snprintf which can return a value larger than the remaining buffer space. showmodes accumulates the return value into i without checking whether i has reached...

SUSE CVE-2026-72021

In the Linux kernel, the following vulnerability has been resolved: ipvs: use parsed transport offset in SCTP state lookup setsctpstate reads the SCTP chunk header again in order to drive the IPVS SCTP state table. For IPv6 it computes the offset with sizeofstruct ipv6hdr, while the surrounding...

curl: 36: HTTP upload resume offset consumed twice after early 307/308 redirect

Summary A read-backed HTTP POST using CURLOPTRESUMEFROMLARGE with a non-seekable source silently uploads the wrong data when the server returns a 307 or 308 redirect before the request body is sent. curleasyperform returns CURLEOK, so the caller cannot detect the substitution. The bug is in...

CVE-2026-13479

CVE-2026-13479 is an out-of-bounds read in the LoRaWAN clock-synchronization service of Zephyr RTOS (subsys/lorawan/services/clock_sync.c). When processing the CLOCK_SYNC_CMD_APP_TIME (AppTimeAns) downlink, the handler reads a 4-byte time correction and 1-byte token without verifying that 5 bytes...

EUVD-2026-66555

The LoRaWAN application-layer clock-synchronization service parses downlinks in clocksyncpackagecallback subsys/lorawan/services/clocksync.c. Its command loop only guarantees that the one-byte command id is in bounds; for the CLOCKSYNCCMDAPPTIME AppTimeAns command the handler then reads a 4-byte...