CVE-2026-64386 smb: client: fix query_info() replay double-free

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix queryinfo replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2queryinfoinit fails before the next send, cleanup retains the previous buffer type and...

CVE-2026-64386

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix queryinfo replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2queryinfoinit fails before the next send, cleanup retains the previous buffer type and...

CVE-2026-64386 smb: client: fix query_info() replay double-free

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix queryinfo replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2queryinfoinit fails before the next send, cleanup retains the previous buffer type and...

CVE-2026-64386

CVE-2026-64386 : In the Linux kernel SMB client, a replayable error could free the prior response buffer when SMB2_query_info_init() fails before the next send, causing a double-free. The fix resets response bookkeeping before each attempt to prevent stale frees. Affected component is the SMB cli...

Linux Distros Unpatched Vulnerability : CVE-2026-64397

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ksmbd: serialize QUERYDIRECTORY requests per file smb2querydir stores a pointer to its stack- allocated private data in the ksmbdfile readdirdata. Concurrent...

PT-2026-64607

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A double-free issue exists in the SMB client. A response-bearing attempt can return a replayable error and free its response buffer. If the SMB2 query info init function fails before the...

PT-2026-64618

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the ksmbd module, the smb2 query dir function stores a pointer to stack-allocated private data within the ksmbd file readdir data. When concurrent QUERY DIRECTORY requests use the sam...

Linux Distros Unpatched Vulnerability : CVE-2026-64387

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb: client: fix query directory replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If...

PT-2026-64608

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A double-free issue exists in the SMB client. A response-bearing attempt may return a replayable error and free its response buffer. If the SMB2 query directory init function fails befor...

Linux Distros Unpatched Vulnerability : CVE-2026-64386

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb: client: fix queryinfo replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2queryinfoinit fails...

GHSA-PMPG-2MXQ-6XWR Budibase: NoSQL injection in MongoDB integration: collection dump, $where JS exec, cross-collection pivot, arbitrary update/delete

Summary An end-user injection in Budibase's MongoDB datasource lets any BASIC app user bypass the builder's query-level access controls. Builders scope MongoDB reads per-user with bindings like "email": " currentUser.email " so each app user only sees their own rows. Because the binding is...

GHSA-2XGG-R2WC-C5R2 Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector

Summary This is a related but independently fixable vulnerability to GHSA-qqf5-x7mj-v43p PostgreSQL SQL injection, reported in the same original disclosure and split per GitHub CNA guidance rule 4.2.11 since it affects a separate integration, has a distinct attack precondition, and requires a...

Improper Neutralization of Special Elements in Data Query Logic

Overview @budibase/string-templates is a Handlebars wrapper for Budibase templating. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic in the enrichContext process. An attacker can gain unauthorized access to sensitive data, modify...

Improper Neutralization of Special Elements in Data Query Logic

Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic in the enrichContext process. An attacker can gain unauthorized access to sensitive data, modify or delete arbitrary documents, an...

GHSA-QW6M-8FW2-2V64 Budibase: NoSQL Injection via JSON Parameter Interpolation in MongoDB Query Execution

Summary Budibase's MongoDB query execution endpoint POST /api/v2/queries/:queryId is vulnerable to NoSQL injection through user-supplied query parameters. The enrichContext function interpolates parameter values into JSON query templates using Handlebars with noEscaping: true, then parses the...

EUVD-2026-42636

Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream X-User-Id header and wsterminal sessionid query injection...

GO-2026-5069 Fiber: Cache middleware key generator ignores query string in github.com/gofiber/fiber

Fiber: Cache middleware key generator ignores query string in github.com/gofiber/fiber...

Information Exposure

Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Information Exposure via error messages generated during GraphQL validation and input-coercion. An attacker can obtain...

GHSA-H3RM-78G3-J7CP @better-auth/stripe: cross-organization billing tampering in organization subscription actions

Am I affected? You are affected if all of these are true: - You use @better-auth/stripe from version 1.4.11 up to a patched version below. This covers the stable line through 1.6.20 and every 1.7.0 beta through 1.7.0-beta.9. - The Stripe plugin has subscriptions turned on subscription.enabled:...

CVE-2026-66009

Parse Server versions = 9.0.0 before 9.10.0-alpha.5 and = 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled graphQLPublicIntrospection: false, the default. A client holding only the public application id ...