CVE-2026-64496

In the Linux kernel, the following vulnerability has been resolved: iio: event: Fix event FIFO reset race iioeventgetfd creates the event file descriptor with anoninodegetfd, which allocates a new fd, creates the anonymous file and installs it in the process fd table before returning to the calle...

EUVD-2026-48840

In the Linux kernel, the following vulnerability has been resolved: iio: event: Fix event FIFO reset race iioeventgetfd creates the event file descriptor with anoninodegetfd, which allocates a new fd, creates the anonymous file and installs it in the process fd table before returning to the calle...

CVE-2026-64496 iio: event: Fix event FIFO reset race

In the Linux kernel, the following vulnerability has been resolved: iio: event: Fix event FIFO reset race iioeventgetfd creates the event file descriptor with anoninodegetfd, which allocates a new fd, creates the anonymous file and installs it in the process fd table before returning to the calle...

CVE-2026-64496

The CVE-2026-64496 issue affects the Linux kernel IIO event (iio: event) where a race between kfifo_to_user and kfifo_reset_out could lead to an out-of-bounds read and leakage of kernel memory to userspace. Root cause: iio_event_getfd() uses anon_inode_getfd() to allocate and install a new FD, th...

Linux Distros Unpatched Vulnerability : CVE-2026-64496

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iio: event: Fix event FIFO reset race iioeventgetfd creates the event file descriptor with anoninodegetfd, which allocates a new fd, creates the anonymous file...

PT-2026-64762

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.2 Description A missing authorization issue exists in the 'POST /mcp' kernel endpoint, which is only protected by a general authentication check model.CheckAuth without enforcing admin roles or read-only...

CVE-2026-21723

A flaw was found in Grafana. A remote attacker with very low privileges, or even anonymous access if enabled, can exploit the alertmanager templates test endpoint by mass-executing templates. This can lead to an Out-Of-Memory OOM error, causing the Grafana service to crash and resulting in a Deni...

SUSE CVE-2026-21723

The alertmanager templates test endpoint /api/alertmanager/grafana/config/api/v1/templates/test can execute templates with no memory limits. Mass-executing templates in a short period causes OOM and crashes the Grafana service. The endpoint requires very low privileges and is exploitable with...

CVE-2026-21723

The alertmanager templates test endpoint /api/alertmanager/grafana/config/api/v1/templates/test can execute templates with no memory limits. Mass-executing templates in a short period causes OOM and crashes the Grafana service. The endpoint requires very low privileges and is exploitable with...

CVE-2026-21723 CVE-2026-21723 Record

The alertmanager templates test endpoint /api/alertmanager/grafana/config/api/v1/templates/test can execute templates with no memory limits. Mass-executing templates in a short period causes OOM and crashes the Grafana service. The endpoint requires very low privileges and is exploitable with...

CVE-2026-21723 CVE-2026-21723 Record

The alertmanager templates test endpoint /api/alertmanager/grafana/config/api/v1/templates/test can execute templates with no memory limits. Mass-executing templates in a short period causes OOM and crashes the Grafana service. The endpoint requires very low privileges and is exploitable with...

CVE-2026-21723

CVE-2026-21723 affects Grafana, specifically the alertmanager templates test endpoint at /api/alertmanager/grafana/config/api/v1/templates/test. The endpoint can execute templates with no memory limits, and mass execution in a short time can cause out-of-memory (OOM) and crash the Grafana service...

EUVD-2026-47869

The alertmanager templates test endpoint /api/alertmanager/grafana/config/api/v1/templates/test can execute templates with no memory limits. Mass-executing templates in a short period causes OOM and crashes the Grafana service. The endpoint requires very low privileges and is exploitable with...

PT-2026-63565

Name of the Vulnerable Software and Affected Versions Grafana affected versions not specified Description The alertmanager templates test endpoint '/api/alertmanager/grafana/config/api/v1/templates/test' allows the execution of templates without memory limits. Sending a large volume of template...

I2P 2.13.0

I2P is an anonymizing network, offering a simple layer that identity-sensitive applications can use to securely communicate. All data is wrapped with several layers of encryption, and the network is both distributed and dynamic, with no trusted parties. This is the source code release version...

DRUPAL-CONTRIB-2026-082

This module enables you to add autocomplete suggestions for search forms created with the Search API module. The module ships with a test script that is accessible to anonymous users and doesn't sufficiently validate user input, leading to a Cross Site Scripting vulnerability. This vulnerability ...

SUSE CVE-2026-64131

In the Linux kernel, the following vulnerability has been resolved: mm/memory: fix spurious warning when unmapping device-private/exclusive pages Device private and exclusive entries are only supported for anonymous folios. This condition is tested in migratedevicepages and makedeviceexclusive...

CVE-2026-64131

A flaw was found in the Linux kernel's memory management subsystem. The unmapping process for device-private and exclusive memory pages incorrectly checks if a virtual memory area VMA is anonymous. This can lead to spurious warnings during process teardown when a folio is part of a private...

EUVD-2026-44673

Directus: Authorization-dependent response served from unsegmented cache key...

GHSA-C6W9-5G5J-JH2P Directus: Authorization-dependent response served from unsegmented cache key

Summary When response caching is enabled CACHEENABLED=true, the cache-key derivation in api/src/utils/get-cache-key.ts includes only version, path, query, and accountability.user plus a conditional ip. Authorization context beyond user share, role, roles, admin, app, policies is not part of the...