PT-2026-96426

In the Linux kernel, the following vulnerability has been resolved: md: do overflow check for sb-bblog shift in super 1 load In super 1 load, sb-bblog shift is an u8 type value loaded from on- disk superblock. It is used for badblocks API badblocks set by the following sequence, 1930...

PT-2026-90357

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the CIFS component. When the cifs file set size function finds a writable file handle via find writable file, it borrows tcon and server from the handle'...

Linux Distros Unpatched Vulnerability : CVE-2026-88038

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validates the cookie name a...

PT-2026-96584

In the Linux kernel, the following vulnerability has been resolved: params: fix charp corruption on allocation failure param set charp stores charp parameters in allocated memory after slab is available, and releases the previous value when the parameter is updated. The previous value is released...

PT-2026-96369

In the Linux kernel, the following vulnerability has been resolved: ecryptfs: pass packet set buffer size to parser ecryptfs parse packet set receives a pointer into the file header, but it calculates the remaining packet buffer size from PAGE SIZE - 8. For version 1 headers the packet set starts...

PT-2026-96422

In the Linux kernel, the following vulnerability has been resolved: net: dsa: realtek: use gpiod set value cansleep for reset GPIO rtl83xx reset assert and rtl83xx reset deassert are only called from the probe path, which may sleep and is not timing-critical. When the reset GPIO is provided by a...

PT-2026-96337

In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Lock the handler in ucma set ib path ucma set ib path calls ucma event handler straight from the write path, without the handler lock that keeps ctx-file stable while a uevent is queued. The handler re-reads ctx-file f...

SUSE CVE-2026-61910

An issue was discovered in Cyrus IMAP before 3.12.4. Mailbox/set let a sharee change a special-use role on shared mailboxes. An authenticated user with maySetKeywords on another user's mailbox could change that mailbox's specialuse annotation. This could allow the sharee to change the shared...

CVE-2026-88038

cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validates the cookie name and value against character sets that reject the semicolon separator, but the domain and path options are checked only against a permissiv...

DEBIAN-CVE-2026-88038

cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validates the cookie name and value against character sets that reject the semicolon separator, but the domain and path options are checked only against a permissiv...

CVE-2026-88038

cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validates the cookie name and value against character sets that reject the semicolon separator, but the domain and path options are checked only against a permissiv...

UBUNTU-CVE-2026-88038

cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validates the cookie name and value against character sets that reject the semicolon separator, but the domain and path options are checked only against a permissiv...

CVE-2026-88038 cookies vulnerable to Set-Cookie attribute injection via unvalidated domain and path options

cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validates the cookie name and value against character sets that reject the semicolon separator, but the domain and path options are checked only against a permissiv...

EUVD-2026-75398

cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validates the cookie name and value against character sets that reject the semicolon separator, but the domain and path options are checked only against a permissiv...

CVE-2026-88038

The cookies Node.js library (used by Koa via ctx.cookies) is vulnerable to Set-Cookie attribute injection (CWE-74) in versions before 0.9.2 . The domain and path options are validated against a permissive RFC 7230 field-content matcher that allows semicolons, while the cookie name and value are c...

CVE-2026-88038 cookies vulnerable to Set-Cookie attribute injection via unvalidated domain and path options

cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validates the cookie name and value against character sets that reject the semicolon separator, but the domain and path options are checked only against a permissiv...

CVE-2026-88038 cookies vulnerable to Set-Cookie attribute injection via unvalidated domain and path options

cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validates the cookie name and value against character sets that reject the semicolon separator, but the domain and path options are checked only against a permissiv...

CVE-2026-88038

cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validates the cookie name and value against character sets that reject the semicolon separator, but the domain and path options are checked only against a permissiv...

PT-2026-89366

cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validates the cookie name and value against character sets that reject the semicolon separator, but the domain and path options are checked only against a permissiv...

Ubuntu 22.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS : GNU C Library vulnerabilities (USN-8737-1)

The remote Ubuntu 22.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8737-1 advisory. It was discovered that GNU C Library had a buffer overflow in the strfmon function when handling right- justificatio...