CVE-2026-89713 NFSD: check truncate permission under inode lock

In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsdsetattr checks whether a size update needs NFSDMAYTRUNC before it takes inodelock. The comparison uses the file size sampled by that unlocked read, but the actual ATTRSIZE upda...

EUVD-2026-76625

In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsdsetattr checks whether a size update needs NFSDMAYTRUNC before it takes inodelock. The comparison uses the file size sampled by that unlocked read, but the actual ATTRSIZE upda...

PT-2026-90429

In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsd setattr checks whether a size update needs NFSD MAY TRUNC before it takes inode lock. The comparison uses the file size sampled by that unlocked read, but the actual ATTR SIZE...

CVE-2026-89713: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsdsetattr checks whether a size update needs NFSDMAYTRUNC before it takes inodelock. The comparison uses the file size sampled by that unlocked read, but the actual ATTRSIZE upda...

GHSA-535W-7CP7-47Q4 multer vulnerable to Denial of Service via oversized array index in field names

Impact multer is vulnerable to a Denial of Service DoS via a crafted array index in multipart field names. The append-field dependency parses bracket notation in field names, and a large numeric index such as items4294967294 forces allocation of a maximum-length sparse array. A following field wi...

CVE-2026-80898

In the Linux kernel, the following vulnerability has been resolved: netfs: clear PGprivate2 on copy-to-cache append failure netfspgpriv2copytocache marks the folio with PGprivate2 before netfspgpriv2copyfolio appends it to the copy-to-cache rolling buffer. If the append fails, the folio is not...

CVE-2026-80898

In the Linux kernel, the following vulnerability has been resolved: netfs: clear PGprivate2 on copy-to-cache append failure netfspgpriv2copytocache marks the folio with PGprivate2 before netfspgpriv2copyfolio appends it to the copy-to-cache rolling buffer. If the append fails, the folio is not...

EUVD-2026-71648

In the Linux kernel, the following vulnerability has been resolved: netfs: clear PGprivate2 on copy-to-cache append failure netfspgpriv2copytocache marks the folio with PGprivate2 before netfspgpriv2copyfolio appends it to the copy-to-cache rolling buffer. If the append fails, the folio is not...

CVE-2026-80898

CVE-2026-80898 affects the Linux kernel netfs subsystem. In netfs_pgpriv2_copy_to_cache(), a folio is marked with PG_private_2 before being appended to the copy-to-cache rolling buffer by netfs_pgpriv2_copy_folio(). If the append fails, the folio is not queued for cache writeback, yet the PG_priv...

CVE-2026-84966 BSON element injection via NUL-embedded document keys in builder append

An incorrect numeric type conversion in the BSON document building component of the MongoDB C++ Driver may cause a length value to be interpreted incorrectly. When an application supplies an extremely large, non-terminated field name to the builder, the library may read memory outside the intende...

CVE-2026-84966 BSON element injection via NUL-embedded document keys in builder append

An incorrect numeric type conversion in the BSON document building component of the MongoDB C++ Driver may cause a length value to be interpreted incorrectly. When an application supplies an extremely large, non-terminated field name to the builder, the library may read memory outside the intende...

Linux Distros Unpatched Vulnerability : CVE-2026-5079

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Impact: multer versions 1.0.0 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service via deeply nested field names in multipart form data. The...

Linux Distros Unpatched Vulnerability : CVE-2026-77650

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency...

CVE-2026-77078: Uncaught Exception

multer is a middleware for handling multipart/form-data in Node.js. A small multipart request containing two specially crafted text field names can cause an uncaught RangeError Invalid array length that terminates the Node.js process. The first field uses a very large numeric array index to...

CVE-2026-68766

A flaw was found in hashcat. This vulnerability allows an attacker to inject malicious command-line options when parsing restore files. By crafting a specially designed restore file, an attacker can append arbitrary content to files, potentially leading to arbitrary code execution on the system...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: In the net subsystem, the function skbAppendPageFrags should no longer check the pfmemalloc status. The skbAppendPageFrags function is currently used by the afunix and udp.sendpage implementations. In commit 326140063946 “TCP: TX...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerabilities have been resolved: l2tp: The correct message length must be passed to ip6.AppendData. l2tpip6sendmsg needs to avoid accounting for the transport header twice when splicing more data into an already partially-occupied skbuff. To address this issu...

CVE-2026-77650

The append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution...

UBUNTU-CVE-2026-77650

The append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution...

CVE-2026-77650

The append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution...