CVE-2026-64356 xfs: fix memory leak in xfs_dqinode_metadir_create()

In the Linux kernel, the following vulnerability has been resolved: xfs: fix memory leak in xfsdqinodemetadircreate If xfsmetadircreate fails in xfsdqinodemetadircreate, the current code returns directly, leaking the allocated update and transaction state. If the subsequent commit fails, the...

GHSA-FWJX-9P69-H25H

creationtimestamp| type| source ---|---|--- 2026-07-25 08:31:11+00:00| seen| https://gist.github.com/alon710/6f3f1af38179861cbb241baf278fc776...

GHSA-6XJ8-QV9J-XCJQ

creationtimestamp| type| source ---|---|--- 2026-07-25 07:31:13+00:00| seen| https://gist.github.com/alon710/e9c3b68dd2dd0898bdce9f4d836eceff...

GHSA-HMJ8-5XMH-5573

creationtimestamp| type| source ---|---|--- 2026-07-25 05:31:39+00:00| seen| https://gist.github.com/alon710/610364d1088c3e73d54d1422be1a22f2...

GHSA-JVXP-QMX7-GJPX

creationtimestamp| type| source ---|---|--- 2026-07-25 04:31:18+00:00| seen| https://gist.github.com/alon710/5da01f85fee825f05b5c606f0085a6c9...

GHSA-MH99-V99M-4GVG

creationtimestamp| type| source ---|---|--- 2026-07-25 03:24:18+00:00| seen| https://gist.github.com/BrendanPatric/94f86501f020c7775dbd8239cf371c2e 2026-08-28 09:35:37+00:00| seen| https://gist.github.com/konard/4ba388beb31caacd09fbc15019f8e274...

CVE-2026-60134

creationtimestamp| type| source ---|---|--- 2026-07-25 00:00:28+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrgkqnv2yo2q...

Linux Distros Unpatched Vulnerability : CVE-2026-64485

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: compress: Fix task creation error unwind sndcomprtasknew allocates the driver task before validating the returned DMA buffers and reserving file...

PT-2026-64548

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the USB gadget functionfs module where the epfile-in variable is initialized too late. Specifically, epfile-in was only populated within the ffs func eps enable...

Linux Distros Unpatched Vulnerability : CVE-2026-64356

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xfs: fix memory leak in xfsdqinodemetadircreate If xfsmetadircreate fails in xfsdqinodemetadircreate, the current code returns directly, leaking the allocated...

GHSA-3WP3-XXJ9-5JQQ

creationtimestamp| type| source ---|---|--- 2026-07-24 22:35:49+00:00| seen| https://gist.github.com/alon710/9bcf9d1bd3d7650ebf44f14eff2dc08a...

CVE-2026-66138

creationtimestamp| type| source ---|---|--- 2026-07-24 22:33:31+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mrgfv6yufv25...

GHSA-86CX-WWF4-PHQ4 OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API

Summary An authorization bypass vulnerability exists in the file sharing mechanism of Openlist. Due to a flawed, non-separator-aware path validation check, an authenticated user can create share links for files outside their restricted base directory. This allows an attacker to bypass tenant/user...

CVE-2026-64218

creationtimestamp| type| source ---|---|--- 2026-07-24 22:08:57+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116977233872144830 2026-08-03 09:19:50+00:00| seen| https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities20260803...

GHSA-49H3-CWHJ-4737 Cloudreve: Path Traversal in WOPI PUT_RELATIVE Allows Arbitrary File Creation in Owner Account

Summary Cloudreve's WOPI PUTRELATIVE handler treats X-WOPI-SuggestedTarget as a path, not a filename. It splits the header on / and joins the segments onto the source file's directory with URI.JoinRaw, which feeds Go's url.JoinPath. url.JoinPath resolves ./.. segments, so a slash-bearing target...

Cloudreve: Path Traversal in WOPI PUT_RELATIVE Allows Arbitrary File Creation in Owner Account

Summary Cloudreve's WOPI PUTRELATIVE handler treats X-WOPI-SuggestedTarget as a path, not a filename. It splits the header on / and joins the segments onto the source file's directory with URI.JoinRaw, which feeds Go's url.JoinPath. url.JoinPath resolves ./.. segments, so a slash-bearing target...

CVE-2026-64873

creationtimestamp| type| source ---|---|--- 2026-07-24 20:14:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrg63us7or22...

CVE-2026-54342

creationtimestamp| type| source ---|---|--- 2026-07-24 20:00:32+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrg5dmmkie22...

CVE-2026-7228

creationtimestamp| type| source ---|---|--- 2026-07-24 18:00:04+00:00| seen| Telegram/M-3cLQvPgI-qMEcWYT-wWAA2JFIhIDN85UPqM1dZ7X-wCw 2026-07-25 00:00:09+00:00| seen| Telegram/M-3cLQvPgI-qMEcWYT-wWAA2JFIhIDN85UPqM1dZ7X-wCw 2026-08-10 15:00:03+00:00| published-proof-of-concept|...

CVE-2026-65710

sysPass through version 3.2.11 contains a missing authorization vulnerability that allows authenticated users with the PUBLICLINKCREATE profile flag to trigger unauthorized decryption and persistent storage of any vault account's password by exploiting the absence of AccountAcl checks in the publ...