CVE-2026-73075 Vim: Out-of-bounds Access in Popup Opacity Handling

Vim is an open source, command line text editor. From 9.2.0469 until 9.2.0843, popupmarkopacityzindex in src/popupwin.c can use a negative wwinrow for a text-property-anchored popup with clipwindow and opacity, indexing before the screen array instead of accounting for wpopuptopoff and causing an...

CVE-2026-73075

CVE-2026-73075 (Vim) affects Vim versions 9.2.0469 through 9.2.0843. The issue occurs in popupwin.c: popup_mark_opacity_zindex() can use a negative w_winrow for a text-property-anchored popup with clipwindow and opacity, indexing before the screen array and leading to an out-of-bounds read and a ...

RUSTSEC-2026-0255 Panic-safety unsoundness in `Chunk`, `RingBuffer`, and `InlineArray` (use-after-free / double-free)

Several methods in sized-chunks drop elements before updating the length/boundary metadata. If an element's Drop panics during the drop, the metadata update is skipped, so the container still treats the already-dropped elements as live. When the container's own Drop runs, those elements are visit...

CVE-2026-15567

A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an attacker-controlled length field without bounds checking and attempts to allocate a byte array of that size...

CVE-2026-73141

A flaw was found in svxlink's audio decoders. A variable-length array on the stack is sized using an attacker-controlled encoded-frame length field received over the network. By sending a frame with an excessively large length value, a remote attacker can exhaust the stack, resulting in a denial ...

CVE-2026-15567

A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an attacker-controlled length field without bounds checking and attempts to allocate a byte array of that size...

CVE-2026-15567 Wildfly: wildfly-iiop: wildfly-jacorb: wildfly: pre-auth denial of service on the iiop listener

A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an attacker-controlled length field without bounds checking and attempts to allocate a byte array of that size...

CVE-2026-15567

A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an attacker-controlled length field without bounds checking and attempts to allocate a byte array of that size...

drm/i915/gem: Do not leak siblings[] on proto context error

...

PT-2026-70250

Name of the Vulnerable Software and Affected Versions Vim versions 9.2.0469 through 9.2.0842 Description The popup mark opacity zindex function in src/popupwin.c can use a negative w winrow for a text-property-anchored popup with clipwindow and opacity. This leads to indexing before the screen...

CVE-2026-68376

In the Linux kernel, the following vulnerability has been resolved: sctp: fix authhmacs array size in struct sctpcookie The authhmacs array in struct sctpcookie is supposed to store a complete SCTPAUTHHMACALGO parameter, which consists of a struct sctpparamhdr followed by N HMAC identifiers...

CVE-2026-68232

In the Linux kernel, the following vulnerability has been resolved: drm/gpusvm: Fix MM reference leak in drmgpusvmrangeevict If kvmallocarray fails in drmgpusvmrangeevict, the MM reference acquired earlier is not released, resulting in a reference leak. Fix this by dropping the MM reference on th...

CVE-2026-68244

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Do not leak siblings on proto context error After a successful BALANCE/PARALLELSUBMIT extension on context creation, error during processing of next user extension leaks the siblings array. Fix that. Discovered usin...

CVE-2026-68154

In the Linux kernel, the following vulnerability has been resolved: libceph: reject zero bucket types in crushdecode CRUSH bucket type 0 is reserved for devices. The mapper relies on that invariant and uses type 0 to identify leaf devices. If crushdecode accepts a bucket with type 0, a malformed...

UBUNTU-CVE-2026-68244

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Do not leak siblings on proto context error After a successful BALANCE/PARALLELSUBMIT extension on context creation, error during processing of next user extension leaks the siblings array. Fix that. Discovered usin...

CVE-2026-68147

In the Linux kernel, the following vulnerability has been resolved: fscrypt: Avoid dynamic allocation in fscryptgetdevices When a blkcryptokey starts being used or is evicted, fs/crypto/ calls fscryptgetdevices to get the filesystem's list of block devices, then iterates over them and calls...

CVE-2026-68325 iommu/amd: Bound the early ACPI HID map

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Bound the early ACPI HID map The ivrsacpihid command-line parser appends entries to a fixed four-element earlyacpihidmap array. Unlike the sibling IOAPIC and HPET parsers, it does not reject a fifth entry before...

CVE-2026-68262

CVE-2026-68262 affects the Linux kernel’s drm/imagination: pvr_set_uobj_array() mishandles the destination user array stride when copying kernel objects to userspace. The code previously advanced the userspace pointer by the kernel object size while advancing the kernel pointer by the userspace s...

CVE-2026-68262 drm/imagination: Fix user array stride in pvr_set_uobj_array()

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fix user array stride in pvrsetuobjarray pvrsetuobjarray copies an array of kernel objects to a userspace array whose element size is described by out-stride. When out-stride is different from the kernel object...

EUVD-2026-55356

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: bound EDID block reads to the response buffer virtiogetedidblock validates the read offset only against the device-supplied resp-size field, never against the fixed-size resp-edid array. The EDID block index is driven...