CVE-2026-79661 Ech0 before 4.7.3 Unauthenticated fav_count Modification

Ech0 through 4.5.6 registers the PUT /api/echo/like/:id endpoint on the public router group without authentication or rate limiting. Unauthenticated attackers can increment the favcount counter of any echo including private echoes by supplying its UUID, which can be harvested from the public GET...

CVE-2026-79661: Allocation of Resources Without Limits or Throttling

Ech0 through 4.5.6 registers the PUT /api/echo/like/:id endpoint on the public router group without authentication or rate limiting. Unauthenticated attackers can increment the favcount counter of any echo including private echoes by supplying its UUID, which can be harvested from the public GET...

PT-2026-81280

Ech0 through 4.5.6 registers the PUT /api/echo/like/:id endpoint on the public router group without authentication or rate limiting. Unauthenticated attackers can increment the fav count counter of any echo including private echoes by supplying its UUID, which can be harvested from the public GET...

GO-2026-4942 Stale blob descriptor cache invalidation in github.com/distribution/distribution

In github.com/distribution/distribution and github.com/distribution/distribution/v3 before 3.1.0, when storage.cache.blobdescriptor is configured with redis and storage.delete.enabled is true, deleting a blob in one repository clears the shared digest descriptor in Redis but leaves stale...

BIT-DISTRIBUTION-2026-35172 Distribution has stale blob access resurrection via repo-scoped redis descriptor cache invalidation

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.0, distribution can restore read access in repo a after an explicit delete when storage.cache.blobdescriptor: redis and storage.delete.enabled: true are both enabled. The delete path clears the shared dige...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099762)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099762 advisory. In the Linux kernel, the following vulnerability has been resolved: dm cache policy smq: check allocation under invalidate lock commit 2d1f7b65f5de dm cache policy...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100542)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100542 advisory. In the Linux kernel, the following vulnerability has been resolved: dm cache policy smq: fix missing locks in invalidating cache blocks In passthrough mode, the...

CVE-2026-74439 iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry devicepasidtableteardown zeroes the 128-bit scalable-mode context entry with contextclearentry while the Present bit is still set. This creates a windo...

SUSE CVE-2026-14666

Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy, via plan reuse. Stale policies continue until some other event invalidates t...

CVE-2026-14666

Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy, via plan reuse. Stale policies continue until some other event invalidates t...

UBUNTU-CVE-2026-14666

Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy, via plan reuse. Stale policies continue until some other event invalidates t...

CVE-2026-14666

Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy, via plan reuse. Stale policies continue until some other event invalidates t...

Linux Distros Unpatched Vulnerability : CVE-2026-14666

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level...

CVE-2026-68330

In the Linux kernel, the following vulnerability has been resolved: net: airoha: Fix DMA direction for NPU mailbox buffer airohanpusendmsg always maps the mailbox buffer with DMATODEVICE, but some callers expect the NPU to write response data back into the same buffer: - airohanpuwlanmsgget...

CVE-2026-68168

In the Linux kernel, the following vulnerability has been resolved: afs: Fix afseditdirremove to get, not find, block 0 Fix afseditdirremove to use afsdirgetblock to get block 0 rather than afsdirfindblock as the latter caches the found block in the afsdiriter and may switch out the page it's on ...

CVE-2026-68330 net: airoha: Fix DMA direction for NPU mailbox buffer

In the Linux kernel, the following vulnerability has been resolved: net: airoha: Fix DMA direction for NPU mailbox buffer airohanpusendmsg always maps the mailbox buffer with DMATODEVICE, but some callers expect the NPU to write response data back into the same buffer: - airohanpuwlanmsgget...

CVE-2026-68330

CVE-2026-68330 relates to the Linux kernel net/airoha NPU mailbox handling. The issue arises because airoha_npu_send_msg() always maps the mailbox buffer with DMA_TO_DEVICE, while some callers expect the NPU to write the response back into the same buffer. On non‑cache‑coherent architectures (e.g...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Remove the reference to the translation cache only for the erased entry. The vgicitsinvalidatecache function iterates through the per-ITS translation cache using xaforeach, and removes the cache reference fo...

CVE-2026-64289

A flaw was found in the Linux kernel. In the iommufd component, the iommufdhwptinvalidate function allows a local user to provide excessively large values for entrynum and entrylen during cache invalidation. This can lead to a Denial of Service DoS by causing the system to become unresponsive...

CVE-2026-64289

In the Linux kernel, the following vulnerability has been resolved: iommufd: Set upper bounds on cache invalidation entrynum and entrylen iommufdhwptinvalidate takes a user-controlled entrynum and entrylen, each bounded only by U32MAX. An entrylen beyond the kernel's struct size makes the copy...