BIT-MONGODB-2026-13055 Server crash via aggregation pipeline expression with compound wildcard index specification

The $internalIndexKey aggregation expression can be used by any authenticated user to crash a MongoDB server mongod. The expression fails to handle compound wildcard index specifications, triggering an internal consistency check that aborts the server process. The user must be able to run an...

kernel: mm: thp: deny THP for files on anonymous inodes

A flaw was found in the Linux kernel's Transparent Huge Pages THP mechanism. This vulnerability occurs because the filethpenabled function incorrectly allows THP for files on anonymous inodes, which are not designed for this feature. An attacker could potentially exploit this by manipulating...

bind: bind9: Unexpected exit with NSEC and NSEC3 both present

If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof...

bind9: bind: Potential wildcard CNAME RPZ policy bypass

A flaw was found in BIND 9, a widely used Domain Name System DNS software. A remote attacker could exploit this by sending specially crafted, excessively long DNS queries. This could bypass Response Policy Zone RPZ rules, which are designed to block access to malicious domains, and potentially...

libreswan: badly formatted X.509 certificate can cause an assertion failure that crashes the daemon process

A flaw was found in Libreswan. An unauthenticated remote attacker can send a specially crafted X.509 certificate payload during an IKEv1 or IKEv2 exchange. This flaw occurs when Libreswan is operating in FIPS Federal Information Processing Standards mode and processing a certificate with an inval...

389-ds-base: 389-ds-base: NULL pointer dereference in deref control plugin BER parser

A flaw was found in 389 Directory Server. The dereference control plugin does not check for allocation failure before using a BER structure, allowing an unauthenticated remote attacker to crash the LDAP server when the system is under memory pressure...

389-ds-base: 389-ds-base: NULL pointer dereference in deref control plugin BER parser

A flaw was found in 389 Directory Server. The dereference control plugin does not check for allocation failure before using a BER structure, allowing an unauthenticated remote attacker to crash the LDAP server when the system is under memory pressure...

389-ds-base: 389-ds-base: NULL pointer dereference in deref control plugin BER parser

A flaw was found in 389 Directory Server. The dereference control plugin does not check for allocation failure before using a BER structure, allowing an unauthenticated remote attacker to crash the LDAP server when the system is under memory pressure...

PT-2026-76854

This issue was addressed through improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash...

PT-2026-76820

Deskflow is a keyboard and mouse sharing app. From 1.17.0 until continuous build 1.26.0.296, a malicious Deskflow server can send an odd-length DSOP vector to ServerProxy::setOptions in src/lib/client/ServerProxy.cpp, causing the missing value after the final option key to be read beyond the vect...

PT-2026-76852

This issue was addressed through improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash...

PT-2026-76849

Name of the Vulnerable Software and Affected Versions iOS versions prior to 18.7.10 iPadOS versions prior to 18.7.10 iOS versions prior to 26.6.1 iPadOS versions prior to 26.6.1 macOS Tahoe versions prior to 26.6.2 Description Processing maliciously crafted web content in Safari may lead to an...

PT-2026-76863

Name of the Vulnerable Software and Affected Versions iOS versions prior to 26.6.1 iPadOS versions prior to 26.6.1 macOS Tahoe versions prior to 26.6.2 Description Processing maliciously crafted web content may lead to an unexpected Safari crash. This issue is caused by improper state management,...

PT-2026-76848

This issue was addressed through improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash...

CVE-2026-68004

An issue in OSSRS SRS Simple Realtime Server...

The vulnerability of the `csio_scsi.c` component in the Linux operating system’s kernel allows a hacker to trigger a service failure.

The vulnerability of the csioscsi.c component in the Linux operating system’s kernel is related to pointer dereferencing errors. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the driver/cpuidle/cpuidle.c component in the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the drivers/cpuidle/cpuidle.c component in the Linux operating system is related to pointer arithmetic errors. Exploiting this vulnerability can allow an attacker to cause a service failure...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099701)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099701 advisory. In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: fix endpoint use-after-free in rmnetdellink rmnetdellink removes the endpoi...

PT-2026-76836

Name of the Vulnerable Software and Affected Versions Safari versions prior to 26.6.1 iOS versions prior to 18.7.10 iPadOS versions prior to 18.7.10 iOS versions prior to 26.6.1 iPadOS versions prior to 26.6.1 macOS Tahoe versions prior to 26.6.2 Description A use-after-free issue exists in the...

PT-2026-76843

An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash...