CVE-2026-80804

In the Linux kernel, the following vulnerability has been resolved: xfs: restore nofs context unconditionally in xfstransroll When xfstranscommit fails in xfstransroll, the NOFS context is cleared but only restored in the success path. This leaves the error path without nofs protection, causing a...

CVE-2026-80804 xfs: restore nofs context unconditionally in xfs_trans_roll

In the Linux kernel, the following vulnerability has been resolved: xfs: restore nofs context unconditionally in xfstransroll When xfstranscommit fails in xfstransroll, the NOFS context is cleared but only restored in the success path. This leaves the error path without nofs protection, causing a...

CVE-2026-74236 GFI Exinda AI / ClearView < 7.6.5 Path Traversal via Diagnostic File Deletion Handler

GFI Exinda AI and ClearView before 7.6.5 contains a path traversal vulnerability in the diagnostic file deletion handler. The unlinkoremailfile function accepts parameters prefixed with vfilerow and appends their values directly to a base directory path without sanitizing for directory traversal...

RLSA-2026:63013 Important: kernel-rt security, bug fix, and enhancement update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fixes: kernel: s390/cpumsf: Handle CPU hotplug remove during sampling CVE-2024-57849 kernel: smc91x: fix broken irq-context in PREEMPTRT...

BIT-NIFI-2024-45477 Apache NiFi: Improper Neutralization of Input in Parameter Description

Apache NiFi 1.10.0 through 1.27.0 support a description field for Parameters in a Parameter Context configuration that is vulnerable to cross-site scripting. An authenticated user, authorized to configure a Parameter Context, can enter arbitrary JavaScript code, which the client browser will...

PT-2026-91341

In the Linux kernel, the following vulnerability has been resolved: gtp: serialize PDP context updates PDP contexts can be deleted through GTP CMD DELPDP or while the GTP network device is being unregistered. The latter is serialized by RTNL, but the generic-netlink delete path only holds RCU...

Linux Distros Unpatched Vulnerability : CVE-2026-80851

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gtp: serialize PDP context updates PDP contexts can be deleted through GTPCMDDELPDP or while the GTP network device is being unregistered. The latter is...

PT-2026-85645

In the Linux kernel, the following vulnerability has been resolved: xfs: restore nofs context unconditionally in xfs trans roll When xfs trans commit fails in xfs trans roll, the NOFS context is cleared but only restored in the success path. This leaves the error path without nofs protection,...

PT-2026-85720

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the bridge multicast component of the Linux kernel. The problem occurs during the teardown of a master VLAN's multicast context. Specifically, the br...

CONTINUITY: Security-Context Contracts for Composable LLM Agent Controls

LLM agent systems increasingly combine provenance tracking, authorization, policy enforcement, protocol adapters, and execution controls. However, individually correct security mechanisms do not necessarily compose into an end-to-end secure system: security-critical context may be dropped, widene...

CVE-2026-18489: Exposure of Data Element to Wrong Session

IBM ContextForge MCP Gateway - Translate utility = 1.0.8 MCP Context Forge could allow a remote attacker to obtain sensitive information from other sessions due to exposure of data elements to the wrong session...

CVE-2026-85654: Improper Neutralization of Special Elements Used in a Template Engine

Improper neutralization of special elements used in a template engine in the CDK generator in Amazon awslabs.dynamodb-mcp-server before 2.1.6 might allow a context-dependent actor to execute arbitrary code on the host that deploys the generated application via crafted table, index, or attribute...

CVE-2026-74235: Improper Limitation of a Pathname to a Restricted Directory

GFI Exinda AI and ClearView before 7.6.5 contains a path traversal vulnerability in the system maintenance configuration download handler. The wcfhandledownload function accepts parameters prefixed with vdel and appends their values directly to the base configuration directory path without...

CVE-2026-80842: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: bridge: mcast: fix use-after-free of a master VLAN's multicast context brmulticasttoggleonevlan clears BRVLFLAGMCASTENABLED under br-multicastlock before stopping a VLAN's multicast context. That is the teardown handshake:...

CVE-2026-80804: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: xfs: restore nofs context unconditionally in xfstransroll When xfstranscommit fails in xfstransroll, the NOFS context is cleared but only restored in the success path. This leaves the error path without nofs protection, causing a...

CVE-2026-85606: Improper Limitation of a Pathname to a Restricted Directory

firecrawl-mcp-server 3.20.2 contains an arbitrary local file read vulnerability in the firecrawlparse tool that accepts unconstrained filePath arguments without directory containment validation. Attackers can supply absolute paths or directory traversal sequences to read sensitive files like...

Linux Distros Unpatched Vulnerability : CVE-2026-80842

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: bridge: mcast: fix use-after-free of a master VLAN's multicast context brmulticasttoggleonevlan clears BRVLFLAGMCASTENABLED under br-multicastlock before...

PT-2026-85729

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists when deleting PDP contexts. PDP contexts can be deleted via GTP CMD DELPDP or during the unregistration of the GTP network device. While the latter is serialized ...

CVE-2026-6071 Code Execution Vulnerability in Arena®

A remote code execution security issue exists in the affected products when parsing DOE files that could allow a remote attacker to write past the end of an allocated object and execute code within the context of the current process. To exploit this vulnerability, a legitimate user must visit a...

CVE-2026-6071 Code Execution Vulnerability in Arena®

A remote code execution security issue exists in the affected products when parsing DOE files that could allow a remote attacker to write past the end of an allocated object and execute code within the context of the current process. To exploit this vulnerability, a legitimate user must visit a...