SUSE CVE-2026-80734

In the Linux kernel, the following vulnerability has been resolved: btrfs: initialize inode mapping flags for cached inodes BUG When running generic/795 with 8K block size, 4K page size, the test always fails, triggering some ASSERTs related to folio size: 795 241074: dropcaches: 3 assertion...

CVE-2026-80734

CVE-2026-80734 affects the btrfs filesystem in the Linux kernel . When a btrfs inode is evicted from the page cache under memory pressure and subsequently re-looked up via btrfs_iget(), the code path that reuses a previously cached delayed_node skips calls to btrfs_update_inode_mapping_flags() an...

CVE-2026-80734 btrfs: initialize inode mapping flags for cached inodes

In the Linux kernel, the following vulnerability has been resolved: btrfs: initialize inode mapping flags for cached inodes BUG When running generic/795 with 8K block size, 4K page size, the test always fails, triggering some ASSERTs related to folio size: 795 241074: dropcaches: 3 assertion...

CVE-2026-80734 btrfs: initialize inode mapping flags for cached inodes

In the Linux kernel, the following vulnerability has been resolved: btrfs: initialize inode mapping flags for cached inodes BUG When running generic/795 with 8K block size, 4K page size, the test always fails, triggering some ASSERTs related to folio size: 795 241074: dropcaches: 3 assertion...

PT-2026-84932

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the btrfs file system where cached inodes may not have their mapping flags and minimal folio order properly initialized. This occurs when an inode is evicted due to...

EUVD-2026-70140

Jenkins Performance Plugin 1015.v09ca52b3370e and earlier does not restrict the classes that can be instantiated when deserializing cached performance reports stored in the build directory on the Jenkins controller, allowing attackers with Item/Configure permission to execute arbitrary code on th...

CVE-2026-84670

Jenkins Performance Plugin 1015.v09ca52b3370e and earlier does not restrict the classes that can be instantiated when deserializing cached performance reports stored in the build directory on the Jenkins controller, allowing attackers with Item/Configure permission to execute arbitrary code on th...

HTTP Request Smuggling

Overview org.webjars.npm:hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to HTTP Request Smuggling in its query parsing helpers, which do not terminate at the URL fragment and parse a ? appearing after a as the start of the query string. An attack...

SUSE CVE-2026-72218

In the Linux kernel, the following vulnerability has been resolved: lockd: Plug nlmfile refcount leak on cached nlmdofopen failure The cached-file path in nlmlookupfile reaches the found: label unconditionally, even when nlmdofopen fails. At that label result and file-fcount are updated before th...

DRUPAL-CONTRIB-2026-111

This module enables you to disable access to the /user/login form unless a secret key is provided. The module does not invalidate the relevant caches when login page access restrictions are enabled. As a result, previously cached login page responses may remain accessible until caches are cleared...

PT-2026-82036

Cloudreve has Broken Access Control - Revoked Share Access Still Allows Signed File URL Generation via Cached context hint in github.com/cloudreve/Cloudreve...

EulerOS Virtualization 2.13.1 : unbound (EulerOS-SA-2026-3203)

According to the versions of the unbound packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability when handling replies with very large RRsets that Unboun...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: nfsd: Fixed the handling of cached open files in the nfsd4open code path. The commit fb70bf124b05 “NFSD: Instantiate a struct file when creating a regular NFSv4 file” added the ability to cache an open file descriptor across...

GHSA-5CWR-5JXG-PCF6 Winter: Stored XSS through cached Brand Settings and Editor Settings custom styles

Impact Users with the backend.managebranding "Customize the back-end" or backend.manageeditor "Manage global code editor preferences" permission can provide custom CSS through Settings → Customize Backend → Styles or Settings → Editor Settings → Markup Styles that is compiled through the LESS CSS...

PT-2026-79976

Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy, via plan reuse. Stale policies continue until some other event invalidates t...

CVE-2026-74791

Scriban before 7.0.0 fails to clear the CachedTemplates dictionary when TemplateContext.Reset is called, allowing cached templates to persist across reused contexts. Attackers can exploit request-dependent ITemplateLoader implementations to access previously authorized template content from earli...

CVE-2026-74791

Scriban before 7.0.0 fails to clear the CachedTemplates dictionary when TemplateContext.Reset is called, allowing cached templates to persist across reused contexts. Attackers can exploit request-dependent ITemplateLoader implementations to access previously authorized template content from earli...

CVE-2026-74791 Scriban before 7.0.0 Authorization Bypass via Stale Include Cache

Scriban before 7.0.0 fails to clear the CachedTemplates dictionary when TemplateContext.Reset is called, allowing cached templates to persist across reused contexts. Attackers can exploit request-dependent ITemplateLoader implementations to access previously authorized template content from earli...

CVE-2026-74791 Scriban before 7.0.0 Authorization Bypass via Stale Include Cache

Scriban before 7.0.0 fails to clear the CachedTemplates dictionary when TemplateContext.Reset is called, allowing cached templates to persist across reused contexts. Attackers can exploit request-dependent ITemplateLoader implementations to access previously authorized template content from earli...

CVE-2026-72431

In the Linux kernel, the following vulnerability has been resolved: alloctag: fix use-after-free in /proc/allocinfo after module unload allocinfostart only reinitializes the codetag iterator at position 0. For subsequent reads position 0, it reuses cached iterator state from the previous batch...