PT-2026-81187

The CM Map Locations – Visualize and share your locations in a few clicks plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 2.1.8 via the uploadMedia function. This is due to insufficient file type validation in the upload handler, which...

CVE-2026-45404

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 0.11.0 through 1.44.0, the OpenTracing bridge's bridgeSpan contains an unsynchronized extraBaggageItems map which can cause a panic. Because Go maps are not safe for concurrent read/write access, concurrent SetBaggageItem an...

DEBIAN-CVE-2026-45404

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 0.11.0 through 1.44.0, the OpenTracing bridge's bridgeSpan contains an unsynchronized extraBaggageItems map which can cause a panic. Because Go maps are not safe for concurrent read/write access, concurrent SetBaggageItem an...

CVE-2026-45404 OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 0.11.0 through 1.44.0, the OpenTracing bridge's bridgeSpan contains an unsynchronized extraBaggageItems map which can cause a panic. Because Go maps are not safe for concurrent read/write access, concurrent SetBaggageItem an...

CVE-2026-45404 OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 0.11.0 through 1.44.0, the OpenTracing bridge's bridgeSpan contains an unsynchronized extraBaggageItems map which can cause a panic. Because Go maps are not safe for concurrent read/write access, concurrent SetBaggageItem an...

CVE-2026-45404

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 0.11.0 through 1.44.0, the OpenTracing bridge's bridgeSpan contains an unsynchronized extraBaggageItems map which can cause a panic. Because Go maps are not safe for concurrent read/write access, concurrent SetBaggageItem an...

EUVD-2026-65155

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 0.11.0 through 1.44.0, the OpenTracing bridge's bridgeSpan contains an unsynchronized extraBaggageItems map which can cause a panic. Because Go maps are not safe for concurrent read/write access, concurrent SetBaggageItem an...

CVE-2026-45404 OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 0.11.0 through 1.44.0, the OpenTracing bridge's bridgeSpan contains an unsynchronized extraBaggageItems map which can cause a panic. Because Go maps are not safe for concurrent read/write access, concurrent SetBaggageItem an...

CVE-2026-45404

OpenTelemetry-Go versions 0.11.0 through 1.44.0 contain an unsynchronized extraBaggageItems map in the OpenTracing bridge's bridgeSpan. Because Go maps are not safe for concurrent read/write access, concurrent SetBaggageItem and correlation.MapFromContext calls on the same hooked bridgeSpan can t...

CVE-2026-62377

A flaw was found in libheif, a HEIF and AVIF file format decoder and encoder. A remote attacker could provide a specially crafted HEIF sequence. Processing this malicious file could lead to a reachable assertion or dereference an empty map, resulting in a crash of the application. This...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: bpf: Exclusive maps are rejected as inner maps in map-in-map structures. An exclusive map created using exclproghash is bound to a single program by the checkmapprogcompatibility function. This function refuses to load any progra...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Fix potential AB/BA lock issue with buffermutex and mmaplock The syzbot tool detected a potential deadlock between the runtime-buffermutex and the mm-mmaplock. This issue arose due to the recent fix related to racy...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: bpf: Cancel special fields on map value recycle Map update and delete operations currently call bpfobjfreefields when a value is being replaced or recycled. This means that the destruction of special fields depends on the context...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: btrfs: fixed incorrect splitting in btrfsdropextentmaprange. In production, we encountered various WARNON messages in the extentmap code, specifically in btrfsdropextentmaprange, when we had to call addextentmapping for our secon...

SUSE CVE-2026-74640

In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: fix OOB write in fcpmeterctlget fcpioctlsetmetermap bounds the user-supplied Level Meter map size by the driver's own limit of 255 if map.mapsize 255 || map.meterslots 255 return -EINVAL; and passes it to fcpaddnewctl ...

SUSE CVE-2026-69153

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile to read an unintended source-map file by supplying an absolute or directory-traversal...

CVE-2026-74640

In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: fix OOB write in fcpmeterctlget fcpioctlsetmetermap bounds the user-supplied Level Meter map size by the driver's own limit of 255 if map.mapsize 255 || map.meterslots 255 return -EINVAL; and passes it to fcpaddnewctl ...

UBUNTU-CVE-2026-74713

In the Linux kernel, the following vulnerability has been resolved: vhostiotlb: bound map allocation in addrange vhostiotlbaddrangectx only retires an old entry when the table has a non-zero limit, has exactly reached that limit and has VHOSTIOTLBFLAGRETIRE set. Non-retiring tables can keep...

CVE-2026-74713 vhost_iotlb: bound map allocation in add_range

In the Linux kernel, the following vulnerability has been resolved: vhostiotlb: bound map allocation in addrange vhostiotlbaddrangectx only retires an old entry when the table has a non-zero limit, has exactly reached that limit and has VHOSTIOTLBFLAGRETIRE set. Non-retiring tables can keep...

CVE-2026-74640 ALSA: FCP: fix OOB write in fcp_meter_ctl_get()

In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: fix OOB write in fcpmeterctlget fcpioctlsetmetermap bounds the user-supplied Level Meter map size by the driver's own limit of 255 if map.mapsize 255 || map.meterslots 255 return -EINVAL; and passes it to fcpaddnewctl ...